Privacy Policy

Sahua | HK GOLD SANDS GROUP LIMITED

Effective date: 8 July 2026

This Privacy Policy explains how HK GOLD SANDS GROUP LIMITED (“Sahua”, “we”, “us” or “our”) collects, uses, discloses, retains and protects personal data when you use the Sahua mobile application, website at https://www.sahua.live, and related services (together, the “Services”). It also explains your privacy choices and rights.

Please read this Policy before using the Services. Where consent is required by law, we will ask for it separately and you may withdraw it at any time. Consent to this entire Policy is not a condition of using the Services, although some data is necessary to provide requested features.

Key points

Sahua is a social and dating service intended only for people aged 18 or older.
We process account, profile, content, communications, transaction, device, usage, location and support information as described below.
Some profile or content choices may reveal sensitive information. You control what you add, subject to information needed for age and safety checks.
We use service providers and may transfer data internationally with contractual and other safeguards required by applicable law.
You may access, correct or delete your information, object to or restrict certain processing, withdraw consent, and opt out of marketing or targeted advertising where applicable.
We do not sell personal data for money. Certain advertising disclosures may be treated as a “sale” or “sharing” under some U.S. state laws; eligible users may opt out as explained in Section 11.

1. Who we are and how to contact us

HK GOLD SANDS GROUP LIMITED is the controller or data user responsible for personal data processed under this Policy, unless a separate notice says otherwise.

Postal address: Unit 617A, Circular Trade Plaza, 1 Sha Tsui Road, Tsuen Wan, New Territories, Hong Kong

Registration Certificate No.3047616

Privacy email: steven1082025@outlook.com

Telephone: +852 64975721

Website: https://www.sahua.live

Please use the subject line “Privacy Request” when contacting us about your data. We may need to verify your identity before completing a request.

2. Scope and relationship with other notices

This Policy applies to the Services and to communications with our support and trust-and-safety teams. It does not govern third-party websites, app stores, payment providers or services that have their own privacy notices. Additional just-in-time notices may appear when you enable a feature, grant a device permission or participate in a promotion. If an additional notice conflicts with this Policy, the more specific notice governs that processing.

3. Personal data we collect

We collect data directly from you, automatically from your device and use of the Services, from other users, and from service providers or platforms you choose to connect.

3.1 Data you provide

Account and verification data: mobile number, email address, username, password or authentication token, one-time verification codes, age or date of birth, and information used to confirm account ownership or eligibility.
Profile data: display name, photographs, avatar, gender, country or general location, interests, biography, relationship preferences and other details you choose to publish. Depending on what you provide, this may reveal sensitive information such as sexual orientation, ethnicity, religion or health information.
User content and communications: text, photographs, video, audio, voice recordings, live-stream or room activity, reactions, reports, messages and other content you create, upload, send or make available. Recipients can save or share content you send them; please share carefully.
Purchases and rewards: product or subscription selected, amount, currency, transaction date, order or receipt identifier, virtual goods, promotion participation and reward-delivery details. App stores and payment providers process your full payment credentials; we generally receive confirmation and transaction metadata rather than full card details.
Support and safety data: requests, complaints, reports, appeal materials, identity or account-verification information, and files or screenshots you choose to provide.
Survey, research and marketing data: feedback, survey responses, promotion entries and communication preferences.

3.2 Data collected automatically

Device and network data: device type and model, operating system and app version, language, time zone, IP address, network type, carrier, browser type, crash logs, diagnostic data, push token, advertising identifier and other resettable or app-specific identifiers where permitted.
Usage and activity data: registration and login times, screens and features used, searches, matches, interactions, content viewed, referral source, session duration, and security or moderation events.
Approximate location: inferred from IP address or device settings. Precise location is collected only when you enable a location-based feature and grant the relevant device permission.
Cookies and similar technologies: identifiers and event data used for authentication, preferences, security, analytics and, where permitted, advertising. See Section 9.

3.3 Data from other sources

Connected services: if you choose Apple, Facebook or another provider to sign in, we receive the identifier and profile information that provider and your settings permit, such as name, email address or profile image.
Other users: content about you, contact details if a user chooses to invite you, and reports relating to safety, fraud or rule violations.
App stores, payment and fraud-prevention providers: purchase confirmation, subscription status, chargeback, risk signals and transaction identifiers.
Public or lawful sources: information reasonably necessary to investigate fraud, safety incidents, infringement or legal claims, where permitted by law.

4. Why we use personal data and our legal bases

The legal or processing basis depends on the purpose and your location. Where EU, EEA or UK data-protection laws apply, we rely on the legal bases in the first table below. For U.S. users, the second table explains our processing purposes, permitted business uses and consumer choices. We identify and document the applicable basis before beginning new processing.

Purpose	What we do	EU/EEA/UK basis
Provide and administer the Services	Create and authenticate accounts; display profiles; enable matching, messaging, rooms, content, purchases and support.	Performance of our contract; consent where required for sensitive data or device permissions.
Personalise the experience	Recommend profiles, people, content and features based on settings, activity and general location.	Legitimate interests in making the Services relevant; consent where required. You may change settings or object.
Safety, integrity and moderation	Detect spam, fraud, abuse, illegal content, account compromise and violations; review reports; enforce rules.	Legitimate interests; legal obligations; protection of vital interests in emergencies.
Payments and records	Confirm purchases, provide virtual items, process refunds or disputes, maintain tax and accounting records.	Contract; legal obligations; legitimate interests in preventing fraud and resolving disputes.
Communications and marketing	Send service notices; respond to requests; send promotions where permitted; measure campaign performance.	Contract and legitimate interests for service messages; consent or legitimate interests for marketing, as local law permits.
Analytics and improvement	Understand feature performance, troubleshoot, develop and test the Services, and produce aggregated statistics.	Legitimate interests; consent for non-essential cookies or SDKs where required.
Advertising	Create indirect user profiles to support promotion and advertising, improve advertising reach and understand user needs; disclose directly identifying data only with consent.	Consent where required; otherwise legitimate interests, subject to opt-out rights.
Legal and corporate matters	Comply with law, respond to valid process, establish or defend claims, and support a merger, financing or restructuring.	Legal obligations and legitimate interests.

U.S. processing bases and consumer choices

Purpose	U.S. processing basis	Consumer choices and limits
Provide and administer the Services	Provide the Services you request; perform our agreement with you; authenticate accounts; process data with consent where required.	You may delete your account or withdraw consent. Mandatory consumer protections remain unaffected.
Personalise the experience	Provide requested features; maintain, improve and personalise the Services; conduct internal business operations permitted by applicable law.	You may change profile, location and recommendation settings and may withdraw consent where processing is consent-based.
Safety, integrity and moderation	Detect security incidents; prevent fraud, abuse and illegal activity; protect users and rights; enforce our rules; comply with law.	You may appeal eligible moderation or account decisions and exercise applicable access, correction or deletion rights.
Payments and records	Complete transactions and provide requested virtual goods or subscriptions; prevent fraud; maintain tax, accounting and legal records.	Payment providers process payment credentials under their own notices. Statutory retention requirements may limit deletion.
Communications and marketing	Send transactional or service communications; respond to requests; send marketing with consent or as otherwise permitted by applicable law.	You may opt out of marketing messages, but not essential service or security notices.
Analytics and improvement	Debug, maintain and improve the Services; conduct internal research; protect service quality and security; use cookies or SDKs as permitted by law.	Where required, you may refuse non-essential cookies or SDKs or withdraw consent through available settings.
Advertising	Provide or measure advertising and promotion as permitted by applicable state law and with consent where required.	Where applicable, you may opt out of sale, sharing or targeted advertising, including through a recognised Global Privacy Control signal. See Section 11.
Legal and corporate matters	Comply with legal obligations and valid process; protect rights and safety; establish or defend claims; support a merger, financing or restructuring.	We limit disclosure to what is reasonably necessary and provide notice where required by law.

Our legitimate interests include operating and improving a safe, reliable and commercially sustainable service, preventing harm and fraud, protecting users and our rights, and understanding use of the Services. We balance these interests against your rights and expectations. You may object where applicable.

Where we process sensitive data that you choose to make public in a profile or post, we rely on your explicit choice to publish it and, where required, explicit consent. We do not require you to disclose sensitive information beyond what is lawfully necessary for age, safety or identity checks.

5. Automated systems, recommendations and moderation

We use automated systems to rank or recommend profiles and content, detect suspicious activity, identify potentially harmful or prohibited content, and prioritise items for human review. These systems may use profile settings, general location, interactions, device and usage signals, and content signals. Automated tools can make mistakes. Where a decision has a legal or similarly significant effect and applicable law requires it, we will provide information about the logic involved and a way to request human review or contest the decision. Contact us to appeal a moderation or account decision.

6. When we disclose personal data

We disclose only the data reasonably necessary for the relevant purpose and require recipients to protect it as appropriate.

Other users and the public: profile fields, public posts, room activity and content you choose to share are visible according to your settings. Messages are visible to their recipients.
Service providers: hosting, content delivery, messaging and push notification, analytics, customer support, content moderation, identity and age assurance, security, fraud prevention, email, marketing and payment-support providers process data for us under contract.
Connected platforms and app stores: Apple, Google, Facebook and other services receive data when you connect them, make a purchase, use their SDK or choose to share content through them.
Promotion and advertising partners: Sahua may create indirect user profiles from account, profile, device and activity information and disclose those indirect profiles to partners that commission promotion or advertising. The purpose is to provide advertising or campaign decision support, improve advertising reach and understand user needs. We do not disclose personal data that directly identifies you to those partners without your consent. Some laws may treat this activity as targeted advertising, “sharing” or a “sale” even when no money changes hands. See Section 11 for opt-out choices.
Professional advisers and corporate counterparties: auditors, insurers, lawyers, banks, investors and potential buyers may receive data subject to confidentiality and lawful safeguards.
Authorities and safety recipients: we may disclose data when we reasonably believe disclosure is required by valid law or legal process, needed to protect rights or safety, investigate wrongdoing, or respond to an emergency. We review requests and limit disclosure where legally permitted.

We do not authorise service providers to use personal data for their own unrelated purposes. Third parties acting as independent controllers are responsible for their own notices and practices.

6.1 Third-party services and SDKs identified by Sahua

Based on Sahua’s existing service disclosures, the Services currently integrate or interact with the third-party services below. The exact data received by a provider depends on the feature you use, your device, permissions and provider settings. Each provider may act as our processor, an independent controller, or both, depending on the activity. Its own privacy notice also applies where it determines how and why it processes data.

Provider / integration	Purpose	Data involved
Amazon cloud services	Hosting, storage, content delivery or related infrastructure	Account identifiers, user content, messages, technical logs, IP address and other service data hosted or transmitted through the infrastructure
Facebook login	Optional third-party account registration or sign-in	Provider account identifier and profile information authorised by you, such as nickname and avatar
Apple ID / Sign in with Apple	Optional third-party account registration or sign-in	Provider account identifier and profile information authorised by you, which may include name or relay email
Apple App Store	App distribution, purchases, subscriptions, receipts and transaction support	Order or receipt identifier, product, amount, currency, purchase status, transaction time, account or device-related transaction metadata; Apple processes payment credentials under its own notice
Google Play	App distribution, purchases, subscriptions, receipts and transaction support	Order or receipt identifier, product, amount, currency, purchase status, transaction time, account or device-related transaction metadata; Google processes payment credentials under its own notice
Third-party message-push service	Maintain communication with our servers and deliver service and, where permitted, personalised notifications	Push token or SDK identifier, SDK version, necessary device and network information, mobile status information and location information where the feature, device permission and applicable law allow
Content-moderation service provider	Review user-posted content for platform safety, policy enforcement and compliance with applicable legal or regulatory requirements	User content submitted for review, related account or content identifiers, report information and moderation metadata reasonably necessary for the review

When a feature relies on a third-party software development kit (SDK), the SDK may process only the data reasonably necessary to provide that feature. Our disclosed integrations include Amazon cloud services; Facebook Login; Apple ID / Sign in with Apple; the Apple App Store; Google Play; a content-moderation service used to review content for safety and legal compliance; and a third-party message-push service used to maintain communication with our servers and deliver service or personalised notifications. The message-push service may process a push token or SDK identifier, SDK version, necessary device and network information, mobile status information and, where the feature, device permission and applicable law allow, location information. We contractually restrict service providers to the relevant purpose and require appropriate data protection. A provider’s own privacy notice applies where it independently determines how and why it processes personal data. If an integration changes, we will update this Policy or the in-app disclosure and provide notice or obtain consent before the new processing begins where required by law.

7. International data transfers

Sahua is based in Hong Kong and serves users internationally. Your data may be processed in Hong Kong and in other countries where our affiliates, service providers or partners operate. Those countries may have different privacy laws.

Where required, we use safeguards such as contractual data-protection terms, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, transfer risk assessments, access controls and data minimisation. We also take reasonable precautions consistent with Hong Kong’s Personal Data (Privacy) Ordinance. You may contact us for information about safeguards relevant to your data, subject to necessary confidentiality redactions.

8. Data retention

We retain personal data only for the period reasonably necessary to provide the Services and fulfil the purposes described in this Policy, or for the longer period required by applicable law. When that period ends, we delete or anonymise the data so that an individual can no longer be identified and the process cannot reasonably be reversed.

Account, profile and user content: generally retained while your account is active. You may delete your account in the app by selecting Settings - Account - Delete Account. Following deletion, personal data will be removed from Sahua except data that applicable law requires us to retain, including transaction-related records and records that government authorities or law expressly require us to preserve.
Messages: messages are processed and transmitted to their recipients. If you or the recipient is offline, an undelivered message may be stored temporarily. We delete the temporary copy after it is delivered or, if it remains undelivered, no later than 90 days after it was sent. Copies retained by recipients or submitted in a safety report may remain available to those recipients or in a restricted case record.
Cessation of service: if Sahua ceases operations, we will stop collecting personal data promptly, notify users individually or by an appropriate public announcement, and delete or anonymise the personal data we hold, except where continued retention is required by law.
Transaction and other legally required records: retained for the period specified by applicable law or a valid governmental requirement.
Support, reports, moderation and security records: retained for the period reasonably necessary to resolve the matter, protect users and the Services, establish or defend legal claims, and comply with applicable law.
Storage location: The servers used to provide the core platform Services are located in Frankfurt, Germany. Data may also be accessed by authorised support, development and service-provider personnel outside your place of residence as described in Section 7.

We do not keep personal data indefinitely merely because storage is available. Where we cannot state a fixed period, the criteria above determine the retention period.

9. Cookies, SDKs and device permissions

Our website and app may set or access cookies, pixels, local storage and SDK technologies so you can sign in and use features that depend on them. Sahua also uses these technologies to provide personalised services, including promotion services. You may accept or refuse cookies through your browser or mobile-device settings. If you refuse them, features that rely on cookies may not work. Analytics, personalisation and advertising technologies are used only with consent where required, and this Policy applies to personal data obtained through technologies set by Sahua.

We request device permissions only when a feature needs them, such as camera, microphone, photographs or media, notifications, or precise location. The permission prompt explains the immediate purpose. You can revoke permissions in your device settings, although the related feature may stop working. We do not access your contacts, installed-app information or precise location unless the relevant feature requires it, the operating system permits it, and any legally required notice or consent has been provided.

10. Your choices and privacy rights

Depending on where you live and subject to legal exceptions, you may have the right to:

know whether we process your personal data and access a copy;
correct inaccurate or incomplete data;
delete data or your account;
restrict or object to processing, including direct marketing and certain processing based on legitimate interests;
withdraw consent at any time, without affecting processing already carried out;
receive certain data in a portable format;
appeal a refusal of your request or certain automated decisions; and
complain to a privacy or data-protection regulator.

You may edit profile information and communication or permission settings in the app where available. To delete your account, use the in-app account-deletion function if available or email us with the subject “Account Deletion Request”. For other requests, email us with the subject “Privacy Request”. Tell us the account identifier and the right you want to exercise. Do not send passwords or unnecessary identity documents.

We may verify your request by confirming control of the registered email, mobile number or account and may request limited additional information if necessary. An authorised agent may submit a request where local law permits; we may require proof of authority and direct verification with you. We will respond within the period required by applicable law and explain any lawful refusal. We will not discriminate against you for exercising privacy rights.

11. U.S. state privacy disclosures

This section applies where U.S. state privacy law gives you additional rights. In the preceding 12 months, we may have collected the categories described in Section 3: identifiers; customer records; commercial information; internet or electronic activity; geolocation; audio, visual and similar information; inferences; and sensitive personal information, including account credentials, precise location when enabled, message contents, and information you choose to provide that may concern sex life or sexual orientation. We use and disclose these categories for the purposes and recipients described in Sections 4 and 6.

We do not sell personal data for money. Sahua’s advertising mechanism uses indirect user profiles to support promotion and advertising, improve advertising reach and understand user needs; directly identifying personal data is not disclosed to advertising partners without your consent. If this activity constitutes “selling”, “sharing” or targeted advertising under applicable law, you may opt out through an available in-app privacy control or by emailing steven1082025@outlook.com with the subject “Opt Out of Sale/Sharing”. Where legally required and technically supported, we also process recognised browser-based opt-out preference signals for the browser or device sending the signal.

We use and disclose sensitive personal information only for permitted service, safety, verification and compliance purposes, or with consent where required; we do not use it to infer characteristics for unrelated purposes. We do not knowingly sell or share the personal data of anyone under 18.

Eligible residents may request access, correction, deletion, portability, a list of categories or specific third parties as provided by local law, and may appeal a decision. California residents may also request information about categories collected, sources, purposes, and categories of recipients. Submit requests using Section 10. California’s “Shine the Light” law may permit residents to request information about disclosure for third parties’ own direct marketing; use the same contact.

12. European Economic Area, United Kingdom and Switzerland

If you are in the EEA, UK or Switzerland, the legal bases in Section 4 apply. You may lodge a complaint with the supervisory authority where you live, work or believe an infringement occurred. UK users may contact the Information Commissioner’s Office. You may also contact us first so we can try to resolve the concern.

Because we are established outside the EEA and UK, applicable law may require us to appoint a local representative. Where such an appointment is required, current representative details will be made available in the app or on our website. This contact does not limit your right to contact Sahua directly or complain to a regulator.

13. Hong Kong users

For Hong Kong users, HK GOLD SANDS GROUP LIMITED is the data user under the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO). You may request access to and correction of personal data in accordance with the PDPO. We may charge a reasonable fee for an access request where permitted. You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong. We will not use personal data for direct marketing without taking the steps and obtaining the consent required by the PDPO, and you may opt out at any time without charge.

14. Children and age assurance

The Services are intended only for adults aged 18 or older. We do not knowingly permit anyone under 18 to create or use an account. We may use proportionate age-assurance measures and may ask for information reasonably necessary to verify age. If we learn that a person under 18 has provided personal data, we will suspend or close the account and delete the data, subject to limited retention needed for safety, legal compliance or preventing repeat registration. A parent or guardian who believes a minor has used the Services should contact us with the subject “Minor Privacy Report”.

15. Security

We use administrative, technical and physical safeguards designed to protect personal data, including access controls, encryption in transit where appropriate, logging, vendor review and incident-response measures. No internet or storage system is completely secure. Protect your credentials, use available security features, and contact us promptly if you suspect unauthorised access. If a personal-data breach occurs, we will investigate and notify affected people and regulators when required by law.

16. Changes to this Policy

We may update this Policy to reflect changes in the Services, our practices or the law. We will post the revised Policy and change the effective date. If a change materially affects your rights or how we use personal data, we will provide additional notice through the app, website, email or another appropriate channel before the change takes effect where required. If we need consent for a new purpose, we will ask for it rather than relying only on an updated Policy.

17. Contact and complaints

Questions, requests or complaints may be sent to:

HK GOLD SANDS GROUP LIMITED
Unit 617A, Circular Trade Plaza
1 Sha Tsui Road, Tsuen Wan, New Territories, Hong Kong
Registration Certificate No.3047616
Email: steven1082025@outlook.com
Telephone: +852 64975721
Website: https://www.sahua.live

We will acknowledge and investigate privacy complaints and will not retaliate against anyone for raising a concern. You may also contact the regulator that applies in your place of residence.