Privacy policy
Privacy Policy & Data Governance
This Privacy Policy describes how HONG KONG PLUSTOUCH CO., LIMITED ("Data Controller", "we", "us"), operating the official portal SUSTORY.com under exclusive worldwide brand authorization from HANGZHOU LUANYING BRAND MANAGEMENT CO., LTD., collects, processes, and safeguards personal information across our global storefronts (including sustory.com, sustory.de, and sustory.fr).
1. Personal Data We Collect
- Order Fulfillment Data: Recipient name, encrypted shipping address, email, phone number, and customs declaration requirements.
- Payment Integrity: Transactions are handled via Level 1 PCI-DSS certified processors (Stripe, PayPal). Raw credit card numbers and CVV codes are never stored on our servers.
- Device & Telemetry Data: IP address, device telemetry, browser locale settings, and anonymized performance metrics.
2. Billing Descriptor & Financial Confidentiality
To protect consumer confidentiality, all financial records and credit card statements are processed with neutral merchant identifiers (e.g., PLUSTOUCH-CO or SUSTORY-RETAIL). No adult novelty terminology is ever transmitted to your banking institution.
3. European Union Rights (GDPR Compliance)
If you reside within the European Economic Area (EEA), you possess enforceable legal rights under Regulation (EU) 2016/679:
- Right to access, modify, or receive a portable export of your personal data.
- Right to erasure ("Right to be Forgotten") within 30 days of submission.
- Right to lodge a complaint with your local EU Data Protection Authority (DPA).
4. California Consumer Privacy (CCPA / CPRA)
Under the California Consumer Privacy Act, California residents have the right to know and opt-out of the sale or sharing of their personal information. SUSTORY does not sell or rent consumer personal data to third-party data brokers under any circumstances.
Frequently Asked Questions About Personal Privacy & Data Security
Q: What exact descriptor will appear on my credit card or bank statement?
Your banking record will display a discreet billing descriptor such as "PLUSTOUCH-CO" or "SUSTORY-RETAIL". Terms referring to adult toys or novelty items will never be transmitted to your bank or card statement.
Q: Does SUSTORY sell, rent, or trade customer contact details?
Never. We operate under strict zero-monetization data policies. Customer shipping information and email addresses are used solely for order delivery and customer care communication. We never sell records to data brokers or advertising networks.
Q: Do you store my credit card details on your servers?
No. All checkouts are processed through certified PCI-DSS Level 1 compliant gateways (Stripe and PayPal). Financial credentials and CVV codes are tokenized and encrypted directly by the payment processor; our servers cannot view or store full card details.
Q: How can I request the deletion of my customer records (GDPR Right to Erasure)?
You may email our compliance desk at service@sustory.com with the subject line "Data Erasure Request". In compliance with GDPR and CCPA, our Data Protection Officer will remove your personal data within 30 days, subject only to statutory accounting retention requirements.
Q: How do I opt out of promotional newsletters or marketing emails?
Every promotional email sent includes an instant one-click "Unsubscribe" link in the footer. Alternatively, email support with your address, and our team will immediately update your preferences.