Privacy

Last updated: October 15, 2026

This notice explains how information is handled when you browse the Hima Shilajatun^® brand catalog or contact us. You can browse products without creating an account. This website offers optional customer accounts. It does not accept orders or process payments.

Information used to deliver the website

Our hosting and security services may process technical information such as your IP address, browser details, requested pages, request times, and security events to deliver pages, prevent abuse, and diagnose problems. The site is hosted on a Tencent Cloud server in Hong Kong. Cloudflare provides domain name services. Essential cookies are used for account sign-in and shopping carts.

We have not added advertising pixels, behavioral advertising, visitor analytics scripts, or a newsletter signup to this catalog. The website fonts are served from this site's own address; loading them does not require a request to Google Fonts.

Product images and external services

Product photographs, brand illustrations, and fonts are served through this website’s hosting service. Product images must be uploaded to this website; external image links are not accepted.

The hosting, domain and email providers also handle information under their own privacy policies. External links are subject to the relevant provider's practices.

Your shopping cart

When you use the cart, an essential HttpOnly cookie identifies a cart stored by our hosting service. The cart contains product identifiers and quantities, with creation and expiry times; it does not contain a delivery address or payment details. The cookie and cart access expire after 30 days. Expired cart records are removed during subsequent cart activity. You can remove items from your cart at any time. Clearing or blocking the cookie prevents access to that saved cart. Cart items and prices are not reserved, and no order or payment is created.

Your customer account

To create an account, you provide your name, email address and phone number with its international country code, verify ownership of that email, and choose a password. We store your profile and a salted password hash, never the password itself. Your account is separate from other brands and from brand management. Phone numbers are provided by you and are not verified by SMS. We use them as contact details, not as proof of identity or a sign-in factor. You can edit your name and phone number, change your password, or sign out in My account. Contact us for an email change or deletion request.

An essential HttpOnly cookie keeps you signed in for up to seven days. We store a digest of the session token, its expiry and a security token. Changing or resetting your password invalidates existing sessions. Signing out ends the current session. Registration uses a one-time email code with a 10-minute window, up to three sends and five verification attempts. It is bound to the browser that requested it. We temporarily store the email, a keyed code digest, a browser-token digest, expiry and attempt counts. Resending replaces the old code without extending the active window. Password-reset links expire after 20 minutes and can be used once. Request counters, including hashed email and available IP identifiers, limit abuse and are cleared during later account activity after 24 hours. Expired session, registration-code and link records are cleared during later account activity. Account profiles remain until you request deletion, subject to applicable obligations.

When email service is enabled, Resend processes the recipient address and account email content to deliver verification and password reset messages. These messages are transactional, not marketing subscriptions. For its practices, see the Resend Privacy Policy. Account information is stored using this website’s hosting services and is not published in the product catalog. No delivery address or payment card information is collected by these account forms.

When you contact us

The contact link opens your email application. If you choose to email Himashilajatun@163.com, the brand receives your email address, message, and any details or attachments you send through its 163.com email service. These are used to respond to your inquiry and any related follow-up. Please do not send payment card details, passwords, or identity documents.

Email correspondence is handled in the brand's email service, rather than a contact-form database on this website. If you have questions about a message you have sent, or want to request access, correction, or deletion, contact the same address.

Protected brand management

Only the authorized administrator can manage the catalog. The management area requires its own administrator username and password. We store the username, an internal owner identifier and a salted password hash, rather than the password itself. The internal identifier preserves account and operation-history continuity after migration from our previous hosting service. Session records and necessary, HttpOnly authentication cookies keep the administrator signed in; sessions expire after 30 minutes of inactivity or 8 hours at most. Attempt counters based on a hashed IP identifier and a site-wide limit help prevent repeated login attempts. Public product pages do not display these authentication records.

Uploaded product information and images are stored by our hosting services. A product marked as a draft is excluded from the public catalog. A picture uploaded to this website is publicly served only while a published product uses it; the administrator can preview other uploaded pictures after signing in. A picture shared with another published product remains public. External image providers and copies previously cached, downloaded, or shared are outside this access control.

Customer administration

Authorized brand administrators can view and correct customer contact details, add internal notes, and suspend or reactivate accounts. We keep the administrator, time, reason and changed values in an operation history for accountability. These records are not public. Suspension revokes existing sign-ins and blocks sign-in and password recovery until reactivation. If an administrator changes your email, you must verify access to the new address through the password-reset process before signing in.

Retention and your choices

Product records and uploaded images remain in the catalog's storage for management; changing a product to a draft does not delete its stored information. Email correspondence, authentication information, and technical logs are held in the services that process them, under their applicable settings, policies, and obligations. This notice does not promise a single retention period for all of those services.

For information handled by the brand, send privacy questions or requests to Himashilajatun@163.com. Please identify the information or correspondence concerned. Requests will be assessed under applicable law, including any identity verification or recordkeeping requirements. The available rights depend on your location and the circumstances. Requests concerning a provider's own account or data practices may need to be addressed to that provider.

You can control cookies and external content through your browser settings, although blocking required security or sign-in technologies may prevent the management area from working. Service providers may process information in countries other than the one where you live; their policies describe the relevant arrangements.

Changes to this notice

Updates to this notice will be posted here with a revised date. Contact Himashilajatun@163.com with questions about the brand's use of information.