Privacy policy

Last updated: August 20, 2026

This Privacy Policy explains how Yihezeda Technology Co., Ltd, trading as BoxToHeart, collects, uses and shares personal information when you visit or use boxtoheart.com, contact us or place an order.

Information we collect

  • Contact and order information: name, email address, telephone number when provided, billing and delivery address, order details and customer-support messages.
  • Personalization information: names, dates, messages, images, design choices and other material you submit for a personalized product.
  • Payment and transaction information: payment status, payment method category, transaction identifiers, fraud-screening signals and limited payment details made available by Shopify or the selected payment provider. Payment providers process the complete payment credentials used at checkout.
  • Device and store-use information: IP address, browser and device information, pages viewed, referring page, cookie or similar identifiers and interactions with the store, subject to the store's privacy settings and any consent choices that apply.

How we use information

We use personal information to operate the store; process and fulfill orders; produce and check personalized items; arrange delivery; provide tracking and customer support; process cancellations, returns and refunds; prevent fraud and misuse; maintain records; comply with law; and improve the store based on information we are permitted to use.

We use information for marketing or non-essential analytics only when we have a lawful basis and provide any consent or opt-out choice required by applicable law.

Who receives information

We share only the information reasonably needed for the relevant service with:

  • Shopify, which hosts the store and processes store and customer information for the services we use;
  • the payment provider selected at checkout;
  • production and fulfillment partners that need order and personalization details to make the item;
  • 4PX or another carrier shown for the order, which needs delivery and contact information to transport the parcel;
  • service providers used for customer support, security, analytics or marketing, but only when those services are actually enabled and subject to applicable privacy choices; and
  • authorities, professional advisers or another party when reasonably necessary to comply with law, protect rights, prevent fraud or complete a lawful business transfer.

For the current personalized memorial suncatcher flow, production and fulfillment can involve service providers in China before the parcel is dispatched to the customer.

Current public-store runtime observations include Shopify and Shop services, Google analytics, tag-management and advertising services, Meta/Facebook technology, Mailchimp/Intuit services and Amplified app services. These providers and their purposes must be kept in sync with the services actually enabled for the store.

Cookies and similar technologies

Shopify and enabled service providers may use cookies or similar technologies to operate checkout, remember preferences, measure store use, prevent fraud and, if enabled, support advertising. Current runtime observations include Shopify cookies and cookies associated with Google analytics and Meta/Facebook technology. At the last configuration review on August 20, 2026, Shopify's automated Cookie Banner and automated data-sharing opt-out were not enabled for this store. We are preparing region-appropriate controls and do not describe them as active until they are verified. You can use controls presented by the store or your browser where available, or contact us about a privacy choice. We retain a non-essential tracker only while it has a named owner, current purpose, appropriate consent category and active business use.

International processing

Your information may be processed in a country different from the one where you live, including where Shopify, payment providers, production partners or carriers operate. Where required, we use an applicable legal mechanism or other safeguard for a restricted international transfer.

For production, we limit the shared fields to an internal order reference, product specification and the personalization content needed to make the item. For delivery, we limit the shared fields to the recipient name, address, contact details and parcel or customs information required by the carrier. We do not send production partners or carriers complete payment credentials, unrelated browsing data, marketing profiles or unrelated customer history.

How long we keep information

We retain personal information only for as long as reasonably needed for the purposes above, including order fulfillment, customer support, fraud prevention and legal, tax or accounting obligations. Working personalization files are scheduled for deletion within 90 days after delivery or final issue resolution, and the production partner is instructed to delete its working copy within 30 days after that point. Identity Archive research contact information is scheduled for deletion within 30 days after the research interaction unless the person separately asks to stay in contact. Closed support correspondence and privacy-safe remediation records may be kept for up to 24 months. Order, payment, tax and accounting records are kept only for the applicable operational and legal period. A legal hold, fraud investigation or unresolved dispute can require a longer period. When operational identity is no longer needed, we delete or de-identify the information where reasonably possible.

Your choices and rights

Depending on where you live, you may have rights to ask for access, correction, deletion, restriction, objection, portability, withdrawal of consent, or an opt-out from certain sale, sharing or targeted-advertising uses. These rights can have legal exceptions.

To make a privacy request, email hello@boxtoheart.com. We may need to verify your identity and order relationship before completing a request. You may also use privacy controls presented by the store or Shopify where available.

Children

The store is intended for adults purchasing products. We do not knowingly ask a child to place an order or submit personalization content without appropriate adult involvement.

Security, changes and contact

We use reasonable administrative, technical and organizational measures appropriate to the information and services involved. No online system can guarantee absolute security.

We may update this policy when our practices or legal obligations change. We will post the updated version and its effective date on this page.

The business responsible for this policy is Yihezeda Technology Co., Ltd, RM22 2/F FU TAO BUILDING, NO.98 ARGYLE STREET, MONGKOK, COMMERCE, Kowloon, 510000, Hong Kong. Privacy questions or requests can be sent to hello@boxtoheart.com.