Privacy
Privacy notice.
How we handle enquiries, orders, delivery and optional email subscriptions.
Effective 2026-10-18Signed-in activity
When site measurement is enabled, actions collected during a verified, active sign-in can be associated with your customer account for up to 90 days, including visits, saved works, checkout stages and account screens. Signing in to the same account on another device allows those signed-in records to be viewed together. We do not retrospectively identify anonymous visits or use device fingerprinting. The owner can see this history with the account's verified email, registration, order and email-delivery records. Browser records can be incomplete and do not prove a person's identity or a successful payment. You can download recent account activity or request deletion through your account. Do Not Track and Global Privacy Control disable optional browsing measurement, not essential account, order or security records.
Customer accounts
An account is optional. We use your verified email, protected password credential and essential session cookie to sign you in; we never store a readable password or send credentials to browsing analytics. Addresses are saved only when you choose to save them. Orders created while signed in and account-bound offers are associated with your account. Marketing email requires your separate choice. You can manage addresses, subscriptions and password, download account data or request deletion from your account. Required transaction and security records may be retained.
Device and checkout stages
Site measurement may include a broad device category (phone, computer, tablet or unknown), whether checkout controls loaded or entered the viewport, and whether an input received focus. Device classification is performed in your browser; no raw user-agent string, screen size or device model is sent or stored. Missing signals are not treated as proof that an action did not occur.
Subscription reminders
This browser remembers when a subscription invitation is shown and pauses automatic invitations for 30 days. A successful signup stops further automatic invitations in this browser. Temporary tab storage counts browsing time and page changes to avoid interrupting your arrival; it does not store your email address. Automatic invitations stay off when browser storage is unavailable or privacy signals are enabled. You can still subscribe through the footer.
Checkout details in this browser
When browser storage is available, contact and delivery details are temporarily stored in the current tab to help you return to the form or change language. The draft expires 30 minutes after its last update. It does not store payment details or your acceptance of purchase terms, and it is not sent to analytics.
Checkout assistance
When you submit your contact and delivery form to review the order, we save those details and selected works for up to 30 days to help with that purchase. Submitted details are restricted to the store owner and are not used for marketing. Where analytics is enabled, a random checkout reference connects the submitted form with its process history. Analytics records only field completion states and controlled error codes, never the text you type. We do not record keystrokes or unsubmitted form contents.
Who is responsible for your information
北京仲羿信息技术服务部（个体工商户）, operating as Himalaya Surprise, is responsible for the personal information described in this notice. For privacy questions or requests, contact hello@himalayasurprise.com.
Recognising return visits
Our first-party browser storage holds a random visitor identifier for up to 180 days from creation to associate repeat visits in the same browser. Our server stores a keyed hash of that identifier. It is not an account or proof of a person's identity; shared browsers may share an identifier. Clearing site data, using another browser or device, or the end of a private-browsing session can create a new identifier. No cross-site or IP-based identity matching is performed. Browser privacy signals are respected; when storage is unavailable, browsing and checkout continue normally and only session-level measurement may be available.
Information we receive
We receive the contact, delivery and order information you provide, together with limited technical and security records needed to operate the service. We do not receive or store your PayPal password or full card details.
Payment processing
When you choose a payment method, payment details are handled by PayPal or the official Apple Pay or Google Pay sheet shown in checkout. We receive provider references, status and reconciliation data needed to create and support the order; we do not receive or store your full card number, security code, PayPal password or Apple Pay/Google Pay account credentials. Available methods can vary by browser, device, wallet readiness, destination, order and merchant configuration; a method that is unavailable is not presented as payable.
How it is used
Information is used to verify availability, process and fulfil orders, communicate payment and delivery status, prevent misuse, maintain accounting records and respond to enquiries. Marketing messages require separate consent.
First-party site measurement
To understand how visitors use the website, our own analytics records pseudonymous session and page-visit identifiers, page paths without query parameters, the order and time of visits, time measured while a page is visible and in focus, and actions such as adding a work to the bag, saving or removing a saved work, or opening checkout. Checkout stages may record the public work links in the bag, item count, destination country or region, and controlled process or error codes showing whether address entry, validation, delivery confirmation, order creation or a PayPal step was reached. These records do not include what you type, a street address or payment details, and do not establish that payment succeeded. Existing referring-domain and campaign tags (UTM) may also be recorded. These records are restricted to the store owner in the private administrative console and internal operational email notifications. They do not contain names, email addresses, telephone numbers, delivery addresses, full referring URLs, user-agent strings, browser fingerprints or form contents. Private order links are redacted. We do not use session replay or link these identifiers across devices. Do Not Track and Global Privacy Control are respected. To investigate abnormal access and review interest in works, we record IP addresses and approximate countries. They are available only to the store owner in the private console and add-to-bag or saved-work notification emails. Online diagnostics are retained for up to 30 days. Encrypted backups follow our disaster-recovery retention cycle and are not used for browsing analysis.
Email subscriptions
When you submit the subscription form, your subscription starts without a second confirmation. We store your email address, signup-page language, source page, consent version and subscription or unsubscribe times separately from orders and anonymous analytics. We send a welcome email in English and notify our owner of the new subscription. Customer updates are in English. We use Resend to deliver email and record delivery, bounce and complaint status, not email-open pixels. Every update includes an unsubscribe option. After unsubscribe, the mailing list retains only a minimal keyed address hash and necessary consent history to prevent unwanted mail; older unconfirmed requests expire after 30 days. We do not add buyers or enquirers automatically. Contact hello@himalayasurprise.com for subscription or privacy requests.
Interaction detail
Limited observations include image enlargement, filters (without search terms), opening information panels, scroll milestones, sections visible for at least one second, form-field focus and completion states, subscription and enquiry outcomes, and payment-method availability and stage timing. Technical diagnostics use predefined codes, not error text or recordings. Optional events are capped and may be missing. A checkout reference can link these observations to current order and payment status in the owner-only console; browser observations alone are not proof of payment or settlement.
Payment diagnostics
When site measurement is enabled, a random payment-attempt reference, method and start time may be retained in this tab for up to 24 hours to connect retries and returns. Elapsed time is not active time inside PayPal. We record only supported stage signals and predefined diagnostic categories, never payment form contents.
Service providers
Only the information necessary for a task is shared with payment, hosting, email, carrier or professional service providers. PayPal handles payment information under its own privacy terms.
Retention and security
Anonymous site-measurement records are automatically deleted after 13 calendar months. Order, payment, enquiry and security records are retained only for operational, transaction, dispute and legal needs. Access to the administrative console is restricted and service secrets remain server-side.
Questions and requests
Use the contact page to ask about the personal information associated with an order or to request correction. Some transaction records may need to be retained where required for accounting, fraud prevention or legal obligations.