Privacy Policy

1. Who we are

The Hainaner website and services are operated by Hainaner, referred to as “we”. We are the processor of the personal information described here.

Personal information protection contact: hello@hainaner.com. General legal contact: hello@hainaner.com.

The Chinese version controls; this English version is a courtesy translation.

2. What we process, why, and on what basis

We follow the principles of lawfulness, fairness, necessity and good faith, and process only what is needed for the purposes below.

• Account and sign-in: email, name, password (stored hashed), sign-in codes, session data. Purpose: create and protect your account and verify identity. Basis: necessary to conclude and perform a contract.
• Bookings and participants: participant names, phone numbers, special requests, booking contents and amounts. Purpose: pass the booking to the merchant, confirm, deliver and support the service. Basis: necessary to conclude and perform a contract. For travel products the named traveller list may include identity-document details the licensed provider needs by law, collected only when required.
• Payment: order amount, payment status and the transaction reference returned by the payment provider. Card numbers are collected directly by Stripe; we never see or store full card numbers. Basis: necessary to perform a contract.
• Communications and support: enquiries, complaints, reviews and emails you send. Basis: necessary to perform a contract; reviews are published because you choose to submit them.
• Device and logs: IP address, browser type, access time and error logs. Purpose: network security, abuse prevention and the network-log retention the law requires. Basis: legal obligations and what is necessary to keep the service secure.
• Statistics: first-party visit statistics run only after you agree in Cookie preferences, to learn which pages are useful. Basis: your consent, which you can withdraw at any time.
• Marketing email: sent only if you tick a separate consent, and every message includes an unsubscribe link. Basis: your consent.
• eSIM orders: the email you enter, the plan and quantity, order and payment status, and the eSIM profile the supplier generates once activated (stored encrypted and used only to show you the QR code and installation details). So the purchaser's browser can reopen the order we set a cookie used only for that order and put an access token tied to the order in the email link. Purpose: delivering the eSIM, after-sales and top-ups. Basis: necessary to conclude and perform the contract.
• Travel insurance page: when you click through to an insurer we record the click (the page, the plan and the time). It is linked to your visitor ID or account only if you have accepted analytics cookies. We ask for no personal information on that page. Purpose: matching the referral, settling referral fees and improving the page. Basis: our legitimate business needs and your consent to statistics.

3. Sensitive information and minors

We do not ask for sensitive personal information beyond what is needed for your booking. If you write health or allergy details in a special request, you give separate consent for us to process them only to pass the request to the merchant, who may use it only to provide that service. Identity-document numbers are sensitive personal information; they are collected only when a licensed travel provider is legally required to have them, after separate notice and with your consent.

The service is for adults aged 18 and over. The personal information of a child under 14 is sensitive and needs the guardian's consent; a guardian booking for a minor should make the booking personally and supply only the necessary details. If you believe we collected a child's information without guardian consent, contact hello@hainaner.com and we will delete it promptly.

4. Sharing, entrusted processing and disclosure

We do not sell your personal information. We provide it only in these cases:

• Merchants and service providers: to complete your booking we give the merchant or licensed provider you chose the participant names, contact details and booking contents. They process it as independent processors under their own privacy rules and applicable law.
• Entrusted processors: providers of hosting, database, file storage, email delivery, payments and eSIM supply process data on our instructions and only to provide their service.
• Insurers: we do not give insurers your name, email or other personal information. After you click through, the insurer's page receives only a referral identifier and a random click number; what you enter on its page is handled by the insurer as an independent processor under its own privacy policy.
• Legal cases: when a state authority lawfully requires it, or it is needed to protect life or property.
• Public disclosure: we do not publicly disclose your personal information without your consent. Reviews you post are shown as you choose.

5. Transfers outside mainland China (separate consent)

To provide the service, the recipients below are located outside the People's Republic of China, so your personal information is transferred abroad. We obtain your separate consent, through an option that is not ticked by default, when you first sign in or book. If you do not consent, features that depend on these providers are unavailable, but you can still browse public content.

• Stripe, Inc. (United States and others): online payments. Information sent: email, order amount and currency, order reference.
• Vercel Inc. (United States and others): website hosting and file storage. Information sent: access logs, forms you submit and files you upload.
• Supabase (database hosting, Singapore region): storage of account and order data. Information sent: the categories listed in section 2.
• Resend (United States): delivery of transactional email and sign-in codes. Information sent: email address and message content.
• eSIM supplier (such as Airalo): only if you buy an eSIM, we send it the plan code, quantity and our order reference to activate the eSIM, not your email; the eSIM profile it generates comes back to us and is stored encrypted.

6. How long we keep information

We keep information only as long as needed for the purpose, unless the law requires longer:

• Account data: while the account exists; after closure see section 8.
• Goods and service information and transaction records: at least three years from completion of the transaction (E-Commerce Law).
• Accounting vouchers and ledgers: under the rules on accounting archives, up to thirty years.
• Network logs: at least six months.
• Sign-in codes and unfinished sessions: removed after verification or expiry.
• eSIM orders and the encrypted profile: kept for the retention period of transaction records; the order's access link works for 180 days from the order and we can revoke it at any time; afterwards you can reopen the order with an emailed code. If you want access to stop sooner, contact us.
• Click records from the insurance page: kept until settlement is complete and at most as long as transaction records are kept.
• Marketing subscription: until you unsubscribe.

7. Your rights

You have the right to know about and decide how your information is processed, to access, copy, correct and supplement it, to ask us to transfer it where the conditions are met, to ask for deletion, to ask us to explain our processing rules, and to withdraw consent at any time. Withdrawal does not affect processing done on the basis of consent before it.

You can export your data, correct your profile or close your account from the account page, or write to hello@hainaner.com. We reply within fifteen working days and may first need to verify your identity.

If we refuse a request we will say why. If you are not satisfied you can complain to us, to the competent authority, or bring a claim in a people's court with jurisdiction.

8. Closing your account

You can close your account from the account page after confirming with an emailed code. If you have unfinished bookings or are the only owner of a merchant, those must be dealt with first. On closure we replace your name, email, phone, enquiry content and other identifying details with anonymous placeholders, end sign-in and cancel subscriptions.

To meet statutory transaction, financial and audit retention duties, orders, payments, refunds, invoices and related records are kept for the legal period but are no longer shown linked to anything that identifies you. If you register again with the same email you get a fresh account.

9. Automated decisions

Search ranking and recommendations are generated automatically from page content and your current browsing context and do not result in different terms for your transactions. If you prefer no personalised suggestions, decline statistics in Cookie preferences or browse by category. Decisions that significantly affect your rights are not made by automated means alone.

10. Cookies and local storage

See the Cookie Notice.

11. Security and incident notification

We use encryption in transit, access control, least privilege, audit logging and rate limiting. If personal information is, or may have been, leaked, altered or lost, we take remedial action immediately and notify the authorities and affected individuals as the law requires.

12. Changes, contact and complaints

Material changes are announced on the site or by email, and where consent is required we ask again.

Contact: hello@hainaner.com. You can also call 12315 or complain to the competent authority.