Privacy Policy: what we collect, how long we keep it, and your rights
This policy explains what personal information PIKABAO collects, how it is used and protected, how long it is retained, and how you can request access, corrections or deletion. Read the applicable rules in the context of how you use your account.
1. Scope and Data Controller
This Privacy Policy applies to the site and account services of PIKABAO Virtual Cards. Data processing is the responsibility of Pikabo Technology Co., LIMITED, incorporated in the Hong Kong Special Administrative Region of the People's Republic of China, with Business Registration Number 76366002.
Check the operator and business registration details on the compliance information page and use its official lookup links for verification. Business registration is not a financial licence or a fund guarantee.
2. Information Collected
Categories of Information Collected
| Information category | Specific content | When collected |
|---|---|---|
| Account information | Registration email, account identifier and login credentials | At registration and login |
| Card application details | Name, ID number and basic details | Entered once at the first card application |
| Funding records | Top-up orders, arrival records and balance-allocation records | At top-up and allocation |
| Card and transaction records | Card status, limit settings, merchant transaction records and the last four digits of the card number | At card issuance and for each transaction |
| Login and communication records | Login time, access IP, key-action logs and customer-service correspondence | At login, on actions and when you contact us |
Collection follows the principle of minimal necessity: information unrelated to the services is not collected. Card application details are entered only once, at the first card application; see Registration and Card Application Guide for how to fill them in.
3. Data Not Collected
- We do not require ID photo uploads, do not use facial recognition and do not request images of your ID.
- We do not obtain precise device location, and we do not access your contacts, photo album or microphone.
- We do not integrate third-party advertising tracking, and we do not sell or rent personal information.
4. How the Information Is Used
- Providing the services: card issuance, top-up, allocation, card management and record queries.
- Risk control: identifying abnormal logins, abnormal transactions and duplicate registrations.
- Compliance review: completing reviews and record retention as required by upstream institutions and applicable law.
- Customer service: retrieving relevant records when you submit an issue or when a transaction dispute arises.
6. Retention Periods and Principles
Retention Principles by Information Category
| Information category | Retention principle |
|---|---|
| Account information | Retained while the account is active; processed irreversibly after closure as required by compliance rules |
| Card application details | Retained for a further period after the service ends, per payment compliance and the issuing institution's requirements |
| Transaction and card records | Retained long-term under general payment compliance requirements, for statement reconciliation and dispute review |
| Login and communication records | Used for security investigation and issue follow-up; deleted once no longer needed |
Specific periods follow applicable law and the requirements of upstream institutions, and information no longer needed beyond the required period is not retained.
7. Data Protection Measures
- Encrypted transmission: the site and account pages use HTTPS for all transmission.
- Credential protection: login credentials are not stored in plain text, and the platform cannot read the plaintext of your password.
- Minimized display: card lists show only the last four digits of the card number.
- Access auditing: key actions in your account and backend access are logged.
8. Your Rights, Cookies and Changes to This Policy
- Access: view the status of your card application details, transaction records and card records in your account.
- Correction: submit a correction request if your name or ID number was entered incorrectly.
- Copy: you may request a copy of your account information and transaction records.
- Deletion and closure: you may close your account, except for records that must be retained by law.
Identity verification is required to exercise the rights above. The site uses necessary local storage to maintain your login state and interface preferences; it does not contain sensitive card information, is not used for cross-site tracking, and no ad-retargeting tracking technologies are used on the site. Material changes to this policy will be announced via in-site notification before they take effect. If you have questions, submit them through the Help Center, and do not send your full card number, security code or email verification code in messages.
Access, correction and copy requests
Specify the fields, record scope and action requested when exercising data rights. This guidance does not expand or restrict policy rights, exceptions or retention duties.
Define the request
Identify account data, date range or transaction records. For correction, name the field and accurate value; avoid conflicting submissions through different channels.
Complete identity checks
Verify the requester through official channels using only required evidence. Do not send passwords, one-time codes or complete payment credentials in messages.
Keep the response
Keep the request date, ticket number and reply. Legally retained records are not erased immediately on closure; check the scope against the policy and response.
Data display and the limits of security checks
Visible features have limited evidential scope. Masking, certificates and profile pages alone do not establish backend storage, access permissions or third-party handling.
Masked card numbers
Shows that the current page hides complete fields, not that the backend never stores a number or that every internal role is denied access.
Transport protection
HTTPS protects browser-to-site transport, not devices, backend storage or fund arrangements. Domain verification remains necessary.
Reporting concerns
For abnormal access or suspected exposure, keep the time, prompt and redacted screenshots and report officially without distributing complete credentials.
FAQ
What personal information is required to apply for a card?
Your name, ID number and basic details, entered only once at the first card application. The site does not require you to upload a photo of your ID, nor does it require facial recognition.
Will my information be sold to third parties?
No. The platform does not sell or rent personal information and does not integrate third-party advertising tracking.
Will my details be deleted immediately after I close my account?
Transaction and card application records that must be retained by law continue to be kept for a period, which is a general requirement of payment compliance.
How can I see what information the platform has stored about me?
In your account you can view the status of your card application details, transaction records and card records; for more complete records, submit an access request, which will be processed after identity verification.
Does the site use my browsing data for advertising?
No. The site does not use ad-retargeting tracking technologies and does not share browsing data with advertising networks.
What should I do if I notice abnormal logins on my account?
Report it as soon as possible through the in-site channels; the platform will freeze the relevant operations and review.