This Privacy Policy explains how Shang Shing Company Limited collects, uses, stores, shares and protects personal information in the course of designing, building and maintaining mobile applications and in the operation of this website. It has been prepared by the developer known as Shang Shing Apps, the software studio of Shang Shing Company Limited, whose registered and operating address is Rm 6A 11/F ENERGY PLZ, 92 GRANVILLE RD, Tsim Sha Tsui, Hong Kong. The policy is written to be read by ordinary users, shop owners, clinic staff and studio operators, and it describes plainly what happens to information that passes through the studio and its products.
By using this website or any application released by Shang Shing Company Limited, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use the website or the applications. You may contact the studio at support@shangshing.buzz at any time with questions about this policy or about the handling of personal information.
1. Introduction
Privacy is a practical matter at this studio. Shang Shing Company Limited builds tools that shops, clinics and studios rely on during a working day, and those tools often touch information about customers, patients or clients. The studio treats that information as something held in trust. This document sets out the kinds of information the studio may handle, the reasons it is handled, the choices available to the people whose information it is, and the steps taken to keep it safe.
This policy applies to the public website at www.shangshing.buzz, to any enquiry or support conversation with the studio, and to the mobile applications that Shang Shing Company Limited designs, builds and maintains on behalf of its clients. Where an application is built for a specific client, that client may also publish its own privacy notice, and where the two documents differ, the client notice will govern the relationship between the client and the people who use the client application. The studio will always aim to be transparent about which party is responsible for which part of the handling.
The policy is intended to be complete rather than brief. It is organised into numbered sections so that a reader can move directly to the topic of interest. Nothing in this policy limits any right that a person may have under applicable law, and nothing here should be read as a waiver of any protection granted by statute.
2. Who We Are
Shang Shing Company Limited is a company established in Hong Kong. Its operating desk is at Rm 6A 11/F ENERGY PLZ, 92 GRANVILLE RD, Tsim Sha Tsui, Hong Kong. The studio provides mobile application design and build services, user interface systems, offline-first data layers, store release management, and crash monitoring and maintenance. The developer name used in this policy, Shang Shing Apps, refers to the software practice carried on by Shang Shing Company Limited and does not indicate a separate legal entity.
For the purposes of applicable data protection law, Shang Shing Company Limited is the organisation responsible for the personal information it collects directly through this website and through its own business operations. Where the studio has built an application for a client, that client is normally the party responsible for the information held inside the client application, and the studio acts on the client instructions. This division is explained to clients during a project so that responsibilities are clear from the outset.
Questions about this policy, about a specific application, or about how to exercise a right described in section fourteen may be directed to support@shangshing.buzz or to the postal address above. The studio aims to answer privacy questions within a small number of working days.
3. Information We Collect
The studio collects information in a small number of defined ways, and it tries not to collect more than it needs. The categories below describe what may be collected through this website and through the studio own business operations. Application-specific data is described later in this policy.
Information collected automatically when a person visits this website can include the internet protocol address from which the request is made, the type and version of the browser, the operating system of the device, the referring address that led to the site, the pages requested, and the date and time of each request. This information is standard for web servers and is used to keep the site working, to understand which pages are useful, and to protect the site from abuse.
Information provided directly by a person can include a name, an email address, a telephone number, a company or organisation name, and the content of a message. This information is given voluntarily when a person writes to the studio, requests a release window, or asks for support.
Information generated in the course of a project can include correspondence, notes from bench sessions, design files, build records and release tags. This information belongs to the working relationship and is kept for the purpose of delivering the service and maintaining a readable history of the work.
- Technical request data, such as internet protocol address and browser details.
- Contact details supplied voluntarily, such as name, email and telephone number.
- Correspondence and support messages, including their content and attachments.
- Project records, such as version tags, release notes and maintenance logs.
4. Information You Provide Directly
When a person uses the contact form on this website, the form prepares a message addressed to support@shangshing.buzz and hands it to the mail application on the device. The studio does not operate a hidden database behind the form, and the information is delivered in the same way as an ordinary email. The fields requested are kept to the minimum needed to reply: a name, an email address, an optional subject line, and a message.
A person may also contact the studio by telephone at +85244234064 or by writing to Rm 6A 11/F ENERGY PLZ, 92 GRANVILLE RD, Tsim Sha Tsui, Hong Kong. Information shared in those ways is used only to respond to the enquiry and to carry out any work that follows.
Where a person provides information about another individual, for example a colleague who should join a project discussion, that person should have the agreement of the individual concerned before the details are shared. The studio will use such details only for the purpose for which they were provided.
Providing information is always a choice. A person who prefers not to give an email address or telephone number may still browse the public pages of this website without contacting the studio. Some services, however, cannot be delivered without a way to reply, and in those cases the studio will explain what is needed and why.
5. Information From Mobile Applications
Shang Shing Company Limited designs, builds and maintains mobile applications for iOS and Android on behalf of clients. The information handled inside those applications depends on the purpose of each application. A shop application may hold stock levels and order records. A clinic application may hold appointment details and clinical notes. A studio application may hold portfolio items and enquiry messages. The studio builds each application to handle only the information required for its stated purpose.
Where the studio operates an application as a service on behalf of a client, the client decides the purposes for which information is used, and the studio processes that information on the client instructions. In those situations, a person who wishes to access, correct or delete information held inside the application should contact the client that operates the application, and the studio will assist the client in responding.
The studio does not sell personal information and does not build advertising profiles from the applications it maintains. The design principle behind every build is that information exists to support the daily routine the application was made for, and nothing more. Offline-first design means much of the information a person enters is held on the device itself, which is discussed further in section sixteen.
7. How We Use Information
Information is used to provide the services described on this website, to reply to enquiries, to design and build applications, to submit and manage store releases, and to monitor and maintain applications after launch. Each use is connected to a purpose that a reasonable person would expect when contacting a software studio or using an application it has built.
Contact information is used to answer questions, to schedule bench sessions, to send project updates and to provide support. Technical request data is used to keep the website secure and available, to diagnose faults and to understand which content is helpful. Project records are used to deliver the work, to maintain a version history and to support the application over time.
The studio may also use information to meet legal and accounting obligations, to enforce its rights, and to protect the rights and safety of clients, users and the public. Where information is used for a new purpose that was not described when it was collected, the studio will explain the new purpose and, where required, ask for agreement before proceeding.
- Responding to enquiries and providing support.
- Planning and delivering design and build work.
- Managing store submissions and maintenance releases.
- Keeping the website and applications secure and reliable.
- Meeting legal, tax and accounting duties.
8. Our Legal Bases for Processing
Where data protection law requires a legal basis for processing, the studio relies on one or more of the following. Processing may be necessary to take steps at the request of a person before entering into a contract, or to perform a contract, such as an agreement to design and build an application. Processing may be necessary for the legitimate interests of the studio in running its business, provided those interests are not overridden by the rights of the individual.
Processing may be based on consent, for example where a person agrees to receive project updates or where an application asks for permission to use a device capability such as notifications or the camera. Consent can be withdrawn at any time, and withdrawing it will not affect processing carried out before the withdrawal.
Processing may also be necessary to comply with a legal obligation, such as keeping accounting records, or to protect vital interests in an emergency. Where a person has questions about the basis on which a particular item of information is processed, the studio will explain it on request.
10. Service Providers and Partners
The studio works with a small group of service providers to deliver its services. These can include web hosting, email delivery, source code hosting, app store distribution and crash reporting. Each provider is chosen for reliability and for a fit with the studio approach to privacy, and each is bound to use information only for the agreed service.
Before a provider is engaged, the studio considers what information the provider will touch and whether the provider has appropriate safeguards. Where a provider processes information on behalf of the studio, the arrangement is documented so that responsibilities are clear. The studio does not permit a provider to use information for its own unrelated purposes, such as building advertising audiences.
Providers may change over time as tools improve. The studio reviews its providers periodically and will update this policy where a change is significant. A person who wishes to know which categories of providers are in use may ask the studio at support@shangshing.buzz.
11. How Long We Keep Information
Information is kept only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. Enquiry messages are kept while a conversation is active and for a reasonable period afterwards, so that context is available if the person writes again. Project records are kept for the duration of the working relationship and for a period afterwards to support maintenance and to meet accounting duties.
Technical request data is normally kept for a short period, because its value is mainly in diagnosing current faults and understanding recent activity. Crash and performance data is kept long enough to identify trends across releases, and then aggregated or removed.
When information is no longer needed, it is deleted or made anonymous so that it can no longer be linked to a person. Where deletion is not immediately possible because information is held in a backup, the information will be isolated from ordinary use and deleted when the backup cycle completes. The studio reviews retention periodically and aims to keep its holdings small and purposeful.
12. How We Protect Information
The studio takes reasonable technical and organisational steps to protect information against loss, misuse and unauthorised access. These steps include limiting access to information to those who need it for their work, using reputable providers with modern security practices, keeping software up to date, and applying the principle of least privilege to accounts and systems.
Information sent to the studio by email or through the contact form travels over the public internet, and while the studio takes care on its side, no method of transmission is perfectly secure. A person who is concerned about sending a particular detail by email may instead telephone the studio or discuss the matter in a bench session. The studio will never ask for a password, a one-time code or a full payment card number by email.
If a security incident affecting personal information occurs, the studio will investigate promptly, take steps to contain and remedy the incident, and notify affected persons and any relevant authority where the law requires it. The studio keeps a record of incidents so that lessons learned can improve future practice.
13. International Data Transfers
Shang Shing Company Limited is based in Hong Kong, and information is primarily held in Hong Kong. Some service providers may store information in other countries, which means information may be transferred across borders. Where such a transfer occurs, the studio takes steps to ensure that the information continues to receive an appropriate level of protection.
Those steps can include choosing providers that offer strong contractual commitments, limiting the categories of information that leave Hong Kong, and using providers that apply recognised safeguards. The studio reviews cross-border arrangements as part of its periodic provider review and will adjust them where the protection available changes.
A person who wishes to know more about where their information may be held may contact the studio. The studio will explain the general arrangements in plain language and will avoid technical jargon where a simpler answer is possible.
14. Your Rights and Choices
Depending on where a person lives, there may be rights over personal information, and the studio aims to honour those rights wherever it operates. These rights can include the right to be told what information is held, the right to obtain a copy, the right to correct information that is wrong or incomplete, the right to ask for deletion in certain circumstances, the right to restrict or object to certain processing, and the right to withdraw consent where consent is the basis for processing.
To exercise a right, a person may write to support@shangshing.buzz or to Rm 6A 11/F ENERGY PLZ, 92 GRANVILLE RD, Tsim Sha Tsui, Hong Kong. The studio may need to confirm identity before acting, so that information is not disclosed to the wrong person. A request will be answered within a reasonable period, and where a request cannot be granted, the studio will explain why and describe any available further step.
A person who believes that information has been handled improperly may raise the matter with the studio first, so that it can be addressed directly. Where a local law provides for a complaint to a regulator, that route remains open at all times, and the studio will cooperate with any lawful process.
- The right to know what information is held.
- The right to request a copy of information.
- The right to correct inaccurate information.
- The right to ask for deletion in defined situations.
- The right to object to or restrict certain processing.
- The right to withdraw consent previously given.
15. Privacy for Children
The services of Shang Shing Company Limited are intended for businesses and professional users, and this website is not directed at children. The studio does not knowingly collect personal information from children through this website. Where an application built for a client serves a younger audience, the client is responsible for obtaining any consent required by law, and the studio builds safeguards into the application to limit the information it collects.
If the studio becomes aware that information from a child has been collected through this website without the appropriate consent, the studio will take reasonable steps to delete it promptly. A parent or guardian who believes that a child has provided information to the studio may contact support@shangshing.buzz so that the matter can be reviewed and, where necessary, corrected.
The studio recommends that families discuss privacy together and that young users are supported when installing any application. Good habits formed early, such as checking what an application asks for and why, serve people well throughout life.
16. Offline and Local Data
Shang Shing Company Limited builds offline-first applications, which means that information entered by a user is often stored first on the device itself and synchronised with a server only when a connection is available. This design keeps shops, clinics and studios working when networks drop, and it also affects how privacy is experienced, because a meaningful amount of information may live on the device rather than in a remote system.
Information held on a device is protected by the security features of the device, such as a passcode or biometric lock, and by the way the application stores its files. A person can usually remove locally held information by signing out, clearing the application data, or uninstalling the application. Where an application supports local export, a person can also take a copy of their own information.
Because local information may not yet have reached a server, a request to delete information held by the studio should be accompanied, where relevant, by clearing the application data on the device as well. The studio will explain this in its reply so that a deletion request is complete rather than partial.
17. Crash Reports and Performance Data
To keep applications stable, the studio uses crash reporting and performance monitoring. When an application fails or slows down, a report may be generated containing technical details such as the application version, the device model, the operating system version, the state of the application at the time, and a stack trace describing where the fault occurred. These reports are used to find and fix defects and to measure the crash-free rate of each release.
Crash reports are configured to avoid capturing the content a person types or the records a person stores. The purpose is to understand the mechanics of a fault, not to read private material. Reports are grouped by cause so that a single defect affecting many users can be recognised and fixed once, rather than being treated as many separate problems.
Performance data, such as how quickly a screen opens, is used to keep an application responsive as it grows. This data is treated as technical information and is retained only as long as it is useful for improving reliability. A person who wishes to know which monitoring tools are used in a particular application may ask the studio or the client that operates the application.
18. Third Party Applications and Links
This website may link to third party sites, such as app stores or documentation pages. Those sites are not controlled by Shang Shing Company Limited, and their own privacy notices apply to any information they collect. The studio encourages readers to review the privacy notice of any site they visit, especially before providing personal information.
Applications built by the studio may include software components provided by third parties. Each component is selected with care and reviewed for the information it may access. Where a component would collect information for a purpose beyond the function of the application, the studio will avoid it unless the client has a clear reason and appropriate safeguards are in place.
If a person encounters a third party feature inside an application and wishes to know how it handles information, the studio will help identify the responsible party so that a question can be directed to the right place. Transparency about the boundary between the application and third party services is part of the studio commitment to its clients and their users.
19. Changes to This Policy
This Privacy Policy may be updated from time to time to reflect changes in the services, the tools used, or the law. When a change is made, the date at the top of the page will be revised so that readers can see when the current version took effect. Where a change is significant, the studio will take reasonable steps to bring it to the attention of affected persons.
Continuing to use the website or an application after an update means that the revised policy applies, to the extent permitted by law. A person who does not agree with a revision may stop using the service and may contact the studio to discuss the handling of information that has already been provided.
Previous versions of this policy are kept internally so that the history of the studio approach to privacy is available if a question arises about an earlier period. A person who needs to understand how information was handled at an earlier time may contact the studio for an explanation.
20. How to Contact Us
Questions, requests and comments about this Privacy Policy or about the handling of personal information are welcome. The studio can be reached by email at support@shangshing.buzz, by telephone at +85244234064 during business hours, Monday to Friday, 09:00 to 18:00 Hong Kong time, or by post at the address below.
Shang Shing Company Limited
Rm 6A 11/F ENERGY PLZ
92 GRANVILLE RD
Tsim Sha Tsui, Hong Kong
When writing about a specific application, please include the application name and its version tag where possible, so that the request can be routed to the right record quickly. The studio aims to answer privacy enquiries promptly and to resolve any concern directly and fairly. Thank you for taking the time to read this Privacy Policy.