WHIMSY App Privacy Policy
Last Updated: April 21, 2026
Table of Contents
- Introduction
- Information We Collect
- Purpose of Information Use
- Information Sharing and Disclosure
- Data Storage and Security
- Your Rights
- Third-Party Services
- Children's Privacy Protection
- Privacy Policy Updates
- Contact Us
1. Introduction
Welcome to WHIMSY APP (hereinafter referred to as "the App" or "we"). We understand the importance of your personal information and will make every effort to ensure its security. We are committed to maintaining your trust by adhering to the following principles in protecting your personal information: accountability, purpose specification, consent, data minimization, security safeguards, individual participation, and openness.
This Privacy Policy will help you understand:
- How we collect, use, store, and share your personal information
- How you can access and control your personal information
- How we protect your personal information security
Important Notice:
- Please read and understand this Privacy Policy carefully before using the App
- Pay special attention to clauses marked in bold
- If you do not agree with any content of this policy, please stop using the App immediately
- By using the App, you acknowledge that you have fully understood and agreed to this policy
2.1 Information You Provide Voluntarily
2.1.1 Account Registration Information
When you register for a WHIMSY membership account, we need to collect the following information:
- Username: Used to identify your identity
- Phone Number: Used for account login, identity verification, security protection (supports Hong Kong 852, 853, Mainland China 86, and other regional codes), and password recovery
- Email Address: Used to receive notifications
- Password: Used for account security protection (8 characters, numbers or letters)
- Gender and Birthday: Used for personal profile display and personalized services
- Profile Photo: Used for personal profile display
2.1.2 Membership Information
- Membership card number and status
- Game coin balance
- Ticket quantity
- Prize ticket quantity
- Total points
- Marble balance
- Promotion information
- Order records and transaction history
2.2 Information We Automatically Collect During Your Use
2.2.1 Device Information
- Device identifier (Device ID)
- Device model and operating system version
- App version number
- Network type and status (WiFi/mobile data)
- IP address
- Language settings
2.2.2 Location Information
- GPS location data (collected only with your authorization)
- Store selection records
- Nearby service queries
Purpose Statement: Location information is used solely to provide nearby store search, personalized recommendations, and other services. You can disable location permissions in your device settings at any time.
2.2.3 Usage Behavior Data
- Page access records and dwell time
- Feature usage statistics
- QR code scanning records
- Operation logs
- Crash logs and performance data
We collect and use your personal information for the following purposes:
3.1 Core Service Provision
- Create and manage your membership account
- Verify your identity and membership status
- Process your orders and transactions
- Manage your membership assets (game coins, tickets, prize tickets, points, etc.)
- Provide gift redemption and in-store pickup services
3.2 Location-Based Services
- Find nearby WHIMSY stores
- Provide location-based personalized recommendations
- Optimize store service experience
3.3 Security Assurance
- Prevent fraud and unauthorized access
- Detect and prevent security issues
- Protect your account and property security
- Comply with legal and regulatory requirements
3.4 Product Improvement
- Analyze app usage
- Optimize product features and user experience
- Perform technical maintenance and system upgrades
- Develop new features and services
4.1 We Will Not Sell Your Personal Information
We commit not to sell your personal information to any third party.
4.2 Circumstances for Possible Sharing
We may share your personal information in the following circumstances:
4.2.1 Service Providers
We cooperate with trusted third-party service providers who provide services on our behalf:
- Payment Processor: Lakala Aggregate Payment, used to process payment transactions
- Cloud Service Provider: Self-built servers for data storage and processing
- SMS Service Provider: Used to send verification codes and notifications
These service providers can only access necessary information for specific purposes and are bound by strict confidentiality obligations.
4.2.2 Legal Requirements
We may disclose your information in the following circumstances:
- Comply with applicable laws and regulations
- Respond to court orders, subpoenas, or other legal proceedings
- Protect the rights, property, or safety of us, users, or the public
- Enforce our terms of service
5. Data Storage and Security
5.1 Data Storage Location
- Server Location: Tencent Cloud Hong Kong Node
- Data Transmission Encryption: Yes (using HTTPS/TLS 1.2+)
- Data Storage Encryption: Yes (sensitive data such as passwords are encrypted)
Cross-Border Transfer Statement: If your data needs to be transferred across borders, we will ensure compliance with relevant laws and regulations and take appropriate security measures.
5.2 Data Retention Period
Unless required or permitted by law for longer retention periods (such as tax and accounting purposes), we will retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Statement. This policy does not require us to retain your personal information for more than 90 days after user account termination for any purpose.
5.3 Security Measures
We adopt multi-layered security measures to protect your information:
Technical Measures
- HTTPS/WSS encrypted transmission
- Encrypted data storage
- Access control and authentication
- Firewall and intrusion detection systems
- Regular security audits and vulnerability scans
Administrative Measures
- Regular security assessments
- Emergency response plans
Important Notice: Although we have implemented reasonable security measures, internet transmission is not absolutely secure. We cannot guarantee absolute security of information, but we will make every effort to protect your personal information.
6. Your Rights
Under applicable privacy protection laws, you have the following rights:
6.1 Access and Correction Rights
- View your personal information in the App
- Modify username, profile photo, gender, birthday, and other information
- Update email address
- View membership assets and transaction records
6.2 Deletion Rights
You can delete uploaded profile photos
6.3 Right to Withdraw Consent
You can at any time:
- Disable camera, photo album, location, and other permissions in device settings
- Unsubscribe from marketing communications
Impact Statement: Withdrawing consent may affect the use of certain features, but does not affect the legality of data processing based on consent prior to withdrawal.
6.4 Account Deletion Rights
You can apply to delete your account:
- Operation Path: Me → My Profile → Delete Current Account
- Processing Time: Effective immediately
- Consequences:
- You will no longer be able to use the App's services
- Your personal information will be deleted
- Unused membership assets cannot be recovered
- Information required to be retained by law excepted
7. Third-Party Services
The App integrates the following third-party services:
7.1 Payment Services
Lakala Aggregate Payment
- Provider: Lakala Payment Co., Ltd.
- Platform: iOS & Android
- Supported Payment Methods: Alipay, WeChat Pay, Visa Credit Card, Octopus, etc.
- Collected Information: Payment information, transaction records, order information, device information
- Purpose: Process mobile payment transactions
- Note: As an aggregate payment service provider, Lakala interacts with your chosen payment method (such as Alipay, WeChat, Visa, Octopus, etc.) to complete payments. Each payment method has its own independent privacy policy.
7.2 Location Services
System Location Services
- Provider: Apple / Google / Device Manufacturers
- Platform: iOS & Android
- Collected Information: GPS coordinates, location accuracy
- Purpose: Find nearby stores, provide location-related services
- Note: We only obtain your location information and do not share it with third parties
7.3 QR Code Scanning
- Function: QR code scanning component
- Purpose: Scan machine QR codes to activate and start machines
- Permission: Requires camera permission
- Note: Scanning data is processed locally only, used to identify machine information
7.4 Third-Party SDK List
| SDK Name |
Provider |
Purpose |
Collected Information |
| Lakala Payment SDK |
Lakala Payment Co., Ltd. |
Aggregate Payment (supports Alipay, WeChat, Visa, Octopus, etc.) |
Payment information, transaction records |
Note:
- As an aggregate payment service provider, Lakala interacts with your chosen payment method (Alipay, WeChat, Visa, Octopus, etc.)
- Each payment method has its own independent privacy policy. We recommend reviewing:
- Alipay: https://render.alipay.com/p/c/k2cx0tg8
- WeChat Pay: https://weixin.qq.com/cgi-bin/readtemplate?t=weixin_agreement&s=privacy
- Visa:https://www.visa.cn/legal/global-privacy-notice.html
- Octopus: https://www.octopus.com.hk/mobile_app/notes/privacy-policy.html
8. Children's Privacy Protection
8.1 Service Audience
We do not collect personal information from children under 13 years of age.
8.2 Parental Supervision
If you are a parent or guardian:
- Please supervise minors' internet use
- If you discover that a minor has provided personal information without consent, please contact us immediately
- We will delete relevant information as soon as possible
8.3 Handling Upon Discovery
If we discover that we have collected personal information from children without verified parental consent:
- We will immediately delete such information
- Terminate related accounts
9. Privacy Policy Updates
9.1 Update Mechanism
We may update this Privacy Policy from time to time to reflect:
- Changes in laws and regulations
- Technological development needs
- Improvements in business practices
- User feedback and suggestions
9.2 Notification Methods
For significant changes, we will notify you through the following methods:
- Email (if you have provided one)
- SMS notification
9.3 Effective Date
The updated Privacy Policy will take effect on the specified date. Continued use of the App indicates your acceptance of the updated policy.
If you have any questions, suggestions, or complaints about this Privacy Policy, please contact us through the following methods:
10.1 Contact Information
- Company Name: WHIMSY AMUSEMENT LIMITED
- Registered Address: SHOP 1403-5 14F, HOPEWELL MALL, 15 KENNEDY ROAD WANCHAI, HK
- Customer Service Phone: +852 67096720
- Customer Service Email: cs2@whimsy.com.hk
- Business Hours: Daily 10:00 to 21:00
10.2 Complaint Handling
We commit to:
- Seriously handle every complaint
- Continuously improve our privacy protection measures
Thank you for taking the time to read this Privacy Policy. We value your trust and will continue to work hard to protect the security of your personal information.