WhatsApp enquiries
When you open a WhatsApp enquiry, the link includes the selected product names, options, quantities and public product links. You can review the message before sending it in WhatsApp. We do not create an order, reserve stock or collect delivery or payment details on this website. WhatsApp handles your use of its service under its own privacy policy. References below to test checkout and payment records concern earlier tests; email, cookie and retention information still applies.
Version 1.0 · Last updated and effective: September 11, 2026
This policy explains how HILLOVO handles personal information when you browse hillovo.club, use the shopping bag, submit a test order or contact customer support. It describes the current test shop. Real payments and deliveries are not enabled; sandbox payments may be available. Please use fictional details at test checkout. Sending a customer-support email is a real communication and its contents are stored.
1. Who is responsible and how to contact us
HILLOVO is the operating name of this shop. The person or people operating the shop under that name determine why and how the shop uses your information. HILLOVO is used here as a shop name, not as the name of a registered company.
For privacy requests and customer support, email support@hillovo.club. Please use “Privacy request” in the subject and tell us which information or interaction your request concerns. We do not currently publish a business postal address; email is the available contact channel.
2. Information you provide
- Test orders: the name, email address, street address, apartment or unit, city, region, postal code and country that you enter; selected products, variants and quantities; sample amounts, order number, order status, order time and any demonstration tracking details.
- Customer support: your sender name and email address, reply address, recipients, subject, message contents, attachments, email headers and timestamps. We store incoming and outgoing messages together under the sender's email address, including a copy of the original incoming email, to preserve the conversation.
- Privacy requests: the contact information, relevant order or message references and limited verification information needed to identify and handle your request.
Browsing does not require a customer account. The shop has no customer password registration, social login or payment-card form. Please do not send passwords, identity documents, full card details or sensitive personal information through checkout or email unless we have explained why specific information is necessary.
3. Information processed when the website runs
The website and its infrastructure provider process network and request information needed to serve pages and protect the service. This may include an IP address, browser or user-agent information, requested URL and query parameters, request time, response status, errors and performance information. Search terms and order links can appear in requested URLs. Keep your order link private because it can give its holder access to that test order.
The shop uses identifiers to maintain the shopping bag, saved objects, language preference and administrator sessions. For administrator login rate limiting, it stores an IP-address digest, an attempt count and an expiry time. A digest is a security measure, not a guarantee that information is anonymous.
We do not currently use Google Analytics, advertising pixels, cross-site advertising profiles, device fingerprinting or precise device-location access. We use Cloudflare's operational metrics and logs to maintain and secure the website and email service.
4. Why we use information
- To deliver the pages and features you request, remember shopping-bag and language choices, and demonstrate order processing.
- To receive, investigate and reply to your enquiries and keep the context of customer-support conversations.
- To manage administrator access, prevent abuse and duplicate submissions, investigate errors and maintain reliability.
- To handle privacy requests and meet legal obligations that apply to the shop.
Where a law such as the GDPR requires a legal basis, requested services and enquiries may involve steps you ask us to take before a contract or the performance of an applicable service arrangement. Necessary website operations, support continuity and abuse prevention rely on the operator's legitimate interests, balanced against your rights. Processing required by law relies on that legal obligation. If a separate activity requires consent, we will request it before that activity; reading this policy or simply visiting the website is not consent to optional marketing or tracking.
5. Cookies and your choices
- shanli: maintains the shopping bag, saved objects and form-security state. Its browser lifetime is up to 30 days and may be refreshed when you use the site. Its contents are signed, not encrypted; it is not intended to contain checkout contact or address details.
- hillovo_language: remembers your selected language for up to 365 days and is refreshed when a language page is visited.
- shanli_admin: applies to administrators only, maintaining a login for up to 8 hours. Logging out revokes the server session and clears this cookie.
These cookies are used for site functions and preferences, not advertising. You can delete or block them in your browser. Blocking functional cookies may prevent the shopping bag, saved objects, form submission or administrator login from working; blocking the language cookie means the site may not remember your language. The site does not currently have a separate cookie-consent manager or optional advertising cookies. Cloudflare may process additional technical signals needed for network security under its own service documentation.
6. Service providers, sharing and payment status
We use Cloudflare to host the website, store order and support data, store uploaded files, receive and send email, and provide network security and operational logs. The services currently used include Workers, D1, R2 and Email Service. Cloudflare processes information needed to provide these services. Email replies also pass through your email provider and the email systems needed to deliver them.
We do not sell personal information or share it for cross-context behavioural advertising. Information may be disclosed where required by applicable law or a valid legal request, or where necessary to protect the service and people's rights. A new optional use requiring consent will be explained before information is used for that purpose.
When configured, test checkout uses Waffo Pancake's hosted sandbox. To prepare a test payment, we send the checkout email, product identifier, test amount and currency, order references and a private return URL to Waffo. Delivery addresses entered on this website are not sent to Waffo by this integration. Waffo collects any test billing and payment details directly on its own page and may send test receipts. Use fictional details and test cards only. The store receives signed payment/refund notifications and retains only order references, event identifiers, amounts, tax, currency and processing status for reconciliation. Local test payment records follow the order's 90-day retention period; callback records are deleted 90 days after receipt. Waffo handles information on its own service under its privacy policy, including its own retention and international processing practices. No real charge or shipment is enabled.
7. Storage, transfers and security
The website uses Cloudflare's international infrastructure, so information may be processed outside your country. A single country of storage is not promised. Cloudflare's data processing addendum describes the contractual safeguards and transfer mechanisms that apply to its processing, including standard contractual clauses where applicable. You can contact us for information about the arrangements relevant to your request.
The website uses HTTPS. Administrative access is protected by authentication, session expiry and form-security checks. Customer emails and attachments are available through authenticated administration routes; they are not public product uploads. Email content is displayed as escaped text rather than executing embedded scripts or loading remote tracking images. These measures reduce risk but do not guarantee absolute security or end-to-end encryption of email. If a personal-data breach requires notification, we will notify the relevant authority and affected people within the deadlines required by the applicable law.
8. How long information is kept
- Shopping-bag and preference cookies: the periods in section 5, or until you delete them from your browser.
- Test orders: 90 days after creation, followed by scheduled deletion of the demonstration order record. This does not apply to future real transaction records, whose retention terms will be set before real sales begin.
- Customer-support conversations, original emails and attachments: 730 days (approximately 2 years) after the last incoming message or outgoing reply in the conversation. New correspondence restarts the period for the entire conversation, preserving its context. Inactive conversations are then scheduled for deletion, including their attachments and original emails.
- Administrator access records: a login expires after 8 hours and is revoked on logout. A login rate-limit window is 10 minutes. Expired server sessions and attempt records are removed during daily cleanup or a subsequent successful administrator login. Expiry and physical deletion are separate events.
- Workers application logs: the current paid Cloudflare service provides a rolling retention window of up to 7 days. Email-delivery logs and infrastructure security data are separate and follow the relevant provider service's retention rules.
- Database recovery copies: Cloudflare D1's current paid recovery window is up to 30 days. After deletion from the active database, copies may remain in that limited recovery window before they expire. This is separate from active email-attachment storage.
Scheduled cleanup runs daily in batches. An expired record is removed when its batch is processed; a failed attachment deletion is retained for retry. Clearing browser cookies does not remove server records. You can request earlier deletion using the contact channel below. Requests remain subject to applicable law and provider recovery windows; we do not promise immediate erasure from every provider or backup.
9. Your privacy rights and requests
Depending on the law that applies to you, you may have rights to be informed, access a copy of your information, correct it, request deletion, restrict processing, obtain portable data, object to processing or withdraw consent where processing relies on consent. Withdrawal does not undo earlier lawful processing. Where applicable, you can also opt out of sale or advertising-related sharing; the shop does not currently carry out those activities. We do not use automated decisions that produce legal or similarly significant effects about you.
Email support@hillovo.club with your request. We may ask for proportionate verification, such as replying from the email address involved or providing a relevant order reference. Please do not send identity documents by default. We aim to respond within 30 calendar days and will comply with any shorter legal deadline or explain an extension where the applicable law permits one. Rights can have exceptions; if a request cannot be fulfilled, we will explain the reason. You may complain to the data-protection authority with jurisdiction over your situation and exercise your rights without discriminatory treatment.
10. Marketing and service communications
The shop does not currently operate a marketing newsletter or send promotional email campaigns. Customer-support replies and responses to privacy requests are service communications. If optional marketing is introduced, its sign-up and withdrawal options will be explained separately before it begins; contacting support will not automatically enrol you.
11. Children and third-party websites
The shop and its information-submission features are intended for adults aged 18 or over. Children should not submit personal information. If you believe a child has sent us information, contact support@hillovo.club so that we can review and remove it where appropriate.
Links to external websites lead to services with their own privacy practices. This policy describes the HILLOVO shop's activities, not your email provider's or an external site's independent use of information. Review their notices when using those services.
12. Changes and contact
We will update the date on this page when the policy changes. Material changes will be brought to your attention through a notice on the website before the new activity starts, or by another appropriate channel where required. If a change requires consent, continued use alone will not replace that consent.
Operating name: HILLOVO Website: https://hillovo.club Privacy and customer-support email: support@hillovo.club
To request access, correction or deletion, use that email address and the subject “Privacy request”.
Privacy enquiries: support@hillovo.club