Privacy Policy

Version 2026-10-05 · In force since 5 October 2026

This page explains what personal information Mia Yiwu collects on miayiwu.com, why we collect it, who sees it, how long we keep it, and the control you have over it. We wrote it in plain language. If anything is unclear, ask us.

1. Who we are
2. What we collect and why
3. Your agreement
4. The WhatsApp assistant and AI
5. Who we share it with
6. Where your data goes
7. How long we keep it
8. How we protect it
9. Your rights
10. Children
11. Cookies
12. Changes to this policy
13. Contact us

1. Who we are

Mia Yiwu (miayiwu.com) is a jewelry and accessories seller based in Yiwu, Zhejiang, China. We are the party that decides how your personal information is used. Our contact details are at the end of this page.

2. What we collect and why

What	Why we use it	How long we keep it
Account: your email address, a one-way scrambled form of your password (we cannot read it), the date you verified your email, the date you created the account, and a record of the policy you accepted.	To create and protect your account, confirm it is really yours, show you your orders and let you reset your password. We need your email to send you order receipts, payment links and updates.	Until you delete your account. Sign-ups whose email is never verified are deleted automatically after 7 days.
Orders: your name, delivery address, phone or WhatsApp number, the verified email, what you ordered, order notes and the order status.	To confirm availability, work out shipping, send your payment link, pack and ship your order, handle customs, and answer questions about it.	For as long as tax, accounting and customs law requires us to keep sales records. If you delete your account, your orders stay in our records but are no longer connected to a sign-in.
Messages through our contact form: your name, email, phone or WhatsApp number, company, topic and message.	To answer your question or wholesale enquiry.	Up to 2 years, then they are deleted automatically. You can ask us to delete them sooner.
WhatsApp conversations: your WhatsApp number and name, the messages you send us, and a text version of voice notes.	To answer your product and order questions through our assistant (see section 4) and to follow up with you.	We keep the history so the assistant remembers your orders and preferences. We delete it when you ask.
Technical data: your IP address and browser details when you visit, and short-lived counters used to stop password guessing and spam.	To keep the site and your account secure and to find faults. We do not use it to track you or to profile you.	Security counters last at most one hour. Standard server logs are rotated automatically.

We do not collect or store your card number. Payments are made on the payment provider’s own secure page, through a link we send you. We only receive confirmation that the payment was made.

3. Your agreement

Before we create your account, or before you send us a message through the contact form, we ask you to tick a box confirming that you have read this policy and agree that we may use your information as described here. The box is never ticked for you. We keep a record of what you accepted: the version of this policy and the date. You can see that record in My account → Privacy & data.

If this policy changes in a way that matters, we ask you to read and accept the new version the next time you sign in. You can withdraw your agreement at any time by deleting your account (see section 9). Information that we must keep by law, such as order records, is not affected by withdrawal.

Some uses do not depend on your agreement because they are necessary to do what you asked, for example using your address to deliver your order, or to meet legal duties such as tax and customs rules.

4. The WhatsApp assistant and AI

When you message our WhatsApp number, an automated assistant can answer questions about products, prices and orders. To do this:

• Your message text is processed by an AI language service (DeepSeek) to write the reply. Product information comes from our own catalogue.
• Voice notes are sent to OpenAI to be turned into text, and messages are checked by OpenAI for abusive or unsafe content.
• Your conversation is stored in our database so the assistant keeps context.

We do not use your data to build or train our own AI models. Replies are automatic and can contain mistakes, so please confirm important details such as prices and shipping with us.

5. Who we share it with

We do not sell your personal information. We share it only with the services that help us run the shop, and only what they need:

• Website hosting: our server is provided by Hostinger (United States).
• Sign-in and database: Supabase hosts the sign-in system (your email and scrambled password), and the data the WhatsApp assistant uses.
• Email delivery: an email delivery service sends our verification emails, receipts and order updates for us.
• Payments: the payment provider whose link we send you (currently WorldFirst) processes your payment under its own privacy policy.
• Shipping: carriers and customs authorities receive your name, address, phone number and the contents of the parcel, so that it can be delivered and cleared.
• AI services: OpenAI and DeepSeek, as described in section 4.
• Messaging: WhatsApp (Meta) carries your messages under its own terms.

The sign-in system also checks a new password against a public list of leaked passwords. Only a short, anonymous fragment of a scrambled version of the password leaves our server, never the password itself.

We may also disclose information when the law requires it, or to protect our rights and the safety of our customers.

6. Where your data goes

We run the shop from China. Our website server is in the United States, our sign-in and database provider stores data in the United States, and our AI providers process data in the United States (OpenAI) and China (DeepSeek). That means your information is stored and processed in countries other than the one you live in, and may be accessed from China. By accepting this policy you agree to these transfers. We choose providers that protect data in transit with encryption.

7. How long we keep it

The table in section 2 shows the retention period for each kind of information. In short: accounts until you delete them, unverified sign-ups 7 days, contact-form messages 2 years, order records for as long as the law requires, and WhatsApp conversations until you ask us to delete them. Copies can remain in our protected backups for a limited time after deletion, until those backups are replaced.

8. How we protect it

• The whole site uses an encrypted (HTTPS) connection.
• Your password is handled only by our sign-in provider, which stores a one-way scrambled form. We never see it, and our staff cannot tell you what it is.
• Every account must prove it owns its email address before it is activated. Verification links work once and expire after one hour.
• Passwords must be long, and are refused if they are common or have appeared in known data leaks.
• Wrong passwords are limited and locked out, and sign-in, password reset and registration forms have protection against automated abuse.
• Changing your password signs you out of your other devices.
• The keys that can read or change customer data are kept on our servers only and never in your browser. Staff accounts are separate from customer accounts and cannot be reached through customer sign-in.
• If we ever discover a breach that affects your information, we will tell you and the authorities as the law requires.

No system is perfectly secure. Please use a password you do not use anywhere else.

9. Your rights

Depending on where you live (for example under the EU and UK GDPR, California law or China’s PIPL) you have rights over your information. We offer them to every customer:

• See and download your data: My account → Privacy & data → Download my data.
• Correct it: update your name and addresses in your account, or ask us.
• Delete it: My account → Privacy & data → Delete your account. This removes your sign-in and saved addresses straight away. For WhatsApp conversations or contact-form messages, ask us and we will delete them.
• Withdraw your agreement, object or ask us to restrict how we use your data: contact us.
• Complain: you can complain to the data protection authority where you live.

We answer requests within 30 days. We may need to confirm it is really you before we act.

10. Children

Our shop is for adults. We do not knowingly collect information from anyone under 16. If you think a child has given us information, contact us and we will delete it.

11. Cookies

We use only the cookies the shop needs to work: your shopping bag, your sign-in, and short-lived security notes. No advertising or tracking cookies. Details are in our Cookie Policy.

12. Changes to this policy

This is version 2026-10-05. When we change it in a way that matters, we update the version and date at the top and ask signed-in customers to accept the new version. The current version is always on this page.

13. Contact us

To use your rights or to ask anything about your privacy, contact us through mia@miayiwu.com. Our address: Yiwu, Zhejiang, China.