Nfxbus Privacy Policy

This Privacy Policy explains how NFXBUS collects, uses, shares, stores and protects personal information when you browse our website, use an account, purchase a service plan, request support or participate in our referral program. It also explains your choices and how to make a privacy request. It is a notice about our data practices, not permission to collect unrelated information or a substitute for consent where consent is required.

1. Who is responsible for your information?

NFXBUS is operated by Hong Kong Sinda Information Technology Co., Limited, which is responsible for the personal information it handles for the purposes described here. Depending on the applicable law, our role is described as a data user or data controller.

Contact address: Room 12, 3rd Floor, Beneficial Centre, 45 Kai Yuen Road, Kwun Tong, Kowloon, Hong Kong.

Website: https://www.nfxbus.com/. For privacy enquiries, use our official website support channels or send a written request to the address above, marked “Privacy Request”. Section 15 explains the information to include.

2. What does this policy cover?

This policy covers information processed by NFXBUS through its website and related account, order, support and referral features. It distinguishes our own processing from the activities of third-party payment, authentication, messaging and digital-service providers.

When you use a third-party product or follow an external link, that provider may handle information under its own privacy notice. Buying a plan through NFXBUS does not place all information held by the third-party provider under our control. Our Terms of Service describe the commercial relationship; they do not replace this policy or any separate privacy choice required by law.

3. Information we collect

The information needed depends on the feature you use. Browsing the catalog does not require the same information as paying for an order or requesting a commission payout.

• Account and authentication information: email address, account identifier, display name, avatar when supplied, authentication credentials or verification information, login status and details returned by an authentication provider. Authentication tokens are different from your password for that provider.
• Orders and payments: product and plan selections, usage term, account or seat options, order and transaction identifiers, amount, currency, discount codes, payment method, payment or refund status and related correspondence. Depending on the payment method, a form may also require your name, phone number, card number, expiry date and security code; see Section 6.
• Delivery and account access: the email or service-account identifier used to receive an invitation, activation information and details required to fulfil the selected product. Certain account top-up or upgrade workflows request a service-account password and backup codes. These are particularly sensitive and should be supplied only through the designated workflow when necessary for the requested service.
• Support and uploads: ticket details, messages, replies, selected account information, screenshots, images, attachments and information you choose to provide in live chat. Files may contain metadata or personal information visible in the image, so review and redact them before uploading.
• Referral and payout information: invitation identifiers, referral codes, attributed order records, commission amounts and status, available balance, withdrawal requests and the PayPal receiving email entered for a payout.
• Public contributions: the name, avatar, country label, rating and review text associated with a review submitted for publication. Publicly displayed information can be read or copied by other visitors.
• Technical and browser information: IP address, request times, browser and device information provided with a request, language preferences, visited pages or requested features, error information and cookies or similar identifiers. The exact technical information depends on the relevant browser, server and provider.

Please do not submit unrelated identity documents, health information, other people’s private data or financial credentials in a general support message. If a particular verification requires additional information, its purpose and necessary scope should be explained at collection.

4. Where information comes from and whether it is required

We receive information directly from forms, account settings, orders, uploads and support conversations; automatically from website requests and browser storage; and from selected authentication, payment and fulfilment providers. Referral links and order records may also connect an invitation identifier to an account or transaction.

Fields required to authenticate an account, take payment, deliver the chosen plan or investigate a request are necessary for that feature. If you do not provide them, we may be unable to complete it. Optional profile information or a choice about marketing should not be made a condition of an unrelated purchase. Where you provide someone else’s information, you must have an appropriate basis to do so and provide only what is necessary.

5. How we use information and the basis for processing

We use relevant information to create and secure accounts; verify sign-ins; process orders, payments and refunds; deliver or manage the service you chose; answer support requests; administer referral records and payouts; prevent misuse; maintain and troubleshoot the website; and meet applicable recordkeeping, dispute-handling and legal requirements.

Where the GDPR or another law requiring a specified lawful basis applies, processing may be necessary to perform a contract or take requested pre-contract steps, comply with a legal obligation, pursue legitimate interests such as proportionate fraud prevention and service security, or act on your consent. Legitimate interests require consideration of your rights. A separate legal condition is required for any processing that needs it; accepting general terms is not blanket consent.

We do not use information collected for an order as unrestricted permission for unrelated purposes. A materially different purpose requires the further notice, lawful basis or consent that applicable law demands.

6. Payment information and sensitive fulfilment details

Orders are paid once for the selected usage term. NFXBUS does not automatically renew your plan or deduct recurring fees. Supplying payment details or accepting this policy does not create a standing payment instruction.

For a redirected or hosted payment method, the payment provider collects the information requested on its payment page. For certain enabled card methods, details are entered on an NFXBUS form and transmitted through our service and payment-processing backend for authorization. We therefore do not claim that card information always bypasses our systems. Temporary form data and payment transaction records serve different purposes. Clearing a checkout form does not delete records held independently by the payment provider.

Card security codes are for transaction authorization, not for retention as account credentials or for recurring billing. Payment records needed for accounting, refunds or disputes are different from security codes. Do not send a full card number, security code, banking password or one-time banking code through a public review or ordinary support chat.

If a particular top-up or upgrade requires service-account access details, their use must remain limited to fulfilling and supporting that request. Provide only the requested details for the specified service, not unrelated account passwords. You may seek clarification before supplying them, and should review account access or change credentials after fulfilment where appropriate. We cannot administer or delete information held independently by the third-party service merely because you bought a plan from us.

7. Cookies and similar browser storage

Cookies store small pieces of information in your browser. The current NFXBUS storefront uses the following first-party cookies:

Cookie	Purpose	Configured lifetime
nfxbus_session	Maintains the authenticated account session and related authentication state. It is configured as HttpOnly, with secure transmission on public hosts.	7 days for the configured session, subject to replacement, renewal, logout or earlier invalidation.
nfxbus-language	Remembers the language you select.	365 days, unless replaced or deleted earlier.
nfxbus_referral	Remembers a valid invitation identifier supplied through a referral link.	30 days, unless replaced or deleted earlier.

A cookie lifetime describes browser storage, not how long every associated order or account record is retained. A referral cookie also does not, by itself, promise a commission or determine every eligibility rule.

Authentication, payment and chat providers may use their own storage when their components or pages are loaded. Their lifetimes and purposes depend on the provider. We do not describe every third-party technology as essential merely because it appears on a page.

You can inspect, block or delete cookies through your browser settings. Removing an authentication cookie may sign you out; removing preference or referral storage may affect the associated feature. Where non-essential storage requires consent, it must be subject to the applicable choice before use. Any additional optional tracking is subject to the notice and choices required by applicable law.

8. Third-party login and live support

The storefront offers Google, Facebook and Kakao sign-in options. When an authentication component loads, your browser may contact the provider and transmit technical request information. If you proceed with sign-in, we receive the identity or authorization information made available for the selected permissions, such as an identifier, email address or display name. We do not receive your third-party password through the ordinary social-login process.

You can review connected-app permissions with the relevant provider and revoke them there. Revoking that connection does not automatically delete NFXBUS order records or close your NFXBUS account; request those actions separately where needed.

Live support uses Crisp. In the current storefront, its chat script is loaded when you request chat, or you may open its hosted chat link. Crisp can process the conversation, information you enter, attachments and technical or session data needed for chat. You may instead use an available support ticket or write to our contact address. Do not assume that closing the chat window erases a conversation.

Provider information is available in the Google Privacy Policy, Meta Privacy Policy, Kakao Privacy Policy and Crisp Privacy Policy.

9. When information is shared

Information is shared only to the extent appropriate to the relevant purpose and subject to applicable requirements:

• Operational providers: hosting, infrastructure, technical support, communications and other providers helping deliver or secure the website, with access limited to their relevant role.
• Payment and payout providers: information needed to authorize a payment, confirm a transaction, process a refund, assess a payment dispute or send a requested commission payout.
• Authentication and fulfilment providers: information needed for the sign-in you choose, an invitation, an activation or the service-account operation you request.
• Referral participants: where an order is attributed to a referral, commission records may display a buyer account or email identifier alongside an order number, amount, commission, status and date. Do not assume that a referred purchase is anonymous to the referrer. This does not authorize disclosure of card details, passwords or unrelated support messages.
• Other visitors: information submitted for publication in a review, as distinct from private support content.
• Legal and professional recipients: competent authorities, courts, advisers or relevant counterparties where necessary and lawful to meet an obligation, investigate misuse or establish, exercise or defend legal rights.
• Business transfers: where a lawful reorganization or transfer affects the operation, necessary information may be disclosed under appropriate protections and any required notice or choice.
• A separate request or consent: a further disclosure that you request or validly authorize, where required.

We seek to limit disclosure to information relevant to the purpose. Shared-service access is not permission to disclose your entire NFXBUS account to other users. When a provider acts independently rather than on our instructions, its own legal obligations and privacy notice also apply.

10. How long information is kept

Information should not be kept longer than needed for the purpose for which it is held, including an applicable legal requirement. Retention depends on the type of information and the circumstances, rather than a single period for all records:

• Account and profile information is used while needed to operate the account and resolve associated requests.
• Order, payment, refund and commission records may remain necessary after a plan ends for accounting, legal obligations, fraud prevention or unresolved claims.
• Support messages and attachments are retained according to the issue, follow-up needs and any dispute or legal hold; unrelated sensitive details should not be retained merely because they were included in a message.
• Authentication and fulfilment secrets should remain accessible only for their necessary purpose and be removed or invalidated when no longer needed, subject to a justified legal requirement.
• Technical logs are retained according to their operational or security purpose and any incident that needs investigation.

When information is no longer needed, it should be deleted or effectively anonymized. Backups or records under a lawful preservation requirement may follow a separate removal cycle and should not be returned to ordinary use without a valid purpose. You can ask about the retention criteria applying to your information. Closing an account is not a promise that all records disappear immediately, and the continued existence of an account is not a reason to keep everything indefinitely.

11. International processing

Our operator is based in Hong Kong. Depending on the feature and providers involved, information may also be processed in other countries or regions where infrastructure, authentication, payment, support or fulfilment providers operate. Their laws may differ from those in your location.

Where a transfer requires safeguards or another legal mechanism, those requirements must be satisfied before the transfer. Depending on the applicable law, a suitable mechanism may include an adequacy decision or appropriate contractual safeguards. Safeguards depend on the particular transfer and the applicable law. Contact us for information about a transfer relevant to your use and any safeguards or permitted exceptions that apply.

12. Security and incidents

We use measures appropriate to the information and the risks involved, including secure transmission, authenticated access, session controls and checks on submitted information. Access to sensitive account and payment workflows should be restricted to the people and systems that need it. These measures do not make any internet service completely secure.

Protect your login credentials and the email or provider account used to sign in. On shared devices, sign out after use. Redact sensitive information from screenshots and avoid uploading confidential work or personal records to a shared third-party account unless you understand who can access them.

If you suspect unauthorized access or an accidental disclosure, contact us promptly with relevant details, without sending additional secrets. We will assess the incident, take appropriate steps and provide any notice to affected individuals or authorities required by applicable law.

13. Communications and your choices

Order confirmations, delivery instructions, security messages, support replies and legally required notices are different from promotional communications. Where we send direct marketing, we must provide the information and obtain the consent required by applicable law, and allow you to stop that use through the relevant message or support channel.

Declining optional marketing should not prevent an unrelated purchase. Withdrawing marketing consent does not cancel an existing order or prevent necessary service messages. You may also manage browser storage, third-party permissions and the optional profile information you provide. We do not treat acceptance of this policy as blanket permission to sell data or disclose it to unrelated advertisers.

14. Your privacy rights

Depending on the law that applies to your situation, you may request access to your personal information and correction of inaccurate information. Additional rights may include deletion, restriction, an objection to particular processing, portability and withdrawal of consent. These rights have conditions and exceptions; withdrawing consent does not undo lawful processing that occurred beforehand.

Where the GDPR applies, you may also challenge a solely automated decision producing legal or similarly significant effects and seek human intervention where the law provides for it. Automatic eligibility or security checks do not remove rights of review. Contact support if you believe an account or transaction restriction is incorrect.

You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, or the competent authority in your jurisdiction. Where applicable, EU authority contact details are available from the European Data Protection Board. You do not have to complete our internal process before using a remedy available to you by law.

15. How to make a privacy request

Contact us through official website support or by post to the address in Section 1. State the right or action you are requesting, the account or contact email concerned, and enough detail to locate the relevant information. You do not need to make another purchase. Do not include a password, full card details or a verification code in the request.

We may ask for proportionate information to verify identity or authority before disclosing or changing personal information. Verification should not collect more information than necessary. If you act for someone else, evidence of authorization may be required. We may redact other people’s information or explain an applicable legal limit.

We respond within the time required by applicable law. Where the Hong Kong data-access rules apply, the ordinary response period is 40 days after receipt, subject to the relevant statutory provisions. Where the GDPR applies, the ordinary period is one month, with a notified extension only where permitted. Any inability to comply or refusal must be explained as required by law.

Requests are handled without a fee where the applicable law requires this. Any otherwise permitted reasonable fee must have a lawful basis and be explained. A deletion request does not necessarily require immediate deletion of information we must lawfully preserve; where an exception applies, we will explain its effect. We cannot directly erase records controlled independently by another provider, but can identify the relevant route where appropriate.

16. Children and sensitive information

Users must meet the account and purchase eligibility requirements in our Terms of Service. Where a child’s information requires parental authorization or another additional safeguard, that requirement applies separately to the processing concerned. A general terms checkbox does not automatically establish valid parental authorization.

If a parent, guardian or user believes that a child’s information has been provided without an appropriate basis, please contact us so we can assess the situation and take necessary action. Do not send sensitive personal information unrelated to a requested feature or support issue.

17. Changes to this policy

We may update this policy as our services, providers or legal obligations change. The version date identifies the document; it does not establish that every existing user has received a required notice or given a new consent.

Material changes will be communicated in a way appropriate to their effect and any applicable requirement. If a new purpose requires additional consent, it must be obtained before the relevant processing. Continuing to browse does not, by itself, provide consent that the law requires to be freely and specifically given.

18. Contact and related information

Privacy contact: Hong Kong Sinda Information Technology Co., Limited, Room 12, 3rd Floor, Beneficial Centre, 45 Kai Yuen Road, Kwun Tong, Kowloon, Hong Kong. Mark written enquiries “Privacy Request”, or contact NFXBUS support through the official website.

For commercial conditions, see the Terms of Service and Refund Policy. Those documents do not reduce your statutory privacy rights. This is the English-language version of this policy.