PRIVACY POLICY

Last updated: July 20, 2026

This Privacy Policy describes how BuySun International Trading (HK) Co., Limited ("FrayNYC," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal information when you visit fraynyc.com, use our custom photo and cross-stitch preview tools, communicate with us, or make or attempt to make a purchase (collectively, the "Services").

1. Personal information we collect

Device and usage information. When you use the Services, we may automatically collect information such as your IP address, browser type and version, operating system, device category (for example, desktop, mobile, or tablet), time zone, language, screen and device characteristics, referring and exit pages, pages and products viewed, dates and times of access, interactions with the Site, and information collected through cookies, pixels, tags, web beacons, local storage, and similar technologies.

We may collect Device and Usage Information using the following technologies:

Cookies and local storage, which store information on your browser or device, sometimes using a unique identifier.
Log files, which record activity on the Site and may include IP address, browser type, internet service provider, referring and exit pages, and timestamps.
Web beacons, tags, pixels, and similar technologies, which help record how visitors use the Site and interact with advertising or communications.
Session and device identifiers, which may include cart identifiers, randomly generated visitor identifiers, and, where permitted, limited browser or device fingerprinting signals.

Where permitted by applicable law and your privacy choices, we may combine limited device, browser, session, and network signals to distinguish one browser, device, or shopping session from another. We may use these identifiers to associate multiple custom photo uploads with the same browser, device, Shopify cart, or logged-in customer account. These identifiers are used for operating and organizing our custom-product workflow, fraud and abuse prevention, and service analytics. We do not use them for biometric identification.

Order and account information. When you make or attempt to make a purchase, create an account, or contact us, we may collect information such as your name, billing and shipping address, email address, telephone number, account information, order number, items purchased, customer service communications, and transaction details. Payment information is processed by Shopify and our payment providers. We generally do not receive your complete payment card details.

Custom photo and production information. When you use our custom photo cross-stitch service, we may collect and process:

the original photo or image that you upload;
generated cross-stitch previews, thumbnails, and downloadable preview files;
production patterns, stitch grids, thread-color mappings, color and usage data, and production PDF or JSON files;
the file name, file type, image dimensions, upload and processing timestamps, and technical processing information;
your selected size, fabric count, preview style, product variant, and quantity;
preview identifiers, cart and line-item references, order references, and token-protected preview links; and
information you provide to our customer service or production team in connection with the custom product.

Photos may contain personal information and may depict adults or children. You should upload a photo only if you have the right and permission to use it for creating the requested custom product. If a photo depicts a child, you confirm that you are the child's parent or legal guardian, or that you otherwise have appropriate authorization to upload and use the photo. We do not use uploaded photos for facial recognition, biometric identification, or to infer sensitive personal characteristics.

When we refer to "Personal Information" in this Privacy Policy, we mean Device and Usage Information, Order and Account Information, Custom Photo and Production Information, and any other information that identifies or can reasonably be linked to an individual, household, browser, device, or account.

2. How we use personal information

We may use Personal Information to:

provide, operate, maintain, troubleshoot, and improve the Services;
generate custom cross-stitch previews, thumbnails, stitch patterns, production files, and related product outputs;
display a custom preview in your cart and allow you to view the full preview through a token-protected link;
process payments, fulfill and ship orders, provide order confirmations, and support reprints or customer service requests;
associate related uploads with the same browser, device, cart, account, or order where permitted;
communicate with you about your order, account, custom image, or support request;
detect, investigate, and prevent fraud, abuse, security incidents, and technical problems;
measure and understand how the Site and our custom preview tools are used;
provide advertising or marketing communications in accordance with your choices and applicable law;
comply with legal obligations, enforce our agreements, and protect our rights and the rights of others; and
carry out other purposes disclosed to you when the information is collected or with your consent.

3. Custom preview links

A custom preview may be made available through a link containing a long, randomly generated access token. The link is intended for you, our production team, and persons with whom you choose to share it. It is not intended for public listing. However, anyone who obtains the complete link may be able to view the associated preview while the link and underlying record remain active. Do not post or share the link publicly unless you want others to view the preview. If you believe a preview link has been disclosed without authorization, contact us at info@fraynyc.com.

4. How we disclose personal information

We may disclose Personal Information to service providers and other parties that help us operate the Services, including:

Shopify, which powers our online store, shopping cart, checkout, customer accounts, and order processing. You can learn more in the Shopify Privacy Policy.
Cloudflare, whose Cloudflare Workers, D1, R2, networking, security, and content-delivery services are used to process requests, store preview metadata, and store and deliver original photos, thumbnails, previews, production patterns, and related files. You can learn more in the Cloudflare Privacy Policy.
Payment, fulfillment, production, shipping, and customer-support providers that need information to process an order or provide the requested custom product.
Analytics and advertising providers, such as Google and Meta, where enabled and permitted by your privacy choices and applicable law.
Professional advisers, authorities, and other parties when reasonably necessary to comply with law, respond to lawful requests, prevent harm or fraud, enforce our agreements, or protect our rights.
Parties to a business transaction in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to applicable law.

We do not sell Personal Information for money. Some analytics or advertising activities may be considered a "sale," "sharing," or targeted advertising under certain privacy laws. Where applicable, you may have the right to opt out as described below.

5. Cookies, analytics, advertising, and privacy choices

We use necessary technologies to operate the Site, cart, security controls, custom photo upload, and order workflow. Depending on your location and choices, we may also use preference, analytics, and marketing technologies. Where required, non-essential analytics, marketing, or device-recognition processing will be used only after the appropriate permission has been provided through Shopify's customer privacy controls or another consent mechanism.

You can manage available choices through the cookie or privacy controls displayed on the Site, through your browser settings, or by contacting us. Blocking necessary technologies may affect the operation of the cart, custom preview tool, login, or other requested features.

We may use Google Analytics to understand how visitors use the Site. You can learn more about Google's privacy practices at https://policies.google.com/privacy and about available Google Analytics controls at https://tools.google.com/dlpage/gaoptout.

Some browsers provide a "Do Not Track" setting. Because there is not a uniform industry standard for interpreting all Do Not Track signals, the Site may not respond to every such signal. Where required by applicable law and supported by our platform, we process legally recognized opt-out preference signals, such as Global Privacy Control, as requests to opt out of applicable sale, sharing, or targeted advertising activities.

6. Data retention and deletion

We retain Personal Information only for as long as reasonably necessary for the purposes described in this Policy, including providing previews, producing and fulfilling custom orders, supporting customers and reprints, maintaining business and tax records, resolving disputes, preventing fraud, enforcing agreements, and complying with legal obligations. Retention periods vary according to the type of information, whether an order was completed, operational needs, and legal requirements.

Incomplete or unused preview records may be deleted earlier than completed order records. Token-protected preview links may remain accessible while the associated preview record and files are retained. When we delete a preview record from our active production system, the associated original image, thumbnail, preview image, and production files are also deleted or scheduled for deletion from active Cloudflare storage, subject to limited backups, security records, and information that we must retain for legal or legitimate business purposes.

Order records may be retained for accounting, tax, fraud-prevention, warranty, dispute, and legal-compliance purposes even if related custom image files are deleted. You may request deletion of eligible Custom Photo and Production Information by contacting us. Deleting custom production files may prevent us from completing an order, providing a reprint, or supporting the custom product.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect Personal Information. These measures include access controls and token-protected preview links. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping preview links, account credentials, and order information confidential.

8. Your privacy rights

Depending on where you live and subject to applicable law, you may have rights to request access to, correction of, deletion of, or a copy of your Personal Information; to restrict or object to certain processing; to withdraw consent; to opt out of targeted advertising or the sale or sharing of Personal Information; and to appeal a decision concerning a privacy request. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

To exercise a privacy right, contact us at info@fraynyc.com. Please describe your request and provide enough information for us to identify the relevant account, order, preview, or upload. We may need to verify your identity and authority before completing a request. You may use an authorized agent where permitted by law. We may deny or limit a request where an exception applies and will explain our decision as required by law.

9. Children's privacy and photos depicting children

The Services are intended for adults and are not directed to children. We do not knowingly collect Personal Information directly from children through child-directed services. An adult may choose to upload a photo depicting a child for a custom product only when the adult has the legal right and appropriate permission to do so. If you believe a child's information or image was provided to us without appropriate authorization, contact us so that we can review and, where appropriate, delete it.

10. International data transfers

We and our service providers may process Personal Information in Hong Kong, the United States, Canada, and other countries where we or our service providers operate. These countries may have data-protection laws that differ from those in your country. Where required, we use appropriate safeguards for international transfers.

11. Third-party websites and services

The Site may contain links to websites, applications, or services operated by third parties. Their privacy practices are governed by their own policies, and we are not responsible for their content or privacy practices. We encourage you to review their privacy policies.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, Services, or legal obligations. We will post the updated version on this page and revise the "Last updated" date. Where required by law, we will provide additional notice or seek consent before a material change takes effect.

13. Contact us

For questions about this Privacy Policy, to exercise a privacy right, or to make a complaint, contact us at:

BuySun International Trading (HK) Co., Limited
FLAT/RM P 4/F, LLADRO CENTRE
72 HOI YUEN ROAD, KWUN TONG
HONG KONG
Email: info@fraynyc.com