Data Retention Policy
Last updated August 2026
1. Introduction
This Data Retention Policy explains how long Hipopick retains information collected through our Service.
Hipopick is part of the Hipobuy service ecosystem. Because Hipopick supports account, cart, order, checkout, fulfillment, logistics, returns, refunds, and after-sales flows through Hipobuy infrastructure, some information may be retained by Hipopick, Hipobuy, Hipobuy affiliated operating entities, and relevant service providers.
This policy should be read together with our Privacy Policy.
2. Retention Principles
We retain information only for as long as reasonably necessary to:
- Provide Hipopick and Hipobuy-supported services
- Maintain accounts, preferences, carts, orders, checkout flows, and after-sales records
- Complete transactions, payment status handling, refunds, returns, compensation, and logistics claims
- Comply with tax, accounting, customs, payment, anti-fraud, consumer protection, and legal obligations
- Resolve disputes, enforce agreements, investigate abuse, and protect safety and security
- Improve product discovery, recommendations, analytics, advertising measurement, and service performance
When information is no longer needed, we delete, anonymize, aggregate, or otherwise handle it according to applicable law and operational requirements.
Retention Schedule
The following periods apply to data held in Hipopick-controlled systems. If applicable law requires a longer period, that law takes priority.
- Account, profile, preferences, saved carts, and non-transactional addresses: while the account is active; deleted or anonymized within 30 days after a verified deletion request is submitted.
- Completed orders, payments, refunds, invoices, delivery, customs, and transaction-related addresses: 7 years from the end of the calendar year in which the relevant transaction is completed.
- After-sales requests, customer-support communications, and dispute evidence not already retained with a transaction: 3 years after the request or dispute is closed. If the record is part of a retained transaction record, the 7-year period applies.
- Account-linked analytics, advertising, and attribution data: deleted or anonymized within 30 days after a verified deletion request is submitted. Non-account-linked event data is retained for up to 24 months; anonymized aggregate reports may be retained longer.
- Authentication, security, device, and fraud-prevention logs: 12 months. Records needed for an active investigation or legal claim are retained until the matter is closed, then for 3 years.
- Backup copies: up to 90 days after deletion, until the backup cycle securely overwrites or deletes them. Access is restricted during this period.
- Deletion-request audit record: 3 years after completion, limited to information needed to demonstrate and administer the request.
We aim to acknowledge your request and close your account within 30 days. The 30-day deletion and anonymization periods in this schedule begin when a verified deletion request is submitted. If we must retain a record, we will limit its use to the retention purpose described in this policy.
3. Account and Profile Data
Account information such as name, nickname, username, email address, authentication identifiers, preferences, language, currency, country, referral information, and account settings may be retained while your account remains active.
If you submit a verified deletion request, we delete or anonymize account information within 30 days, except for the limited records listed in the Retention Schedule.
4. Order, Checkout, and Payment Records
Order-related information may include cart item identifiers, product and SKU information, quantities, prices, coupons, addresses, order numbers, pre-order numbers, payment amount, payment channel, payment time, payment status, refund status, fulfillment status, and related customer service records.
We retain order, payment, refund, and transaction records for 7 years from the end of the calendar year in which the relevant transaction is completed, unless applicable law requires a longer period.
Payment providers and Hipobuy payment systems may have their own retention periods.
5. Shipping, Customs, and Logistics Data
Shipping and logistics information may include recipient name, phone number, address, postal code, country or region, package information, goods information, waybill information, customs declaration data, delivery status, route information, carrier records, and claims materials.
This information is retained for 7 years from the end of the calendar year in which the relevant transaction is completed, unless applicable law requires a longer period.
Where customs authorities, carriers, or logistics providers require longer retention, those third parties may retain information under their own rules.
6. Returns, Refunds, and After-Sales Records
After-sales records may include return requests, refund requests, product issue descriptions, photos, package evidence, proof of payment, proof of delivery, customer service messages, dispute records, seller responses, compensation records, and claim outcomes.
We retain this information for 3 years after the request or dispute is closed. If it forms part of a retained transaction record, the 7-year period applies.
7. Analytics, Advertising, and Attribution Data
Analytics and event data may include page views, screen views, clicks, search terms, product views, add-to-cart events, checkout initiation, purchase-related events, session duration, device information, app performance, and error logs.
Advertising and attribution data may include campaign parameters, click IDs, internal identifiers such as scan_id, and advertising platform events.
Account-linked data is deleted or anonymized within 30 days after a verified deletion request is submitted. Non-account-linked event data is retained for up to 24 months. Aggregated or anonymized reports may be retained longer for business analysis and product improvement.
8. Security and Operational Logs
Security and operational logs may include IP addresses, device information, request logs, fraud indicators, authentication events, payment-risk events, system diagnostics, and error records.
These logs are retained for 12 months. Records needed for an active investigation or legal claim are retained until the matter is closed, then for 3 years.
9. Cookies and Local Storage
Cookies, local storage, SDK storage, and similar identifiers may be retained until they expire, are replaced, or are deleted by you through browser, device, or app settings.
For more details, see our Cookie Policy.
10. Backup and Archive Systems
Deleted information may remain in backups or archive systems for up to 90 days, until those backups are overwritten or securely deleted. During that period, access is restricted and the information is not used for ordinary business purposes.
11. Your Deletion Requests
You may request deletion of your personal information by contacting support@hipopick.com. We aim to acknowledge your request and close your account within 30 days after a verified deletion request is submitted.
We may be unable to delete certain information immediately if retention is required for active orders, payments, refunds, returns, shipping, customs, tax, accounting, fraud prevention, dispute resolution, or legal compliance.
12. Changes to This Policy
We may update this Data Retention Policy from time to time. Updates will be posted on this page with an updated "Last updated" date.