Privacy Policy

Last Updated: May 29, 2026

PRIME MERIDIAN AI HK LIMITED ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile application, or purchase our products (collectively, the "Services").

This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). It also addresses requirements under the Children's Online Privacy Protection Act (COPPA).

1. Information We Collect

1.1 Personal Information You Provide

We may collect the following categories of personal information when you use our Services:

• Contact Information: Name, email address, phone number, shipping address, and billing address.
• Account Information: Username, password, and account preferences.
• Payment Information: Credit/debit card details, billing information (processed through secure third-party payment processors; we do not store full payment card numbers).
• Communication Data: Information you provide when contacting our customer support team, including correspondence and survey responses.
• Product Reviews: Any content you submit in product reviews, testimonials, or feedback forms.

1.2 Information Collected Automatically

When you access our Services, we may automatically collect:

• Device Information: Device type, operating system, browser type, unique device identifiers, and mobile network information.
• Usage Data: Pages visited, time spent on pages, clickstream data, referring URLs, and interaction with our content.
• Location Data: Approximate location based on IP address (city/country level).
• Advertising Identifiers: iOS Advertising Identifier (IDFA) or Android Advertising ID, subject to your consent where required.

1.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Payment processors (confirmation of payment, not full card details).
• Shipping carriers for order fulfillment.
• Analytics providers (e.g., Google Analytics).
• Advertising networks (with your consent where required).

2. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal information based on the following legal grounds:

• Consent: Where you have given explicit consent for specific processing activities (e.g., marketing emails, advertising tracking). You have the right to withdraw consent at any time.
• Contractual Necessity: Processing necessary to fulfill our contract with you, such as processing orders, delivering products, and providing customer support.
• Legal Obligation: Processing required to comply with applicable laws and regulations.
• Legitimate Interests: Processing for our legitimate business interests, such as improving our Services, fraud prevention, and network security, provided such interests are not overridden by your data protection rights.

3. How We Use Your Information

We use the collected information for the following purposes:

• To process and fulfill your orders, including shipping and returns.
• To create and manage your account.
• To communicate with you about your orders, account, and our Services.
• To send marketing communications (with your consent where required by law).
• To improve and personalize your experience on our Services.
• To analyze usage patterns and optimize our website and app performance.
• To detect, prevent, and address fraud, security incidents, and technical issues.
• To comply with legal obligations and enforce our terms of service.

4. Data Sharing and Disclosure

We may share your personal information with the following categories of third parties:

• Service Providers: Payment processors, shipping carriers, IT service providers, analytics providers, and customer support platforms.
• Advertising Partners: With your consent, we may share advertising identifiers with ad networks for personalized advertising.
• Legal Authorities: When required by law, court order, or governmental regulation.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information for monetary consideration. Under CCPA, certain data sharing for cross-context behavioral advertising may be considered a "sale." You have the right to opt out of such sharing (see Section 8).

5. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Information: Retained for the duration of your account plus 12 months after account closure, unless otherwise required.
• Order Information: Retained for 7 years to comply with tax and accounting obligations.
• Marketing Preferences: Retained until you withdraw consent or opt out.
• Usage Data: Retained for a maximum of 26 months.

6. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to certain exceptions.
• Right to Restrict Processing: Request restriction of processing in certain circumstances.
• Right to Data Portability: Request transfer of your data to another controller in a structured, commonly used format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at support@curabay.com. We will respond within one month (extendable by two months for complex requests).

7. Your Rights Under CCPA

If you are a California resident, you have the following rights under the CCPA:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, business purpose, and categories of third parties with whom we share data.
• Right to Delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: Opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your CCPA rights, please contact us at support@curabay.com or submit a request through our website. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

8. App Tracking Transparency (ATT)

Our iOS application uses Apple's App Tracking Transparency framework. When you first launch the app, you will be presented with an ATT authorization prompt requesting your permission to track your activity across other companies' apps and websites for advertising purposes. You have the choice to:

• Allow Tracking: You consent to the app accessing your advertising identifier (IDFA) for personalized advertising and analytics.
• Ask App Not to Track: You decline tracking, and we will not access your IDFA or use it for cross-app advertising.

You can change your tracking preferences at any time through your iOS device settings (Settings > Privacy & Security > Tracking). We only request permissions that are strictly necessary for the functioning of our Services.

9. Children's Privacy (COPPA)

Our Services are not directed to children under the age of 13 (or under 16 in the EEA). We do not knowingly collect personal information from children without verifiable parental consent. If we become aware that a child has provided us with personal information without parental consent, we will take steps to delete such information promptly.

If you believe we may have collected information from a child, please contact us at support@curabay.com.

Where we offer products that may be of interest to families, we ensure age-appropriate labeling and implement parental consent mechanisms as required by applicable law.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using TLS/SSL protocols.
• Secure storage with access controls and authentication.
• Regular security assessments and penetration testing.
• Employee training on data protection and privacy.
• Incident response procedures for data breaches.

While we strive to protect your personal information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including Hong Kong and the United States. When we transfer data from the EEA to countries not deemed adequate by the European Commission, we implement appropriate safeguards, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Binding Corporate Rules (where applicable).
• Other lawful transfer mechanisms as permitted under GDPR.

12. Account Deletion and Data Erasure

You may request deletion of your account and associated personal data at any time. To request account deletion:

• Via Email: Send a deletion request to support@curabay.com from the email address associated with your account.
• Via App: Navigate to Account Settings > Delete Account (if available in your version).

Upon receiving your verified deletion request, we will:

• Delete your personal information from our active systems within 30 days.
• Retain only such information as required by law (e.g., transaction records for tax purposes).
• Notify any third parties with whom we have shared your data, where feasible.

13. Withdrawal of Consent and Authorization

Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To withdraw consent:

• Marketing Communications: Click the "unsubscribe" link in any marketing email or update your preferences in your account settings.
• Tracking/Advertising: Adjust your device settings (iOS: Settings > Privacy > Tracking; Android: Settings > Privacy > Ads).
• Cookie Preferences: Manage cookies through our cookie consent banner or your browser settings.

14. Cookies and Similar Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze usage, and deliver personalized content. For detailed information about the cookies we use and your choices, please refer to our Cookie Consent Banner available on our website.

Categories of cookies we use:

• Essential Cookies: Required for the basic functioning of our website.
• Functional Cookies: Remember your preferences and settings.
• Analytics Cookies: Help us understand how visitors interact with our website.
• Advertising Cookies: Used to deliver relevant advertisements (with your consent).

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a revised "Last Updated" date.
• Sending an email notification (if we have your email address).
• Providing in-app notifications for significant changes.

We encourage you to review this Privacy Policy periodically for any changes.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@curabay.com
• Address: ROOM G3, FLAT B 14/F, WIN SUN MANUFACTURING BUILDING, 2 SAN HOP LANE, TUEN MUN, N.T., HONG KONG

GDPR Representative

For users in the European Economic Area, you may also contact our GDPR representative or lodge a complaint with your local data protection supervisory authority.

CCPA Contact

For California residents, you may contact us at support@curabay.com with the subject line "CCPA Request" to exercise your rights under the California Consumer Privacy Act.

← Back to Home