Privacy Policy

Molan Studio ("Molan," "we," "us," or "our") is a handcraft studio specializing in traditional Chinese intangible cultural heritage (ICH) artworks, including Da Qi (Chinese lacquerware) and Luodian (mother-of-pearl inlay) creations. We operate this website to sell our handcrafted jewelry and home décor pieces to customers worldwide.

We are the exclusive design and production partner of the East China Sea Shell-Carving Art Museum. Our registered business address and data controller contact details are provided in Section 14 of this policy.

We collect information you provide directly to us, information collected automatically, and information from third-party sources.

We use the information we collect for the following purposes:

• Order Fulfillment: To process transactions, arrange international shipping, send order confirmations, and provide post-purchase support.
• Account Management: To create and maintain your customer account and authenticate your identity.
• Customer Service: To respond to your inquiries, resolve disputes, and provide assistance.
• Marketing and Communications: To send promotional emails, product updates, and cultural heritage content -- only where you have provided consent or where permitted by applicable law. You may opt out at any time.
• Personalization: To tailor product recommendations and website content based on your browsing and purchase history.
• Analytics and Improvement: To understand how our website is used, diagnose technical issues, and improve our products, services, and user experience.
• Legal Compliance: To comply with applicable laws, regulations, tax obligations, and to respond to lawful requests from public authorities.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions and other illegal activities.

If you are located in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases under the General Data Protection Regulation (GDPR) to process your personal data:

Your personal data is stored on secure servers hosted by reputable cloud service providers. We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

• Order and Transaction Records: Retained for a minimum of 7 years to comply with tax and accounting regulations.
• Customer Account Data: Retained for the duration of your account's existence and for up to 3 years following account deletion, unless otherwise required by law.
• Marketing Preferences: Retained until you withdraw consent or request deletion.
• Support and Communication Records: Retained for up to 3 years from the date of last contact.
• Cookies and Analytics Data: Retained according to the specific cookie lifetime described in Section 7.

When data is no longer required, we securely delete or anonymize it in accordance with our internal data retention procedures.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your data with the following categories of trusted service providers and partners, solely as necessary to operate our business:

All third-party service providers are required to maintain the confidentiality and security of your personal information and are prohibited from using it for any purpose other than providing services to us.

We use cookies and similar tracking technologies to enhance your browsing experience, analyze site traffic, and support marketing activities. Cookies are small text files stored on your device.

You can manage or withdraw your cookie consent at any time through our Cookie Preference Center (accessible via the cookie banner at the bottom of our website) or by adjusting your browser settings. Please note that disabling certain cookies may affect website functionality.

As a cross-border e-commerce business operating from China and serving customers globally, your personal data may be transferred to, stored in, and processed in countries outside your country of residence, including China, the United States, and other jurisdictions where our service providers operate.

For customers in the EEA or UK, we ensure that any international transfers of personal data are subject to appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions issued by the European Commission or UK authorities; or
• Other legally recognized transfer mechanisms under GDPR Chapter V.

You may request a copy of the safeguards we rely on for international transfers by contacting us at the address in Section 14.

Depending on your country or region of residence, you may have the following rights regarding your personal data:

To exercise any of the above rights, please contact us using the details in Section 14. We will respond to your request within 30 days. We may need to verify your identity before fulfilling your request.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. However, you may submit an opt-out request at any time by contacting us.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit the use of sensitive personal information to purposes necessary to provide our services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. You will receive the same quality of service regardless of whether you exercise these rights.

To submit a California privacy request, please contact us at the details provided in Section 14 or use our dedicated privacy request form on our website. We will respond within 45 days, with a possible extension of an additional 45 days where reasonably necessary.

Our website and services are not directed to individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at the details in Section 14, and we will take steps to delete such information promptly.

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our website;
• Encrypted storage of sensitive data at rest;
• Access controls limiting data access to authorized personnel only;
• Regular security assessments and vulnerability testing;
• PCI-DSS compliant payment processing via certified third-party providers.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authorities as required by applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Notify registered customers via email; and/or
• Display a prominent notice on our website.

We encourage you to review this Privacy Policy periodically. Your continued use of our website after any changes become effective constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Team:

We aim to respond to all privacy-related inquiries within 30 days of receipt.