FULLSEND PRIVACY
Privacy notice.
Buying needs some data. Analytics do not. This notice explains the current data flows, the choices you control and the limits of our retention and verification claims.
Operator and requests.
Disclosed operator
Second Dream Games Limited (第二夢遊戲有限公司), BRN 77902346, is disclosed as the store operator responsible for this notice.
Registered office
Its registered office is ROOM 5, FTY B, 23/F, KIN GA INDUSTRIAL BUILDING, 9 SAN ON STREET, TUEN MUN, HONG KONG.
What this declaration means
The operator relationship is a project declaration, with the evidence boundaries described on our Company and Trust pages.
Privacy questions and identity checks
For access, correction, deletion or another privacy question, contact legal@
Data the service handles.
Order and payment records
Orders include your checkout email, order number, selected items, quantities, USD amounts, payment status, provider identifiers, timestamps and accepted legal version.
Support and refund requests
Support and refund requests include the information you send and the request status.
Access and service records
Service records include notification attempts, dispatch status, audit logs and hashed access tokens. Cart and order-access cookies connect your browser to those records.
Technical request information
Request IP information is used by short-lived in-memory rate limits; hosting and network infrastructure may also process technical request logs. No store account password is required.
Approximate network location
When internal cart and checkout notifications are configured, we also use the request IP address, autonomous system number and approximate city and country. IP-based location can reflect a VPN, internet provider or corporate gateway rather than your physical location. We do not request GPS coordinates or your browser's precise-location permission for this lookup.
How service data is used.
Running and protecting your order
We use service data to maintain the cart, create and verify payment, provide protected order access, review delivery and refund issues, answer communications and prevent misuse. Order and accounting records may also be needed for applicable legal obligations and disputes.
Analytics are a separate decision
We do not treat buying as permission for optional analytics. GA4 measurement runs only after a separate affirmative choice.
What this notice does not certify
This notice does not claim that every service has been independently audited or that processing meets every jurisdiction's requirements.
Internal cart and checkout monitoring
Internal notifications let the team monitor successful cart additions and the start of checkout with a non-empty cart. This lookup does not verify your identity, determine your price by country or make an automated fraud decision.
Who receives which data.
- CosmoPAY · payment
- CosmoPAY receives payment and order information, including the checkout email, to create and process the invoice.
- Resend · order email
- Resend handles the recipient email and secure order-link message.
- Telegram · paid-order notifications
- When configured, an invoice-created Telegram notification can include the checkout email, order number, selected items and amount; it explicitly does not confirm payment. Paid-order Telegram notifications can include email, order number, items, amounts, payment time and an internal reference code.
- GeoJS · approximate network location
- GeoJS receives your public IP address to return its autonomous system number and approximate city and country. The lookup request does not include your email, basket contents, cookies, order-access tokens or reference code.
- Telegram · cart and checkout activity
- For cart additions and the start of checkout, Telegram receives the IP address, autonomous system number, approximate city and country together with items, options, quantities, USD amounts and event time. These activity notifications do not include your checkout email; the paid-order notifications described above are separate.
- Hosting, database and network
- Hosting, database and network providers process data needed to deliver the service.
- Google · only with analytics consent
- If you allow analytics, Google processes GA4 events.
Processing locations and safeguards
Providers may process information outside Hong Kong or your home country under their own terms and safeguards. We do not claim that all processing is local or that no data is shared.
What we do not send to GA4
We do not send checkout emails, order-access tokens or personalized URL parameters to GA4. This is not a promise that payment or email providers receive no personal information.
Analytics are your choice.
Where tracking can run
GA4 can measure public page visits and shopping actions on public content pages, such as adding an item to the cart. Private cart, checkout and order routes do not load GA4 or send tracking events, so checkout and purchase measurement is not collected there.
Refusing does not restrict shopping
Declining analytics does not restrict the cart, checkout or order access. Before consent, and after refusal, the GA loader and tracking events are disabled.
Changing or withdrawing your choice
Use the Analytics preferences button below or in the footer to accept or decline. Withdrawing consent stops new events, removes accessible GA cookies and reloads the page without GA.
The limits of withdrawal
It does not erase data already received by Google. We do not replay shopping events that happened before consent.
Internal notifications are separate
Your GA4 choice controls optional Google analytics, not the internal GeoJS and Telegram notifications described above. Declining or withdrawing GA4 consent does not disable those operational notifications. This distinction describes the current service; it is not a claim that your analytics choice provides a legal basis for other processing.
Access expiry is not deletion.
No fixed automated purge schedule
Records are kept according to their operational purpose, accounting or legal requirements and dispute-handling needs. There is no fixed automated purge schedule in the current service. We do not promise that all order, payment, notification or audit data is deleted after the access link expires.
Access, correction or deletion requests
Contact the legal team to request access, correction or deletion. Requests are reviewed manually and may be limited by verification needs, legal record-keeping or an unresolved dispute. Available rights depend on applicable law; this notice does not promise a universal response deadline or immediate deletion from provider backups.
Location data and provider records
For the GeoJS lookup, the application uses the address and returned location in memory for the internal message; it does not add them to the database, a location cache or separate cookies. This does not prevent Telegram from retaining the message or GeoJS and infrastructure providers from keeping their own request logs. We do not promise an automatic deletion period for those provider records.
Security and notice updates.
Access measures and your part
Protected order access uses expiring links, hashed tokens and browser binding. These measures reduce particular access risks; they are not a guarantee of absolute security. Keep your secure link private and contact support if you believe it has been exposed.
Checking for notice updates
This notice was updated on 28 October 2026 to describe GeoJS lookups, internal activity notifications and invoice-created order notices. Check this notice for changes to the data flows described here.
Contact the right team.
What to include — and keep private
For a purchase, use your checkout email and order number. Do not send account passwords, private keys or your secure order link. For legal or privacy requests, explain the issue and the information you want us to review.