1. 誰負責你的資料
澳市 mMart 的資料控制者是 Kevin Lei（李尚霖 / Seong Lam Lei）。有關私隱、查閱、更正或刪除資料的要求，請寄到 support@mmart.app。
mMart 是澳門本地二手商品刊登及買賣聯絡平台，目前提供一口價交易，不開放拍賣。我們不代收、保管或轉移交易款項。你必須年滿 18 歲 才能使用。
2. 我們收集什麼、用來做什麼
以下 P1–P10 是資料類別的對照編號，方便你查閱。
P1 帳戶聯絡資料
註冊需要電郵地址或電話號碼至少一項，以及密碼和暱稱。電郵或電話用來識別帳戶、登入及提供帳戶支援，不在公開個人頁展示。密碼重設使用電郵；只提供電話的帳戶不能透過這項功能接收重設碼，我們不會因此發送短訊。
P2 公開個人資料
我們保存暱稱、帳戶識別資料、註冊時間、已有的頭像連結及評分摘要，以顯示賣家和聊天對象。暱稱會公開；如果你在暱稱或支援信件寫下真實姓名，我們也會收到。目前沒有頭像上傳或新增評價功能。
P3 商品資料與相片
我們保存你提供的商品標題、描述、標價、幣種、類別、成色、狀態、相片，以及商品標記，供刊登、搜尋、篩選及展示。你選擇的澳門半島、氹仔或路環區域也會保存；這不是手機 GPS 定位。公開商品、相片及賣家公開資料可供其他人瀏覽。
新上傳的商品圖片會完整讀取、轉正方向並重新編碼，去除 EXIF／GPS 等隱藏資料；我們保存處理後的圖片，不保存原始上傳檔案。這不會抹去照片中可見的地址、臉孔或證件文字。舊圖片及舊外部連結沒有自動重新處理。請在上傳前移除不必要的個人資料。
P4 站內聊天
我們保存訊息內容、對話雙方、相關商品、發送及已讀時間，以及防止重複傳送所需的識別資料，用來提供聊天、未讀提示及可靠傳送。對方可以閱讀訊息；聊天不是端對端加密，平台可為必要的支援、安全及維運工作處理訊息。
P5 成交資料與定價建議
賣家標記成交時，我們保存成交價、原標價、幣種、商品類別和成色、成交時間及買賣聯絡關係，用來保留成交紀錄並避免重複記錄。這只是賣家的成交聲明，不代表我們確認已付款。
成交價不會公開，也不會顯示給聊天對方；賣家可在自己的成交紀錄查看。我們會使用成交價及相關商品資料改善定價建議。 這個用途是研究同類商品的成交情況，並不包括廣告定向、信用評分或依個人身分決定價格。我們沒有聲稱已提供自動化的個人定價服務。
P6 舉報與封鎖
我們保存舉報對象、原因、你選填的說明、舉報人與相關帳戶的關係，以及處理狀態、處理時間、決定、必要備註和處理人員資料，以處理違規、爭議及安全問題。封鎖關係用來限制新訊息。我們不向被舉報者公開舉報人身分或封鎖方向。請勿在說明中加入多餘的敏感資料。
P7 登入、安全與同意紀錄
我們保存密碼的安全摘要、登入憑證的有效及撤銷紀錄、帳戶停用或刪除狀態，以驗證身分和防止濫用，不長期保存明文密碼。App 的登入憑證存放在 iOS 安全儲存區。
註冊時，你要明確聲明年滿 18 歲並同意當時的使用條款和社群守則。我們保存帳戶識別資料、接受的版本及時間，作為約定及爭議的證明。這份同意紀錄不包含 IP、出生日期或證件，亦不是年齡核驗。 連線及限流資料另按 P8 處理。
重設密碼時，我們處理電郵地址及驗證碼。後端保存的是安全摘要，不是明碼；驗證碼有效 15 分鐘，錯誤五次後失效。最近一次成功重設的安全摘要會保留，以便斷線後確認相同操作的結果；未註冊的電郵也會產生摘要形式的請求紀錄，避免洩露帳戶是否存在。驗證碼到期不代表這些紀錄已刪除。重設成功會使舊登入憑證失效。
P8 連線與技術資料
主機及 Cloudflare 為傳送連線、防濫用、排錯和維持服務，會處理 IP、請求的頁面或路徑、時間、回應狀態及技術錯誤。搜尋字詞可能隨請求路徑傳送；如供應商保留該路徑，也可能留在紀錄中。我們不以 IP 推算你的位置或進行廣告追蹤。
目前的正式部署設定關閉應用程式及源站代理的存取日誌；這不代表 Cloudflare 或其他供應商沒有紀錄。登入、註冊、重設密碼及刪除密碼檢查會使用短期的 IP 或帳戶相關計數限制濫用；這些計數在服務運作的記憶體中處理，通常在一小時內的視窗過後按請求清理，重啟會清空。供應商日誌另行保存。
P9 支援電郵
你聯絡支援時，我們會收到寄件地址、內容和你自行附上的檔案，用來回覆支援、私隱權利及安全要求。請勿寄送密碼、登入碼或不必要的證件副本。
P10 以往的拍賣紀錄
目前不接受新拍賣或出價。如帳戶有過往測試或使用留下的拍賣、出價及結算紀錄，我們仍保存相關商品、參與關係、金額及時間，以處理歷史紀錄和爭議。關閉拍賣不等於刪除了這些資料。
不提供必要的註冊資料便不能建立帳戶；不提供刊登或聊天所需內容便不能使用該項功能。選填描述、支援附件等由你決定是否提供。我們不要求手機精確定位、通訊錄、銀行帳戶或付款卡資料。目前沒有廣告、第三方追蹤或分析 SDK；不出售個人資料，不向廣告網絡或資料經紀商分享。改善定價建議的成交資料用途不因沒有分析 SDK 而消失。
3. 誰會收到資料、資料放在哪裡
公開訪客可看到已發布的商品、相片和公開個人資料；聊天對方可看到對話內容。只有因支援、安全或維運工作需要的授權人員才應存取相關私人資料。
- 恒創科技（香港 VPS）：提供主機，帳戶、商品、聊天及其他服務資料存於香港。
- Cloudflare：提供網絡代理、DNS，以及 R2 圖片和備份儲存；處理連線資料、圖片及加密的資料庫備份。其網絡及服務可能在澳門、香港以外處理資料，不能把香港主機理解為所有副本只在香港。
- Resend（美國公司）：發送密碼重設碼及密碼更新通知，會收到收件電郵地址及郵件內容，包括重設碼；電郵地址會傳到美國。自動郵件由 noreply@mmart.app 發出。新舉報也會經此服務寄送最少資料的內部通知，只含舉報編號、對象種類和原因，不含舉報說明、訊息內容、商品內容或舉報人聯絡資料。
- 支援收信服務：你寄往 support@mmart.app 的信件會經電郵服務處理；不要把此地址當成即時救援渠道。
資料存於香港，屬澳門《個人資料保護法》（第 8/2005 號法律）第 19、20 條意義下向澳門以外轉移資料。 傳往美國的發信資料，以及境外儲存和維運，也涉及跨境處理。接受使用條款不等於已完成法律要求的跨境轉移程序；本政策不表示已取得任何許可或批准。
我們會在提供你要求的服務、維持安全、處理爭議或履行適用法律義務所需的範圍內處理資料。需要另行同意的處理會另作說明；你可聯絡支援撤回以同意為基礎的處理，可能影響相關功能。只有在適用法律允許及必要的範圍內，才向有權機關提供資料。
4. 保存多久、刪除帳戶後會怎樣
帳戶使用期間，我們保存提供服務所需的資料。訊息、成交、舉報、同意及安全紀錄沒有統一的自動到期刪除時間；我們不承諾刪除帳戶就會立即清空所有資料。這些保留只應限於相應服務、爭議、安全或法律目的所需，不能作無關用途。你可聯絡支援查詢或提出刪除要求。
你可在 App 內用目前密碼要求刪除帳戶。成功後：
- 帳戶不能再登入，舊登入憑證失效；電郵、電話及頭像連結清除，暱稱改為「已刪除的使用者」，密碼不能再使用，該帳戶的重設密碼紀錄清除。仍保留沒有直接聯絡資料的帳戶及必要安全識別紀錄。同一電郵可以重新註冊，但會是新帳戶。
- 你的全部商品及商品相片會從公開頁隱藏。隱藏的商品資料仍可能保存；商品標題會留在對方的聊天紀錄中。
- 我們會嘗試刪除可確認屬於你的平台圖片檔案及已有頭像檔案。檔案刪除失敗不會取消已成功的帳戶刪除，仍需後續清理；舊外部連結只能移除連結，無法替你刪除第三方原檔，也不能保證快取或他人副本立即消失。
- 你曾發送的訊息和對話仍保留，對方仍可閱讀，並看到「已刪除的使用者」。 對方不能再向已刪除的帳戶發新訊息；他人截圖或自行保存的副本不會隨之刪除。
- 成交價、商品類別、成色、時間等成交資料以匿名顯示方式保留，用於成交紀錄及改善定價建議。 成交紀錄會移除你作為買家或賣家的直接帳戶標示；但歷史對話及商品關聯仍在，因此不能保證完全、不可逆地匿名。不要把匿名顯示理解為所有資料已無法再與你聯繫。
- 與你有關的雙向封鎖紀錄會刪除。舉報、處理決定、必要安全證據和註冊同意紀錄仍會保留，用來處理安全、約定及爭議；被隱藏訊息的原文可作非公開證據保存。刪除帳戶不會自動清除供應商日誌、支援郵件或以往拍賣紀錄。
被停用的帳戶須聯絡支援核實並要求刪除。如有以往仍未結算的進行中拍賣，而你是賣家或當時最高出價者，自助刪除會被阻擋，須先由支援協助處理；目前不開放新拍賣。
資料庫備份會加密上傳 Cloudflare R2，保留 30 天並輪替。 備份可能含有刪除前的資料，不會因帳戶刪除即時改寫每份備份；輪替及檔案刪除若遇故障仍需處理，30 天不是所有服務資料的保存期限。資料庫備份不等同圖片檔案的完整備份。登入憑證及重設碼的有效期也不是其他資料的刪除期限。
5. 你的選擇與權利
你可向 support@mmart.app 查詢資料處理情況，要求查閱、更正、刪除或封存不符合要求的資料，以及提出適用的反對或撤回同意要求。我們需要以相稱方式確認是你本人，並保護他人的資料；法律要求保留的內容可能不能立即刪除。不要寄送密碼或完整登入憑證。如有未解決的私隱疑慮，你可向澳門個人資料保護主管機關查詢或申訴。
6. 安全、年齡與更新
我們使用密碼安全摘要、可撤銷的登入憑證、存取權限檢查及防止密碼猜測的限制；備份採用加密。這些措施不能保證永不發生事故。圖片重新編碼不等於病毒掃描或自動圖片內容審核；目前沒有提供這兩項能力。
未滿 18 歲人士不得使用。發現未達年齡的帳戶後，我們會刪除帳戶並清除直接身分資料，其他內容及必要安全紀錄依上文處理。你可在 App 內以「疑似未滿 18 歲」舉報，或通知支援。
政策更新會刊登在本頁。重要的資料用途改變會另作告知，並在需要時取得同意。
English version
1. Who is responsible
The data controller for mMart is Kevin Lei (李尚霖 / Seong Lam Lei). For privacy questions, access, correction or deletion requests, email support@mmart.app.
mMart provides local second-hand listings and buyer–seller communication in Macau. It currently supports fixed-price sales, with no new auctions. We do not receive, hold or transfer transaction payments. You must be 18 or older to use mMart.
2. What we collect and why
P1–P10 are reference numbers for the data categories below.
P1 — Account contact details. Registration requires an email address or phone number, a password and nickname. Contact details identify your account and support login and account assistance; they are not displayed on your public profile. Password recovery uses email. Phone-only accounts cannot receive email reset codes through this feature, and we do not send recovery texts.
P2 — Public profile. We keep your nickname, account identifiers, registration time, any existing avatar link and rating summary to show sellers and chat participants. Nicknames are public. We receive your real name if you choose to include it in a nickname or support message. Avatar uploads and new reviews are currently unavailable.
P3 — Listings and photos. We keep titles, descriptions, asking prices, currencies, categories, condition, status, photos and item labels for publishing, search, filtering and display. We also keep your manually selected Macau Peninsula, Taipa or Coloane area; this is not device GPS. Published items, photos and seller profiles are publicly viewable. New listing uploads are fully decoded, oriented and re-encoded to remove hidden metadata including EXIF/GPS. We store the processed image, not the original upload. Visible addresses, faces and document text remain in the image. Existing images and legacy external links are not automatically reprocessed. Remove unnecessary personal information before uploading.
P4 — In-app messages. We keep message content, participants, the related listing, sending/read times and identifiers needed to prevent duplicate delivery. These support chat, unread indicators and reliable sending. Your counterpart can read messages. Chat is not end-to-end encrypted; the platform can process it for necessary support, safety and operations.
P5 — Completed sales and price suggestions. When a seller marks an item sold, we keep its final and asking prices, currency, category, condition, completion time and buyer–seller communication links to record the sale and avoid duplicates. This is a seller declaration, not verified payment. The final price is not public or shown to the chat counterpart; the seller can view it in their own sale record. We use final prices and related item details to improve price suggestions. This studies comparable sales; it does not include advertising targeting, credit scoring or setting prices based on personal identity. We do not claim to provide automated personal pricing.
P6 — Reports and blocks. We keep report subjects, reasons, optional explanations, reporter and account relationships, status, handling times, decisions, necessary notes and operator details to handle violations, disputes and safety. Blocks restrict new messages. We do not disclose the reporter's identity or block direction to the reported person. Avoid unnecessary sensitive information in reports.
P7 — Login, security and acceptance records. We keep protected password summaries, credential validity/revocation records and disabled/deleted account status for authentication and abuse prevention, rather than retaining plaintext passwords. App credentials use secure iOS storage. Registration requires an explicit 18-plus declaration and acceptance of the current terms and community guidelines. We keep account identifiers, accepted versions and time as evidence of the agreement and for disputes. This acceptance record contains no IP address, date of birth or identity document and is not age verification. Connection and rate-limit information is handled separately under P8.
Password recovery processes email addresses and codes. The backend stores protected summaries, not plaintext codes. Codes last 15 minutes and become invalid after five wrong attempts. Protected summaries of the latest successful reset remain so an identical operation can be confirmed after a lost connection. Requests for unregistered addresses also leave digest-based records to avoid revealing whether an account exists. Code expiry does not delete these records. A successful reset invalidates earlier login credentials.
P8 — Connection and technical information. Our host and Cloudflare process IP addresses, requested pages or paths, times, response status and technical errors to deliver connections, prevent abuse and operate the service. Search terms can travel in request paths and may remain if a provider retains those paths. We do not use IP addresses to infer location or for advertising tracking. Current production configuration disables application and origin-proxy access logs; this does not mean Cloudflare or other providers keep no records. Login, registration, password recovery and deletion password checks use short-term IP/account-related abuse counters held in service memory. They are cleared on requests after their windows, generally up to one hour, or on restart. Provider logs have separate retention.
P9 — Support email. We receive your sender address, message and volunteered attachments to handle support, privacy rights and safety requests. Do not send passwords, login codes or unnecessary identity documents.
P10 — Earlier auctions. New auctions and bids are unavailable. If earlier testing or use left auction, bid or settlement records, related items, participants, amounts and times remain for history and disputes. Turning auctions off does not delete that history.
Without required registration details you cannot create an account; listings and messaging require their necessary content. Optional descriptions and support attachments are your choice. We do not request precise device location, contacts, bank accounts or payment-card details. There are currently no advertising, third-party tracking or analytics SDKs. We do not sell personal data or share it with advertising networks or data brokers. The sale-data purpose of improving price suggestions still applies without an analytics SDK.
3. Recipients and locations
Public viewers can see published listings, photos and public profiles. Chat counterparts can see conversations. Authorized people should access private information only as needed for support, safety or operations.
- 恒創科技 (Hong Kong VPS) hosts the service; account, listing, chat and other service data is stored in Hong Kong.
- Cloudflare provides the proxy, DNS and R2 image/backup storage, handling connection data, images and encrypted database backups. Its network and services may process data outside Macau and Hong Kong. Hong Kong hosting does not mean all copies stay in Hong Kong.
- Resend (a US company) sends password-reset codes and password-update notices and receives recipient addresses and message content, including reset codes. Email addresses are transferred to the United States. Automated messages come from noreply@mmart.app. Minimal internal report notifications use the same provider, containing only a report reference, subject type and reason, without explanations, message/listing content or reporter contact details.
- Incoming support email services process mail sent to support@mmart.app. This address is not an emergency service.
Storage in Hong Kong is a transfer outside Macau within the meaning of Articles 19 and 20 of Macau's Personal Data Protection Act (Law No. 8/2005). US email delivery and overseas storage/operations also involve cross-border processing. Acceptance of the terms does not fulfil the legal transfer procedures. This policy does not represent that any authorization or approval has been obtained.
We process data as needed to provide the services you request, maintain safety, handle disputes or meet applicable legal duties. Processing requiring separate consent will be explained separately. You may contact support to withdraw consent-based processing, which may affect the relevant feature. Data is provided to competent authorities only where permitted by applicable law and necessary.
4. Retention and account deletion
While your account is used, we keep data needed for the service. Messages, sales, reports, acceptance and security records have no single automatic expiry. Deleting an account does not immediately erase all data. Retention should be limited to the relevant service, dispute, safety or legal purpose, with no unrelated use. Contact support to ask about retained data or request deletion.
You can request account deletion in the App using your current password. On success:
- Login ends and earlier credentials become invalid. Email, phone and avatar links are cleared, the nickname becomes “Deleted user,” the password stops working and that account's recovery records are removed. An account record without direct contact details and necessary security identifiers remains. Reusing the email creates a new account.
- All your listings and listing images are hidden from public pages. Hidden listing information can remain, including item titles in your counterpart's conversations.
- We attempt to delete platform image files and existing avatar files that can be confirmed as yours. File-deletion failures do not undo successful account deletion and need follow-up cleanup. Legacy external links can only be unlinked; we cannot delete third-party originals or guarantee immediate removal of caches and other people's copies.
- Your past messages and conversations remain readable by the counterpart, showing “Deleted user.” They cannot send new messages to the deleted account. Screenshots and independently saved copies remain outside this process.
- Final prices and sale details such as category, condition and time remain with an anonymous display for sale records and improving price suggestions. Your direct buyer/seller account label is removed from sale records, but historical conversation and item links remain. Complete, irreversible anonymity is not guaranteed; anonymous display does not mean all links to you are impossible.
- Blocks in both directions are removed. Reports, decisions, necessary safety evidence and registration acceptance records remain for safety, agreements and disputes. Original hidden messages may remain as non-public evidence. Account deletion does not automatically erase provider logs, support mail or earlier auction history.
Disabled users must contact support for verified deletion. If an earlier active auction remains unsettled and you are its seller or current highest bidder, self-service deletion is blocked until support helps address it. New auctions are currently unavailable.
Database backups are encrypted, uploaded to Cloudflare R2 and retained on a 30-day rotation. They may contain pre-deletion data and are not individually rewritten immediately on account deletion. Rotation or file-deletion failures still need handling. Thirty days is not a universal retention period for service data. Database backups are not a complete backup of image files. Credential/code validity is also separate from data retention.
5. Your choices and rights
Email support@mmart.app to ask about processing, request access, correction, deletion or blocking of noncompliant data, or exercise applicable objection and consent-withdrawal rights. We need proportionate identity checks and must protect other people's information. Legally required records may not be immediately erased. Do not send passwords or complete credentials. For unresolved privacy concerns, you may contact or complain to Macau's competent personal data protection authority.
6. Safety, age and updates
We use protected password summaries, revocable credentials, access checks and password-guessing limits; backups are encrypted. No measure guarantees that incidents never occur. Re-encoding images is not virus scanning or automated visual moderation; neither is currently provided.
People under 18 must not use mMart. If we discover an underage account, we delete the account and clear direct identifying details, handling other content and necessary safety records as above. Report suspected under-18 accounts in-app or contact support. Updates appear on this page. Material changes to data purposes will be separately notified, with consent where required.