Security & Privacy Commitment

Your birth date, photos and delivery details are personal. This page describes how we actually protect them right now: data is kept only for set periods, we never handle your card details, and if something goes wrong we will notify you within 72 hours.

• •Customer databases are closed to the public internet. The databases holding member and order data do not accept direct connections from the internet; only our own services can reach them over an internal network.
• •Two-step sign-in for administrators. Signing in to our store back office and internal admin system from a new device requires a one-time code in addition to the password.
• •Encrypted backups, with keys kept apart. Databases are backed up automatically every day and encrypted in transit and at rest. An additional off-site copy is stored in a data centre in Taiwan, encrypted again with a key we hold ourselves and kept separately from the backups. We rehearse a restore from backup every month.
• •Photos and report images are deleted automatically. Photos you send in customer chat are kept for 180 days and reading-report images for 1 year, then deleted by the system. Wrist photos used for AI try-on are used only to create that image; our systems do not store them. If you close your account in the member centre, your uploaded photos are deleted with it.
• •We never handle your card details. Card and other payment details are entered on the payment provider's page and processed directly by them. Our systems do not receive or store your card number.
• •AI processing is disclosed up front. Chats with our AI advisor, readings, crystal identification and AI try-on are processed by AI. In the chat window, on our LINE account, on the reading pages and in our Privacy Policy we tell you beforehand which data is processed and where it goes. If you would rather your data not be processed by AI, you can ask for a member of staff instead.

• •A protective layer filters malicious traffic. Our website and back-end services sit behind a protective layer that filters malicious traffic and limits abnormal bursts of requests.
• •Repeated wrong sign-ins are locked out. The back office, the internal admin system and member sign-in all limit attempts; repeated wrong entries are temporarily locked out, making passwords harder to guess.
• •Protection against injected malicious code. Pages may only load code from sources we have approved, and anything customers type is converted to plain text before it is shown in the back office.
• •Encrypted connections across the whole site. The entire site uses HTTPS, and browsers are instructed to always open it over an encrypted connection.
• •Automatic security checks every day. Our systems check every day that each line of defence is working, and alert the person responsible straight away if something is wrong.

• •We make no health claims. Crystals are accessories. Under Article 69 of Taiwan's Pharmaceutical Affairs Act, products that are not medicines may not claim medical effects, so we do not claim that wearing a crystal treats illness or changes how your body works.
• •Software checks first. AI-written copy is screened by software for health-claim wording before it goes live, and anything flagged is held back.
• •Symbolism is labelled as symbolism. Traditional ideas such as attracting wealth or warding off bad luck are labelled as symbolic meaning in our product categories. They describe cultural symbolism, not an actual effect.
• •No claims we cannot back bead by bead. We do not write things like "100% natural". Each stone type and bead size is labelled, and texture and colour vary from bead to bead. Photos are for reference and the actual piece is what counts; you are welcome to see pieces in person at our shop.
• •AI content is labelled. Our AI advisor and AI-written articles are clearly marked as AI.

• •An order number alone does not open your order. Pages for paying for an order or uploading proof of payment open only when you are signed in, or through the personal link we send you.
• •Who can see your member and order data. Back-office access depends on each person's role, so staff see only the data their job needs. Every time member or order data is viewed, it is logged against the person who viewed it, the business owner included.
• •When staff leave, their access goes with them. Once a staff account is deactivated, it stops working in the store back office and point-of-sale system within 5 minutes, and in the customer service and membership system on its next request.
• •If someone claiming to be our customer service asks you to use an ATM, see the fraud warning below.

We have a written incident response procedure. If we confirm a personal data incident, we will notify affected customers within 72 hours of becoming aware of it, explaining what data was affected, what we have done and how you can protect yourself, and we will report it to the authorities as required.

Fraud warning: Qi Yi Crystal will never call or message you asking you to use an ATM, make a bank transfer, give us a verification code or card details, cancel an instalment plan or change a payment method. If you receive a call like this, hang up and contact your local police, or check with us through our official channels.

PDPA Article 8 (notice)

Our Privacy Policy states what we collect, why, how long we keep it, where it is used and your rights. AI processing is disclosed before use.

PDPA Article 11 (correction and deletion)

You can ask to access, correct or delete your data at any time, and close your account yourself in the member centre. Data whose purpose has ended or whose retention period has expired is deleted or anonymised.

PDPA Article 12 (incident notice)

Affected customers are notified within 72 hours of us becoming aware of a confirmed incident.

PDPA Article 21 (international transfer)

Where data must be processed outside Taiwan, we tell you beforehand where it goes and to what kind of recipient.

Following international privacy norms

You can ask to access, correct or delete your data. In the member centre you can view your details, edit your birth date and delivery addresses, and delete your account yourself; to change your name or email, contact us.

Pharmaceutical Affairs Act Article 69

Products that are not medicines may not claim medical effects. We make no such claims, and AI-written copy is screened by software before it goes live.

Retention

Chat photos 180 days, reading-report images 1 year. Invoices and accounting vouchers are kept for at least 5 years and accounting books for at least 10 years, as Taiwanese law requires.

If you find a security vulnerability on this site or in our services, please email service@qiyicrystal.com with the subject "Security report", and include the page and the steps to reproduce it.

While investigating, please do not access, change or delete data that is not yours, and do not disrupt other customers. We read every report, and once confirmed we will fix it as quickly as we can and reply to you.

Email service@qiyicrystal.com. How to access, correct or delete your personal data is explained in our Privacy Policy.

Security is never finished. We keep checking and improving, and we will update this page when our practices change.