Privacy Policy

01Who is responsible for your data

The data controller is HaulMio, registered at Hong Kong SAR.

Privacy contact: hello@haulmio.com

02Scope

This policy covers the HaulMio website, customer account, request form, quotes, orders, payment flow, support messages, and transactional email. It does not cover a seller's, carrier's, PayPal's, or Google's own handling of your data.

03What we collect

Information you give us

• name, email address, password (stored as a hash), and account preferences;
• delivery name, phone number, address, postal code, and country;
• request details: product links, photos, specifications, quantity, budget, timing, and notes;
• quote, order, payment, refund, and cancellation details;
• messages you send to us and photos or documents you upload; and
• marketing preferences and consent records.

Information from third parties

• Google sign-in identifier and basic profile if you choose Google;
• PayPal payment status, payer identifier, capture/refund identifiers, and shipping address if you pay or use PayPal;
• seller, warehouse, and carrier updates about your item or parcel; and
• fraud-prevention, chargeback, or compliance information from payment providers.

Information collected automatically

• IP address, browser type, device type, pages viewed, and timestamps;
• authentication and cart cookies;
• error and security logs; and
• aggregate analytics if Plausible is enabled.

We do not intentionally collect special-category data (such as health data). Please do not send it to us unless we ask for it for a specific legal reason.

04Why we use your data

We use personal data to:

• create and manage your account;
• review requests, source items, and prepare quotes;
• purchase items on your behalf and handle warehouse, checking, packing, and shipping;
• process payments, refunds, chargebacks, and fraud checks, and share shipment tracking with payment providers;
• provide customer support and respond to messages;
• send transactional email (request received, quote ready, payment, shipping);
• comply with tax, customs, accounting, and legal obligations;
• protect the site, staff, customers, and carriers; and
• send marketing only where you have opted in or where the law allows it.

05Legal bases (EU/UK GDPR)

Where GDPR or UK GDPR applies, we rely on:

• contract — to provide the service you requested;
• legal obligation — tax, customs, accounting, and fraud-prevention duties;
• legitimate interests — operating and securing the service, preventing fraud, and improving the customer experience, balanced against your rights;
• consent — marketing and any optional feature that asks for it; and
• vital interests — only in an emergency.

You can withdraw consent at any time. Withdrawal does not affect processing that already happened.

06Who we share data with

We share only what is needed for the relevant purpose:

We do not sell personal data. We do not share data for cross-context behavioural advertising.

07International transfers

Our production database and hosting are in the United States. If you are in the EU, UK, or another region with transfer restrictions, your data may be transferred to the United States and to sellers or carriers in China.

Where required, we rely on appropriate safeguards such as the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. Contact us for a copy of the relevant safeguard.

08How long we keep data

We keep data only as long as needed for the purposes above, then delete or anonymise it. Expected periods:

We may keep data longer if a legal hold, customs inquiry, insurance claim, or dispute requires it.

09Security

We use access controls, row-level security in Supabase, encrypted connections, private storage buckets, staff permissions, and audit logs. No system is completely secure. If we become aware of a breach that affects your rights, we will notify you and the relevant authority where required by law.

10Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete data, subject to legal retention;
• export or port your data;
• restrict or object to certain processing;
• withdraw consent;
• object to direct marketing; and
• complain to a supervisory authority.

EU/UK: you can complain to your local data-protection authority or the relevant supervisory authority.

California and other US states: you may have rights to know, access, delete, correct, or opt out of sale/sharing. We do not sell personal data. We will verify your request and use an authorised agent process where applicable.

To exercise a right, email hello@haulmio.com. We may ask for information to verify your identity. We will respond within the time required by law.

11Cookies and analytics

We use essential cookies for sign-in, security, and the cart. These are needed for the service to work.

If Plausible is enabled, it provides aggregate analytics without advertising cookies or cross-site tracking. PayPal and Google may set their own cookies when you use their flows; their policies apply.

You can control cookies in your browser. Blocking essential cookies may prevent sign-in or checkout from working.

12Marketing

We send marketing only with consent or where the law permits. You can opt out using the unsubscribe link or by emailing hello@haulmio.com. Transactional messages about a request, quote, payment, or shipment are not marketing and will still be sent.

13Children

The service is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided data, contact us and we will delete it.

14Changes

We may update this policy. If a change is material, we will post it here and, where appropriate, notify you by email or on your request page. The "Last updated" date shows the current version.

15Contact

Privacy questions or requests: hello@haulmio.com. Data controller: HaulMio, registered address: Hong Kong SAR.