Privacy Policy

真的好菜 (the "Shop", OMGreens) takes your personal data seriously. In line with Article 8 of Taiwan's Personal Data Protection Act (the "PDPA"), we give you the notice below. By placing an order, creating an account or otherwise using this website, you confirm that you have read this policy.

Purposes and categories of data

Purposes: processing orders and payments, arranging cold-chain delivery, contacting you about orders, order lookup, member account management, customer service and after-sales handling, preventing fraud and keeping the site secure, and improving the site (anonymous statistics). We send promotional messages only with your separate consent.

Categories of data we collect:

• Identity and contact data: name, mobile number, email address, and a username (optional).
• Recipient address book: recipient names, phone numbers, delivery addresses and notes that a member chooses to save, plus the delivery address and order note on each order.
• Account security data: a hashed password (we cannot recover your actual password) and hashed login-session tokens. If you sign in with Google, Facebook or LINE (once available), we receive the name, email and avatar you authorize; we do not store third-party access tokens and never see your password on those platforms.
• Transaction data: order contents, amounts, payment method category, order status and order history. Your card number is entered only on the ECPay payment page; we never receive or store it.
• Technical and connection logs: ordinary server connection logs; your IP address is used only as a one-way hash, temporarily, for rate limiting and abuse prevention when you order or sign in, and is not written to the statistics data; the cart contents kept in your browser (localStorage); and anonymous statistics (see "Cookies and anonymous statistics").

Recipients of data and overseas processing

Apart from the parties below and where the law requires, we do not sell your data or give it to other third parties:

• Payments: ECPay (Green World FinTech). It processes credit card, ATM transfer and convenience-store payments. ECPay receives your name, mobile number and email address, together with the order number and amount, and handles payment data under its own privacy policy.
• Delivery carrier: to deliver your order, the recipient name, phone number, delivery address and order note are given to the cold-chain courier that actually carries the parcel.
• Hosting and security: Cloudflare. The website, database, bot check (Turnstile) and traffic statistics (Cloudflare Web Analytics) run on Cloudflare. When you place an order or sign up, Turnstile receives the browser and connection information it needs to tell humans from bots.
• Email delivery provider: to send order confirmations, payment instructions, shipping notices and sign-in emails, your email address and the message content are handled by our email delivery service provider.
• Authorities, courts or other parties where required by law.

Overseas processing: Cloudflare and our email delivery provider may process or store data outside Taiwan. We provide only the minimum data needed to deliver the service.

Period, area and method of use

• Period: for as long as the purposes above exist and for the periods required by law (tax, accounting and commercial records). Once the period ends, or you ask for deletion and no legal retention duty applies, we delete or anonymize the data within a reasonable time. Individual anonymous-statistics events are kept for only 7 days.
• Area: Taiwan, and the locations where the service providers above process data.
• Method: stored electronically and processed by automated systems or by staff as needed for the purposes above.

Whether providing data is voluntary, and what happens if you do not

Providing personal data is voluntary. However, an order requires your name, mobile number, email address and delivery address; without accurate details we cannot form the order, contact you or deliver. Creating a member account is not required to order: you can check out and look up orders as a guest. If the bot check cannot be completed, you may be unable to submit an order or sign up.

Customer profile, marketing consent and retention

To serve you better and plan stock, we use the order and account data you have already given us to work out an internal "customer profile". Only our administrators can see it:

• What it contains: number of orders, total and average spend, first and latest order dates, your rough reorder interval, the varieties you buy most, whether orders go to someone other than you (recipient compared with you), the county you ship to most, the category of source you first arrived from (for example search or social), the kinds of sign-in you have linked (only names such as LINE, Google, Facebook, Email and password, never the other platform's user ID), whether your phone and email are verified, and the birthday month if you chose to give it. Based on your latest order date we then group customers as new, returning or dormant.
• How: the profile is calculated on the spot from existing order data when an administrator opens it. We do not keep a separate stored copy, we do not obtain extra data from outside, and we do not make automated decisions. We do not request sensitive permissions such as birthday or gender from social platforms. Visitors without an account are matched only by the phone number on their orders.
• Access log: every time an administrator opens a profile that shows the full phone number and email, an entry is written to the audit log (who, when and which customer, never the personal data itself).
• Birthday month: optional. We store the month only, not the year or day. You can change or clear it in your account at any time. We may later use it for a small gift in your birthday month.
• Marketing consent: promotions and news are sent only through channels you have clearly ticked in your account (email and LINE are separate), and both are off by default. We record when you ticked or unticked. You can withdraw at any time and we then stop sending marketing messages. People who have not agreed are not put on any marketing list. Order confirmations, payment and shipping notices are not marketing and are not affected.
• Retention: the profile exists only as long as the order and account data it is calculated from, so the retention periods are the same as above. Your birthday month and consent records are deleted when your member account is deleted.

Your rights and how to exercise them

Under Article 3 of the PDPA you may ask us to let you inquire about or review your personal data, provide a copy, supplement or correct it, stop collecting, processing or using it, or delete it. Members can also view and edit their own details and address book on the account page.

Please make a request through the contact details below and include your order number or registered email so we can verify your identity. We will reply within 15 days of receiving the request, and may extend by up to 15 days with notice of the reason. Data we must keep for business operations or legal reasons may not be deletable right away; we will explain if so.

Cookies and anonymous statistics

We count site usage anonymously for one purpose only: to learn which pages are viewed, where checkout gets stuck and what breaks, so the site can work better.

• Cookies we use: two first-party cookies of our own, used only on this website, valid for 180 days. og_vid is a random code that tells whether the same browser returns; our database keeps only a one-way hash of it. og_ft records the category of source of your first visit (for example search, social, direct), a campaign code and the first page viewed; when you order, these source labels are stored on the order to show which channels bring orders. It does not store og_vid.
• What is recorded: which page you viewed, phone or computer, language, the category of source, which product you viewed, whether you added to cart or opened checkout, which field failed validation (field name and error type only), site or server errors, and payment success confirmed by the server (payment method category only).
• What is not recorded: text you type in any field, your name, email, phone, address, order number, exact amounts, full URLs or browser version strings; we also do no device fingerprinting. Statistics are never used to identify you or for sign-in or authorization.
• Retention: daily aggregate figures (containing no individual data) are kept long term; individual step and error details are kept for 7 days and then deleted automatically.
• Traffic and speed statistics (Cloudflare Web Analytics): public pages also use Cloudflare Web Analytics for aggregate page views, sources, devices and page speed. It uses no cookies, does no cross-site tracking and builds no personal profiles. It is not loaded on account pages, the back office or payment pages. This service is run by Cloudflare and we cannot apply a "Do Not Track" setting to it; if you do not want to be counted, block Cloudflare's analytics script (beacon.min.js) in your browser settings or with a content blocker. The site works the same when it is blocked.
• Sharing: our own statistics are stored by us and are not given to advertisers or any third party, and are not used for cross-site tracking.
• How to opt out: if your browser sends "Do Not Track" or "Global Privacy Control", we do not set the cookies above and do not run our own statistics. You can also uncheck "Allow anonymous analytics" under "Analytics settings" at the bottom of every page: we stop counting immediately, clear the two cookies, and remember your choice with a cookie named og_cnt (valid one year, containing only a "do not count" marker); check the box again to turn statistics back on. You may also block or delete these cookies in your browser; every function of the site, including shopping and checkout, keeps working.

This website uses no advertising or tracking cookies. Your cart contents live in your browser's localStorage and are not sent to the statistics system. If we add other analytics tools later, we will update this page first.

Data security

The site uses encrypted connections (HTTPS) throughout, stores only hashes of passwords, and lets only the people who handle orders see personal data. No method of network transmission or electronic storage is completely secure; if an incident that may affect you occurs, we will notify you as the law requires.

Changes to this policy

If we revise this policy, we will post the new version on this page and update the date; significant changes will be highlighted on the site. Please also read our Terms of Service and Returns policy before you buy.

This page is also available in Traditional Chinese, Japanese and Korean. The Traditional Chinese version prevails; if the translations differ or are unclear, the Traditional Chinese version governs.

Shop lettuce