Legal · Trust & Transparency
Your Privacy,
Our Promise.
At MOEFAL — Moments of Eternal Faith and Love — we treat your personal information with the same care we put into every bouquet we craft. This policy explains exactly what we collect, why we collect it, and the rights you have over your information.
Last Updated
October 15, 2026
Version 1.3 · Added details about MOEFAL accounts, sign-in with Google and Facebook, phone numbers and account deletion · Effective immediately
SECTION 01
About this Privacy Policy
This Privacy Policy describes how Hong Kong Raylking Trading Co., Limited ("MOEFAL", "we", "us", or "our"), a company registered in Hong Kong SAR, collects, uses, shares, and protects your personal information when you visit www.moefal.com (the "Site"), purchase our products, or interact with us through email, social media, or customer service.
By using our Site or services, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, please do not use our Site.
In plain English
We collect the minimum information needed to fulfill your order, improve your shopping experience, and keep our business running. We never sell your data. You have full control over your information at any time.
SECTION 02
Information we collect
2.1 Information you provide directly
When you create an account, place an order, subscribe to our newsletter, or contact our support team, we collect:
- Identity & contact: name, email address, phone number, billing and shipping addresses. A mobile number is required at checkout so the carrier and our support team can reach you about a delivery.
- Order details: products purchased, order history, special instructions, gift messages
- Payment information: processed by our payment partners — we never see or store full card numbers
- Account credentials (if you create an account): your email address and a password. We never store your password itself — only a salted one-way hash of it. One-time email codes are stored the same way and expire after 15 minutes.
- Communications: messages you send to support, reviews, and survey responses
2.2 Information collected automatically
When you browse our Site, our servers and analytics tools record:
- Device & technical: IP address, browser type and version, operating system, screen resolution, device identifiers
- Usage data: pages viewed, time spent, referring URL, click paths, search terms used on our Site
- Approximate location: derived from your IP address (city or region level — not precise GPS)
- Cookies and similar technologies: see Section 7 for full details
2.3 Information from third parties
We may receive limited information about you from:
- Google and Facebook, if you choose to sign in with them. We receive your name, your email address and an account ID that Google or Facebook creates for MOEFAL. From Facebook we request only the email and public_profile permissions. We do not receive your password, friends list, posts, photos or any other data, and we never post anything on your behalf. If the email address on your Facebook account already belongs to a MOEFAL account, we email you a 6-digit code to confirm it's yours before we link the two.
- Fulfillment and shipping partners — order status and tracking updates from the US warehouse and carrier that ship your order
- Payment processors — confirmation of successful payment, fraud-risk signals
2.4 Your MOEFAL account
An account is optional — you can always check out as a guest and look up an order with your order number and email address.
- Ways to sign in. You can sign in with your email address and a password, with Google, or with Facebook. All three can be used for the same account as long as they share the same email address. You can see and remove sign-in methods under My account → Sign-in methods (at least one must remain).
- Confirming your email. We only show past orders in your account after your email address has been confirmed — by a 6-digit code we email you, or by Google confirming it for us. If you joined with Facebook, you can confirm your email any time from My account.
- What we keep in your account: your email address, name, phone number, saved shipping addresses, which sign-in methods you use, when you joined and last signed in, your marketing preference, and any notes our support team adds to help you.
- Deleting your account. You can delete your account at any time from My account → Delete account (we email you a 6-digit code to confirm it's really you), or by emailing [email protected]. We delete your account, sign-in details, saved addresses and phone number, and take down any reviews you wrote. Records of past orders are kept for tax and accounting purposes (see Section 12) and are no longer linked to an account; you can still look them up with your order number and email address.
- Inactive accounts. We may delete accounts that have not been used for a long time, or accounts that appear to be duplicates, automated sign-ups or in breach of our Terms of Service. When we do, we email you to let you know; you are welcome to sign up again with the same email address.
- If you sign in with Facebook and later remove MOEFAL from your Facebook settings and ask for your data to be deleted, we unlink your Facebook account and delete the Facebook ID we stored. If Facebook was your only way to sign in, we delete your MOEFAL account as described above. You can check the status at moefal.com/facebook-data-deletion/.
SECTION 03
How we use your information
We use the information described above for the following purposes:
| PURPOSE | WHAT WE DO | LEGAL BASIS |
|---|---|---|
| Order fulfillment | Process payments, prepare and ship orders, handle returns, send order confirmations and tracking updates. | Contract performance |
| Your account | Create and secure your account, confirm your email address, sign you in, show your orders and saved addresses. | Contract performance |
| Customer support | Answer your inquiries, resolve issues, process refunds and exchanges. Our team may contact you by email or phone about an order or a request you made. | Contract / Legitimate interest |
| Marketing communications | Send promotional emails about new collections, sales, and wedding tips — only if you opted in (for example the "Email me offers" box when you create an account). Every marketing email has an unsubscribe link. We do not send marketing text messages. | Consent |
| Site improvement | Analyze how visitors use our Site to improve navigation, content, and product offerings. | Legitimate interest |
| Fraud prevention | Detect and prevent fraudulent transactions, unauthorized access, and abuse of our services. | Legitimate interest / Legal obligation |
| Legal compliance | Maintain tax records, respond to lawful requests, enforce our Terms of Service. | Legal obligation |
SECTION 04
Legal basis & your consent
When you place an order or provide your information to complete a transaction, we treat this as your implied consent to collect and use that information for the specific purpose stated.
For any secondary use — such as marketing emails or analytics — we either ask for your explicit opt-in consent or provide a clear option to opt out.
Withdrawing your consent
You can withdraw your consent at any time:
- Marketing emails — click the "unsubscribe" link in any email
- Cookies — accept or decline non-essential cookies via our cookie banner on first visit; manage all cookies through your browser settings at any time
- Account data — sign in and use My account to update your details or delete your account, or contact us at [email protected]
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
SECTION 05
Sharing & disclosure
We do not sell your personal information to anyone. We only share data with the categories of recipients listed below, and only to the extent necessary:
- Service providers who help us run our business (hosting, payment processing, shipping, email delivery, analytics) — see Section 6
- Fulfillment and shipping partners — the US warehouse that packs your order and the carrier that delivers it (such as UPS, USPS, FedEx or DHL) receive your name, shipping address and order contents
- Legal authorities when required by valid legal process (court order, subpoena, government request) or to protect our rights
- Business successors in the event of a merger, acquisition, or sale of assets — your information may be transferred under equivalent privacy protections
No data brokers, no advertising sales
MOEFAL does not sell, rent, or trade your personal information to data brokers, marketing list providers, or any third party for their independent marketing purposes.
SECTION 06
Third-party services we use
MOEFAL is built and operated using the following independent service providers. Each has their own privacy policy governing how they handle your data — we encourage you to review theirs as well.
| Service | Purpose | Data shared |
|---|---|---|
| Cloudflare | DNS management, CDN, security & DDoS protection | IP, request headers, page paths |
| Hetzner Hosting | Web server hosting for the Site | Server logs, IP, browser info |
| Stripe | Processes credit/debit cards, Apple Pay & Google Pay wallets | Tokenized card data, billing address, transaction ID |
| PayPal | Alternative payment processing & PayPal wallet checkout | PayPal account identifier, billing address, transaction ID |
| US fulfillment warehouse & carriers | Order fulfillment & shipping (United States) | Shipping address, products, name |
| Google Analytics | Visit statistics: which pages are viewed and where visits come from (on by default; you can turn it off — see Section 7) | Pseudonymous device identifier, pages viewed, referring site, approximate location |
| Google (Sign in with Google) | Optional sign-in — the "Continue with Google" button, or the Google sign-in prompt shown on the account and checkout pages if you're already signed in to Google in your browser | When you choose it: Google tells us your name, email address and a MOEFAL-specific account ID |
| Meta (Facebook Login) | Optional sign-in | When you choose it: Facebook tells us your name, email address and a MOEFAL-specific account ID |
| Purelymail | Transactional & marketing email delivery | Email address, name, order history |
SECTION 07
Cookies & tracking technologies
Cookies are small text files stored on your device. We also keep a few items in your browser's local storage, such as your cart. This is everything the Site uses:
Strictly necessary
Always on
Keep the Site working: your shopping and checkout session, sign-in, your choice on the cookie note, and Cloudflare security checks. Your cart, checkout draft and recently viewed items stay in your browser's local storage until you check out or sign in.
mf_sid mf_cust mf_oauth mf_oauth_fb mf_fbv mf_reg mf_gnonce mf_li mf_consent · g_state (Google sign-in prompt) · Cloudflare security cookies (for example cf_clearance) · local storage: mf_cart mf_checkout_draft mf_recently_viewed mf_revived
mf_oauth lasts 10 minutes and mf_oauth_fb 15 minutes while you sign in with Google or Facebook; mf_fbv lasts 15 minutes while you confirm your email after signing in with Facebook; mf_reg lasts up to 24 hours while you confirm a new account, so the code only works in the browser where you signed up; mf_gnonce lasts 10 minutes while the Google sign-in prompt is open; g_state is set by Google to remember whether you closed its sign-in prompt, so it isn't shown again too soon.
Analytics
On by default — you can turn it off
We use Google Analytics and our own visit statistics to see which pages and products people look at, where visits come from, and where checkout gets stuck. This runs without any action from you. Choosing Analytics off on the cookie note, or sending a Global Privacy Control signal from your browser, stops Google Analytics and our page-view statistics on that device; we still record cart and checkout steps, which we need to run your order.
_ga _ga_* (Google Analytics) · mf_vid mf_ses (MOEFAL visit statistics)
Advertising
Not used
We do not use advertising or remarketing cookies, and we do not run the Meta Pixel or the Pinterest Tag on this Site.
On your first visit a short note explains this. Got it simply closes the note; Analytics off turns analytics off on that device. Your choice is remembered for six months in the mf_consent cookie, and you can change it at any time from Cookie settings at the bottom of every page. You can also block or delete cookies in your browser settings — blocking strictly necessary cookies may break the cart, sign-in and checkout.
SECTION 08
International data transfers
MOEFAL is operated by a Hong Kong–based company serving customers primarily in the United States. By using our Site, you understand that your information may be processed in jurisdictions outside your own, including:
- Hong Kong SAR — our headquarters and primary data controller
- United States — our payment processors, fulfillment warehouse and carriers, and most marketing platforms
- European Union — some of our service providers may have data centers in the EU
For each transfer, we ensure appropriate safeguards are in place, including Standard Contractual Clauses with our processors and selecting providers that comply with recognized privacy frameworks (such as the EU-U.S. Data Privacy Framework where applicable).
SECTION 09
Data security
We take reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:
- Encryption in transit: all pages and form submissions are secured with TLS 1.3 (HTTPS)
- Passwords and codes: passwords and one-time codes are stored only as salted one-way hashes; database access is restricted to our own servers
- Payment security: card data never touches our servers — it's tokenized and handled directly by PCI-DSS compliant processors
- Access controls: only authorized staff have access to personal data, on a strict need-to-know basis
- Network protection: Cloudflare WAF, DDoS protection, and bot mitigation
- Regular updates: we keep our storefront software and servers patched against known vulnerabilities
While we follow industry best practices, no method of transmission or storage is 100% secure. We will notify affected users and relevant authorities promptly in the event of a personal data breach as required by applicable law.
SECTION 10
Your privacy rights
Depending on where you live, you have the following rights regarding your personal information:
01
Right to access
Request a copy of the personal data we hold about you.
02
Right to correct
Update or correct inaccurate personal data.
03
Right to delete
Request deletion of your account and personal data.
04
Right to portability
Receive your data in a machine-readable format.
05
Right to opt out
Stop marketing communications or sale of personal data at any time.
06
Right to object
Object to certain types of processing based on legitimate interests.
CALIFORNIA RESIDENTS (CCPA / CPRA)
If you are a California resident, you have specific rights including the right to know what personal information we collect, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. MOEFAL does not sell personal information. To exercise your rights, email [email protected] with "California Rights Request" in the subject line.
EU / UK RESIDENTS (GDPR)
If you are in the EU, UK, or Switzerland, you have the rights listed above under the GDPR / UK GDPR. You also have the right to lodge a complaint with your local data protection authority if you believe we have not addressed your concerns.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or 45 days for complex requests, with notification of the extension).
SECTION 11
Children's privacy
Our Site is not directed to children under 16 years of age, and we do not knowingly collect personal information from children. If you are under 16, please do not provide any personal information on our Site without the involvement of a parent or guardian.
If we learn that we have collected personal information from a child under 16 without verified parental consent, we will delete that information promptly. If you believe a child has provided us with personal information, please contact us at [email protected].
SECTION 12
Data retention
We keep your personal information only for as long as needed for the purposes described in this policy, or as required by law:
| DATA TYPE | Data shared |
|---|---|
| Order & transaction records | 7 years (required for tax and accounting purposes in most North American jurisdictions) |
| Account information | Until you delete your account, plus 30 days for backup purges. We may delete long-inactive accounts earlier and will email you when we do. |
| Marketing subscriber list | Until you unsubscribe, plus suppression list (email only) to honor your opt-out |
| Customer support tickets | 3 years from the last interaction |
| Cookies & tracking data | Varies by cookie — see Section 7. Most marketing cookies expire within 13 months. |
| Server access logs | 90 days for security & debugging |
SECTION 13
Updates to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page
- Post a clear notice on our Site for at least 30 days
- Email registered users if the change significantly affects how we use existing data
We encourage you to review this policy periodically. Your continued use of our Site after changes become effective constitutes your acceptance of the revised policy.
SECTION 14
Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, we're here to help.
Get in touch
We aim to respond to all customer service and privacy-related inquiries within 5 business days. For formal data subject requests (access, deletion, portability), we will respond within the statutory timeframe (typically 30 days).
Customer Service & Privacy
Response Window
Within 5 business days · Mon – Fri
Mailing address
Written correspondence regarding privacy matters can be sent to our Hong Kong registered office.
Data Controller
Hong Kong Raylking Trading Co., Limited
Attn: Privacy Compliance Officer
Room P11, Flat 2C, 2/F, Hung To Ctr.,
94-96 How Ming St.,
Kwun Tong, Kowloon,
Hong Kong