1. Who we are
Discreet Vibes is operated by ANZSBS Ltd, registered in Hong Kong. Our publishable business contact address is Unit 1603, 16th Floor, The L. Plaza, 367–375 Queen’s Road Central, Sheung Wan, Hong Kong.
For privacy questions, requests or complaints, use our Contact page and choose “Privacy or personal information request”, or email tait@anzsbs.com.
As a Hong Kong-registered operator, we apply Hong Kong’s Personal Data (Privacy) Ordinance where it governs our handling. We also take account of Australia’s Privacy Act 1988 and Australian Privacy Principles, and New Zealand’s Privacy Act 2020 and Information Privacy Principles, where those laws apply to the particular handling or relationship. Publishing this policy does not assert that ANZSBS Ltd is an APP entity under Australia’s Privacy Act 1988.
2. Scope of this policy
This policy covers browsing discreetvibes.com, viewing its product catalogue and guidance, using site search, sending a contact enquiry, creating or using a customer account, and placing, paying for, receiving and getting support with orders. It also covers affiliate referrals, creator applications and the transactional emails we send about accounts and orders.
3. Information we collect
- Contact enquiries: your name, email address, enquiry type, optional order number, message, consent confirmation, submission time and originating Contact page.
- Website and security records: IP address, date and time, requested URL, response status, browser/user-agent information, referring page and security events recorded by the web host and its security systems.
- Contact-form safeguards: short-lived keyed hashes used to limit repeated submissions and suppress exact duplicates, plus short-lived generic status notices. The raw IP address, email address and message are not stored in these WordPress transient records.
- Catalogue interface data: first-party browser storage for age confirmation, anonymous cart-fragment state, browser capability checks and visit-source attribution, as detailed below. Anonymous WooCommerce session records contain interface/cart state, not completed orders or payment data.
- Search terms: a catalogue search is sent to this website to return suggestions and may appear in ordinary URL/access logs. The site does not build a marketing profile from searches.
- Customer accounts: if you create an account on the My Account page: your email address, a username generated from it, a securely hashed password, the date the account was created, and any account details you later add yourself. We send account emails (the password-setup link and any password-reset link) to that address.
- Affiliate referrals: if you follow an affiliate link, our first-party referral cookie identifies the referring affiliate. SliceWP also records the visit, including the IP address, landing page and referring URL, so we can attribute a later purchase and prevent misuse. We do not use this record for third-party advertising.
- Creator applications: if you apply to work with us, we collect the details you provide in the application, your contact and channel details, your proposal, submission and review records, and related correspondence. Applications are reviewed privately by authorised store staff. An application does not automatically create an affiliate account.
When you place an order
- Order and delivery details: your name, delivery and billing address, email address, phone number, the products, colours and quantities ordered, prices, currency, shipping service and charge, order notes you add, and the order date and status.
- Payment information: card and wallet payments are processed by Stripe. Your full card number and security code are entered into Stripe’s secure payment form and go directly to Stripe; they are never sent to or stored by ANZSBS Ltd. We receive and keep limited payment records from Stripe, such as the payment reference, payment method type, card brand, last four digits and expiry, and the payment outcome. If you choose to save a card to your account, Stripe stores it and we keep only a reference to it.
- Fraud prevention: Stripe uses information about the payment, your device and your browser (including IP address) to detect and prevent fraud.
- Fulfilment and tracking: the delivery details needed to pack and ship your order, and the tracking number and delivery status returned by our warehouse and carriers.
- Order source: WooCommerce records how a visitor reached the site (for example direct, a search engine or a referring site) and attaches it to the order for our own sales statistics. It is not used for advertising.
- Support and claims: messages about an order, return, cancellation or quality claim, and any photos or short videos of the product or parcel you choose to send.
Guest checkout is available, so you do not need an account to order. We do not ask for your date of birth or government identification.
4. Information you should not submit
Please do not send payment-card details, passwords, government identification, or unnecessary health, sexual-health or intimate personal details. Product questions can usually be answered without identifying sensitive information. If sensitive information is not needed to respond, we may remove it or delete the message.
5. How information is collected
We collect information directly when you complete the Contact form, submit a creator application, create or use a customer account, place an order, or email us. Stripe collects payment details directly through its payment form on our checkout page. Essential technical information is collected automatically when your browser requests pages, images, styles, fonts or catalogue data from our site and service providers. First-party browser storage is created by our theme, WordPress, WooCommerce and SliceWP.
6. Why we use information
We use information to process, pay for, pack, ship and track orders; send order confirmations, dispatch and tracking emails and other messages about your order; handle cancellations, refunds, returns and quality claims; prevent payment fraud; attribute affiliate referrals and administer commissions; review creator applications and communicate with applicants; keep business and tax records; answer enquiries, provide product guidance and customer support; create, secure and maintain customer accounts (including password-setup and password-reset emails), operate and troubleshoot the catalogue, protect the form and website from misuse, maintain appropriate support and security records, and meet applicable legal obligations. We do not use contact information for an unrelated secondary purpose without permission or another lawful basis.
7. Contact-form collection notice
Using the Contact form is voluntary. Name, email address, enquiry type, message and privacy consent are required because we need them to understand and answer an enquiry; the form cannot be sent without them. An order number is optional and helps us find your order.
A submission is emailed to ANZSBS Ltd’s configured support/privacy mailbox. It is processed by our website host, outbound mail and filtering services, and authorised Google and Microsoft mailbox services. The message is not saved as a contact record in the WordPress database. WordPress stores only short-lived security hashes and generic success/error notices.
To request access to or correction of an enquiry, contact us using the details below and provide enough information for us to locate the message. We may ask for proportionate identity verification before disclosing personal information.
9. Disclosure and service providers
We disclose information only as needed to operate and protect the service, respond to you, obtain professional or legal advice, or comply with law. Our service providers are:
- Hosting, database and backup: WebHostBuzz/WHG Hosting Services and its cPanel, LiteSpeed, malware/security and infrastructure services.
- DNS: Cloudflare provides authoritative DNS. Cloudflare proxy/CDN caching is not enabled for website traffic.
- Fonts: the Google Fonts Web API receives the visitor’s IP address, requested Google URL, browser/user-agent headers and referring page to return a stylesheet/font and for security. Google states that this service does not set or log cookies and does not use the information to profile end users or for targeted advertising.
- Email delivery and filtering: the hosting mail transfer service, antispamcloud filtering, and authorised Google and Microsoft mailbox services process contact messages and delivery metadata.
- Payments: Stripe processes card, Apple Pay, Google Pay and Link payments, refunds and fraud screening. Stripe receives your payment details, billing name and address, email address, the amount and currency, and device and browser information. Stripe acts as an independent controller for some purposes, such as fraud prevention and meeting its own legal obligations; see stripe.com/privacy. Apple Pay, Google Pay and Link are covered by those providers’ own terms when you choose them.
- Fulfilment warehouse: Topest Express, our fulfilment partner in Shenzhen, China, receives the recipient name, delivery address, phone number, email address and the items ordered, so it can pack and dispatch your order and give us tracking details.
- Carriers and customs: postal and courier services in China, in transit countries and in your country receive the delivery details needed to carry and deliver your parcel and to contact you about delivery. Customs authorities receive the customs declaration (recipient details, a general description of the contents and their value) and may collect import charges from you.
- Order emails: order confirmations and dispatch, tracking, refund and account emails are sent from orders@discreetvibes.com through our hosting mail service.
- Multi-currency display: WooCommerce and WPML WooCommerce Multilingual run on our own server. They may use your approximate country, worked out from your IP address, to choose a default display currency.
- Affiliate administration: SliceWP runs on our own website to record affiliate visits, referrals and commissions. Creator applications are held privately in WordPress for review by authorised store staff.
- Professional advisers and authorities: information may be shared when reasonably necessary for legal, accounting, security or regulatory matters.
We do not sell or rent personal information, and we do not share it with third parties for targeted advertising. There is no advertising network connected to the site.
10. International processing and disclosure
The website, WordPress database, operator-accessible web logs and primary hosting backups are located in Singapore. ANZSBS Ltd is registered in Hong Kong and has its published business contact address there, so authorised operational access, privacy handling and support may occur in Hong Kong.
When a visitor in Australia or New Zealand uses the website or contact form, their information is sent to the Singapore hosting environment and the service providers described here. Those countries’ privacy laws may apply to particular handling or relationships; neither is the operator’s place of registration.
Contact email is sent from the Singapore server through antispamcloud infrastructure observed in the United States and onward to authorised Google and Microsoft mailbox services. Those global providers may process or replicate information in other countries under their service arrangements; the precise mailbox storage region is not exposed to this website.
Cloudflare’s DNS network is globally distributed, although page content and contact submissions do not pass through Cloudflare’s reverse proxy. Google Fonts is delivered over Google’s global infrastructure and may involve processing in the United States and other Google service regions. Operator-controlled deployment backups may be held in access-restricted systems whose physical region is not contractually fixed.
When you place an order, your delivery details are sent to our fulfilment warehouse in mainland China, and to carriers in China, in transit countries and in your destination country, because we cannot deliver your order without doing so. Stripe processes payment information in the United States and other countries where it operates, under its own safeguards.
Where an applicable privacy law requires safeguards for an overseas disclosure, we will take reasonable steps appropriate to the information and provider involved.
11. Retention and deletion
The following schedule applies from 11 September 2026 and is reviewed as part of site operations:
- Ordinary contact enquiries and mailbox copies: 12 months after the last substantive exchange.
- Privacy requests, complaints, disputes and records subject to a legal hold: 24 months after closure, or longer only where a specific legal obligation requires it.
- Contact-form rate-limit keys: usable for 15 minutes. Duplicate hashes and generic status notices: usable for 10 minutes. Expired rows may remain until WordPress housekeeping runs, ordinarily within 24 hours.
- WooCommerce cart and checkout sessions: up to 48 hours, then eligible for automated cleanup.
- Orders, invoices, payment and refund records: 7 years after the end of the financial year of the order, as required for Hong Kong business and tax records. If you ask us to delete your account, we keep these records for that period but stop using them for anything else.
- Return, cancellation and quality-claim messages, photos and videos: 24 months after the claim is closed, or longer if needed for an unresolved dispute.
- Customer accounts: kept while the account remains open. Ask us to delete your account at any time using the contact details below; it is then removed from the live website, and backup copies expire under the backup schedule.
- Creator applications and related correspondence: 12 months after the last substantive exchange if an application is not approved, unless a dispute or legal obligation requires longer. Approved affiliate relationship and commission records are kept while the relationship is active, with financial records retained for 7 years after the end of the relevant financial year.
- Affiliate visit and referral records: up to 12 months after the visit or the related commission decision, unless needed for an active dispute or legal obligation. The referral cookie expires after 30 days.
- Operator-accessible web/access and mail-delivery logs: 30 days. An extract connected to a confirmed security incident may be retained for 12 months after the incident closes.
- Routine deployment and website backup copies: 90 days, unless temporarily retained to investigate an active restoration, security or legal issue.
- Browser cookies and storage: as stated in the table above; visitors can remove them at any time using browser controls.
Provider-controlled infrastructure and security logs may follow the provider’s own shorter or longer operational schedule where we cannot configure them. We minimise what is sent to those providers and review provider arrangements when services change.
12. Security and discretion
We use HTTPS, access controls, restricted administrative access, maintained WordPress components, hosting security controls, server-side validation, a WordPress nonce, an invisible honeypot, short-lived rate limiting and keyed hashes. Contact messages are sent only to the configured support/privacy mailbox. Card details are entered into Stripe’s secure payment form and are never stored on our website.
Because the catalogue concerns intimate products, we minimise collection and ask visitors not to provide unnecessary sensitive details. No internet or email system can be guaranteed completely secure, but we review issues and take reasonable protective steps appropriate to the information involved.
13. Access, correction and deletion requests
Depending on the law that applies, you may ask for access to personal information we hold about you, correction of inaccurate information, deletion where applicable, or an explanation of how it has been handled. No account login is required.
Use the Contact page and choose “Privacy or personal information request”, or email us. Describe the request and the email address used for your enquiry, account or order. We may need to verify identity proportionately and will explain if an applicable exception prevents us from completing part of a request.
14. Privacy complaints
Send a privacy complaint through the Contact page or by email. Include what happened, when it occurred and the outcome you are seeking, without adding unnecessary sensitive information. We aim to acknowledge a complaint within five business days and provide a substantive response within 30 calendar days, or explain if more time is reasonably needed.
If the complaint is not resolved, the Hong Kong Privacy Commissioner for Personal Data may be available in connection with the Hong Kong operator. The Australian or New Zealand regulator may be available only where that country’s law applies to the particular handling or relationship:
- Hong Kong Privacy Commissioner for Personal Data
- Office of the Australian Information Commissioner
- New Zealand Office of the Privacy Commissioner
Listing a regulator does not mean that every regulator has jurisdiction over every visitor or complaint.
15. Children and age restrictions
This site and its products are intended only for adults aged 18 or over. We do not knowingly request personal information from minors. If you believe a person under 18 has sent information, contact us with enough detail to locate it and we will assess and, where appropriate, delete it.
16. Direct marketing
The site does not currently accept newsletter subscriptions or send direct-marketing emails. Contact, account and order details are not added to a marketing list. Before this changes, we will introduce appropriate consent, disclosure and unsubscribe controls and update this policy.
17. Accounts, orders, payments and delivery
You can create a customer account on the My Account page with your email address, or check out as a guest. An account lets you see your orders and, if you choose, save a card with Stripe for future purchases. You can remove a saved card from your account at any time.
When you order, we use your details to take payment through Stripe, send your order to our fulfilment warehouse, ship it with a tracked carrier, and email you about your order. We use your phone number only for delivery and for contacting you about your order. Emails about your order and account are transactional, not marketing.
Payment-card numbers and security codes are handled by Stripe and are never stored by ANZSBS Ltd. Payments appear on card statements as ANZSBS LIMITED.
18. Automated decisions
We do not use personal information for profiling or automated decisions that produce legal or similarly significant effects. Automatic form validation, honeypot checks, duplicate suppression and short-term rate limiting only decide whether a contact attempt can be accepted; they do not evaluate a person’s suitability, preferences or purchasing eligibility. Stripe’s automated fraud screening may decline a payment that appears fraudulent; if that happens, contact us and we will help.
19. Changes to this policy
We will update the “Last updated” date when this policy changes. A prominent site notice may be displayed before or when a material change takes effect, especially before marketing is introduced. Earlier versions and the reasons for material changes will be retained in our project records.
20. Contact us
ANZSBS Ltd — Discreet Vibes
Unit 1603, 16th Floor, The L. Plaza
367–375 Queen’s Road Central
Sheung Wan, Hong Kong
Privacy email: tait@anzsbs.com
Contact Discreet Vibes