Privacy Policy - Frank & Label

This Privacy Policy explains how Frank & Label handles personal information when you use frankandlabel.com, create an account, sign in with Google, shop or contact us. It applies to Google Sign-In and Google One Tap as well as our other website services.

Who we are and how to contact us

Frank & Label is a jewellery business based in Hong Kong. For privacy questions, access requests or account deletion, email info@frankandlabel.com or use our contact page. Our contact address is Unit J, 7/F, Kaiser Estate Phase 2, 51 Man Yue Street, Hung Hom, Kowloon, Hong Kong; telephone +852 2773 0791.

Information we collect

Account information: your name, email address, account identifiers and profile details. If you register with a password, we store a password hash, not your readable password.
Shopping and business information: cart contents, orders, shipping and billing details, phone number, payment status, gift card and coupon use, and information you provide for wholesale enquiries, including business registration documents if you upload them.
Communications: enquiries, support messages, reviews and subscription preferences you submit.
Technical information: IP address, browser/device information, pages and interactions, session identifiers and security logs. We use cookies and similar technologies for authentication, cart functionality, preferences, security and analytics.

Google Sign-In and Google One Tap: data accessed

Google login is optional; you can use our email/password registration and login instead. When you choose Google Sign-In or Google One Tap, Google provides your Google account identifier, email address and verification status, and basic profile information such as your name and profile picture URL when available. Our OAuth login requests only basic identity permissions: openid, email and profile. One Tap provides a Google-issued identity credential that we verify on our server.

We do not request access to your Gmail messages, Google Drive files, Google Contacts, Calendar, Photos or Google account password through these sign-in features. Separate Google services used to operate our business do not grant us access to your personal Google files or mailbox when you sign in.

How we use and store Google information

We use the verified Google account identifier and email to authenticate you, create your Frank & Label account or associate a sign-in with an existing account, prevent impersonation and maintain secure sessions. We store your Google identifier, email, available name and profile picture URL in our account database. Your email is also used for account and order communications, such as welcome messages, receipts and support. Google sign-in does not by itself subscribe you to a newsletter.

The sign-in credential and OAuth access token are used to verify your identity or retrieve the basic profile; our sign-in implementation does not persist Google access or refresh tokens in your account. Signing out ends the website session but does not delete the account information already stored.

Google data commitments

Frank & Label's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where applicable. We use Google information only for the disclosed account, security and customer-facing services. We do not sell Google user data, use it for personalised advertising, transfer it to data brokers, use it to determine creditworthiness, or use it to train general-purpose AI or machine-learning models. We do not request additional Google permissions without an appropriate explanation and consent.

How we use other information

We process information to provide accounts, fulfil orders, arrange shipping, manage payments and refunds, respond to enquiries, administer wholesale services, prevent fraud and comply with legal obligations. We use website analytics to understand service performance. Marketing communications are managed separately from Google authentication; you can request that they stop at any time.

Sharing and service providers

We do not sell your personal information. Information may be processed by providers supporting the services you use, including hosting and database infrastructure, Cloudflare security/content delivery, payment providers such as Stripe, shipping carriers, and email/support providers. They receive information needed for those functions; for example, a courier needs delivery details, not your Google account identifier. Google processes authentication under its own Privacy Policy. Google Analytics, where enabled, separately processes website usage information; this is distinct from the basic Google account information used for sign-in.

Access by staff and contractors is limited to their operational need, such as responding to a support request or investigating fraud. We may disclose information when required by law, to protect rights and security, or in a business restructuring subject to applicable safeguards, notification and consent requirements. Google-derived data remains subject to the Google data commitments above.

Cookies and your choices

Essential cookies support login, security, shopping carts and site preferences. Google Identity Services may use cookies or browser-mediated identity features for sign-in. Analytics technologies may collect usage and device information. Browser settings can restrict or delete cookies, although this can prevent sign-in or cart features from working. You can also use browser-level tracking controls. Deleting cookies does not delete account information we store.

Security and international processing

We use HTTPS for website connections, access controls and security measures appropriate to our services. No system can guarantee absolute security. Our infrastructure and providers may process information outside your country, including outside Hong Kong. We take reasonable steps to protect information transferred to our providers. Card payments are handled through payment providers; we do not store your full payment-card number or card security code in your shopping account.

Retention, deletion and Google access removal

We retain account and Google profile information while needed to provide your account and the purposes described here. To request access, correction, an export, removal of a Google association or deletion of your account, email info@frankandlabel.com from your registered address. We may request proportionate identity verification before acting. Deletion is handled on request; merely signing out or removing Google access does not automatically erase the Frank & Label account.

You can remove Frank & Label's Google connection in your Google Account connections settings. This stops that authorised connection but does not itself delete information already stored by us. Contact us to delete that information or disconnect Google while arranging another sign-in method.

When information is no longer needed, we delete or anonymise it, subject to retaining order, accounting, fraud-prevention, dispute and legal records where necessary. Limited copies may remain in security logs and backups until their normal retention or backup-rotation cycle ends; access to retained records remains restricted.

Your rights and communications

Depending on your location, you may have rights to access, correct, delete or obtain a copy of personal information, restrict or object to processing, withdraw consent, and complain to your local privacy regulator. Contact us to exercise these rights. Withdrawing optional consent does not affect earlier lawful processing. Use the unsubscribe instructions in marketing emails or contact us to stop marketing; necessary order and security messages may still be sent.

Children and policy updates

Our shop and sign-in services are not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and address it. We may update this policy and publish the effective date here. If we intend to use Google data for a new purpose, we will provide notice and obtain any required consent before that use.