Privacy policy

Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains how IDEA ULTRA LIMITED, trading as Still Sanctuary (“Still Sanctuary”, “we”, “us”, or “our”), collects, uses, discloses, and protects personal information when you visit stillsanctuary.com, place an order, create an account, contact us, or otherwise use our services.

1. Who Controls Your Information

Data controller/business: IDEA ULTRA LIMITED

Address: Room D07, 8/F, Kai Tak Factory Building, No. 99 King Fuk Street, San Po Kong, Hong Kong

Privacy email: stillsanctuary@hotmail.com

UK/EU representative or Data Protection Officer: not currently appointed. We will update this notice if an appointment becomes legally required.

2. Information We Collect

Depending on how you use our services, we may collect:

  • identifiers and contact details, including name, email, phone number, billing and shipping addresses;
  • account details, preferences, and authentication information;
  • order, transaction, payment-confirmation, return, and customer-support information;
  • device, browser, IP address, cookie identifiers, and Site-usage information;
  • marketing preferences and interactions with messages or advertisements;
  • reviews, images, messages, and other content you submit;
  • information from Shopify, payment processors, delivery companies, analytics providers, advertising platforms, social platforms, and other service providers.

Payment providers process full payment-card details. We generally receive payment confirmation and limited transaction information rather than full card numbers.

3. How We Use Information

We use personal information to:

  • process payments, fulfil orders, arrange delivery, and manage returns;
  • provide accounts, customer support, and service communications;
  • operate, secure, troubleshoot, and improve the Site;
  • detect fraud, abuse, and security incidents;
  • personalise shopping and measure Site performance;
  • send marketing where permitted and respect opt-out choices;
  • comply with legal, tax, accounting, product-safety, and regulatory obligations;
  • establish, exercise, or defend legal claims.

For UK/EEA users, our legal bases may include performance of a contract, compliance with legal obligations, legitimate interests, and consent where required.

4. Cookies and Similar Technologies

We use strictly necessary cookies to operate checkout, security, accounts, and core Site functions. With consent where required, we may use analytics, functionality, advertising, and social-media technologies.

You can manage preferences through our cookie banner and browser controls. Withdrawing consent does not affect prior lawful processing. Blocking some cookies may affect Site functionality. Additional details should be provided in a separate Cookie Policy or cookie-preference centre.

5. How We Disclose Information

We may disclose relevant information to service providers and partners that help us operate, including:

  • Shopify and hosting/commerce providers;
  • payment processors and fraud-prevention providers;
  • warehouses, fulfilment providers, delivery companies, and customs agents;
  • customer-support, email, translation, review, analytics, and advertising providers;
  • professional advisers, insurers, auditors, regulators, courts, and law-enforcement bodies where legally required;
  • a buyer or successor in connection with a merger, sale, restructuring, or similar transaction.

Current Shopify applications include Dianxiaomi, 妙手, Translate & Adapt, and Messaging. We also use Shopify, payment providers shown at checkout, logistics providers, analytics technologies, and advertising platforms including those used for cross-site advertising. Each provider receives only information reasonably necessary for its function and is subject to its own contractual and legal obligations.

We do not disclose personal information merely because a third party asks for it. We do not sell personal information for money. Certain advertising or analytics disclosures may be treated as “sale”, “sharing”, or targeted advertising under some US state laws; see the US Privacy Rights section.

6. International Transfers

Your information may be processed outside your country, including where Shopify and other providers operate. Where required, we use recognised safeguards such as adequacy decisions, contractual clauses, or other lawful transfer mechanisms.

7. Retention

We retain information only as long as reasonably necessary for the purposes described above, including order fulfilment, support, fraud prevention, tax and accounting obligations, dispute resolution, and legal compliance. Order and accounting records are generally retained for up to seven years unless a different period is legally required; marketing data is retained until consent is withdrawn or it is no longer needed.

8. Security

We use reasonable administrative, technical, and organisational safeguards. No transmission or storage method is completely secure. Keep account credentials confidential and contact us if you suspect unauthorised access.

9. Your Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to withdraw consent. You may also have the right to complain to a data-protection authority.

UK users may complain to the Information Commissioner’s Office, although we encourage you to contact us first.

10. US State Privacy Rights

Residents of certain US states may have rights to know/access, delete, correct, obtain a portable copy, opt out of sale/sharing or targeted advertising, and limit certain uses of sensitive information, subject to legal thresholds and exceptions. We will not discriminate against you for exercising an applicable privacy right.

Requests may be submitted through stillsanctuary@hotmail.com or WhatsApp +852 6694 3843. We may verify identity before completing a request. Authorised agents must provide legally sufficient authority.

Based on our current size and activity, we do not presently believe the CCPA/CPRA business thresholds apply. We nevertheless honour applicable privacy requests and opt-out signals where technically supported. Because we intend to use cross-site advertising, we will provide a cookie-preference and advertising opt-out mechanism and will reassess state-law thresholds as the business grows.

11. Marketing Choices

You can unsubscribe using the link in marketing emails or contact us. Service messages concerning orders, security, or policy changes are not promotional and may still be sent where necessary.

12. Children

Our services are not directed to children under 13, or a higher age where required by local law. We do not knowingly collect children’s personal information. Contact us if you believe a child has provided information.

13. Third-Party Links

Third-party websites and services have their own privacy practices. We are not responsible for their policies or content.

14. Changes

We may update this Policy to reflect operational, legal, or regulatory changes. We will post the new version and update the date above, and provide additional notice where required.

15. Contact and Complaints

Privacy email: stillsanctuary@hotmail.com

Postal address: Room D07, 8/F, Kai Tak Factory Building, No. 99 King Fuk Street, San Po Kong, Hong Kong

Privacy requests may be submitted by email or through the Contact page at stillsanctuary.com.