Privacy Policy

This service is operated by AGGS TECHNOLOGY SERVICES CO., LIMITED ("the Company"), which is incorporated in the Hong Kong Special Administrative Region and acts as the data controller under this privacy policy.

The virtual credit card brand the Company operates, "RDVCC" ("we" or "the Platform"), is a virtual credit card platform for Chinese-speaking users, offering card opening, top up, spending records and management for Visa / Mastercard virtual cards. The Platform works with a licensed card issuer — an offshore entity holding the relevant cross-border payment licences — which actually issues and settles the virtual cards.

To run the service and meet compliance requirements, we collect only what is directly needed:

• Basic account information: email (required at sign-up) and a password hash; the mobile number is entered before your first card, not at sign-up;
• Cardholder details: legal name and 11-digit mainland-China mobile number (for card-eligibility decisions and risk control);
• Payment and card data: top-up orders, card limits and transaction detail, on-chain USDT top-up records;
• Usage logs: login IP and the approximate location inferred from it (country / region / city level), device information and operation records (for risk control, unusual-login alerts and dispute handling);
• Cookies / local storage: the session token that keeps you logged in, UI preferences and similar technical data.

We do not collect unnecessary device information (contacts, device GPS location, microphone and the like), and we integrate no third-party advertising SDK. The location referred to above is inferred solely from your network IP and is accurate only to city level; we neither request nor can obtain your device's precise location.

• Full card number and CVV are never stored: the database holds neither. When you view them on the card detail page, the system fetches them live from the upstream card issuer each time and returns them straight to your browser, with no local caching. All the database keeps long term is the last four digits, for list display and reconciliation;
• Field-level encryption: sensitive fields that require encrypted storage use the AES-256-GCM algorithm;
• Irreversible password hashing: passwords are stored as a one-way bcrypt hash (12 rounds), so we cannot recover yours;
• Transport encryption: all HTTPS traffic enforces TLS 1.2+ and HSTS;
• Least-privilege access: decryption keys are held separately and application code has no decryption rights by default;
• Access auditing: every administrator access to sensitive data is written to a tamper-proof audit log.

• Providing the service: opening cards, top up, transaction processing, account management;
• Card eligibility and anti-fraud: name plus mobile-number checks and risk-control rules (unusual IPs, abnormal changes in login location, brute force, cash-out patterns); when a card is issued we use the region you are in at that moment to match a billing address that satisfies the issuer's rules;
• Compliance disclosure: the Platform does not proactively send cardholder details to the upstream licensed card issuer; they are provided only when a specific dispute, investigation or compliance requirement arises, after the necessary redaction;
• Support disputes: relevant data is retrieved only when you open a ticket or support handles a dispute;
• Compliance audit: to meet the retention requirements that apply to cross-border payment services.

We never sell your information to third parties, nor use it for advertising unrelated to the service.

• Core account data: kept while the account exists; logically deleted and anonymised once the account is closed;
• KYC data: for the life of the account plus at least 5 years after the service ends (cross-border payment compliance requirement);
• Transaction and card records: 7 years after the service ends (standard international payment compliance requirement);
• Login and operation logs: 18 months;
• Support tickets: 2 years after the ticket is closed.

• Access: you can review every transaction, card record and KYC status in your account centre;
• Correction: cardholder details (name / mobile number) can be changed through support; your email can be changed on the profile page;
• Closure: you can ask to close your account; afterwards the account is frozen and cardholder details are retained as the law requires;
• Objection: if you object to your account data or how it is handled, raise it through support .

The following categories of third party receive the data they need, under strict authorisation. Following data minimisation, each receives only the fields required to do its job:

• Upstream licensed card issuer — receives card operation requests (open, top up, close) to actually issue and settle cards; cardholder details are provided, redacted and only as needed, when a dispute or compliance requirement arises;
• Payment and settlement providers — receive top-up order numbers, amounts and on-chain transaction information to confirm funds were received; they receive neither your account password nor sensitive card data;
• Email provider — receives your email address and message body, to send verification codes, notifications and announcements;
• Instant-messaging provider — receives the conversation content when you contact support over Telegram; not involved if you do not use that channel;
• Web analytics service — receives anonymous page-visit behaviour (no account identity), for traffic statistics and product improvement; you can refuse it through your browser settings or as described in the Cookie Policy;
• Infrastructure and security providers — supply servers, CDN, DDoS protection and WAF. To be explicit: all site traffic passes through CDN edge nodes, which terminate TLS, so technically they can see plaintext in transit; we rely on their contractual obligations and industry compliance certifications as the safeguard. The same CDN also supplies country / region / city-level geographic indicators derived from the visitor's IP; we use these solely for risk control and the purposes described above.

We do not integrate third-party ad networks, social plugins or any other channel that shares identity-level user data.

Web analytics: to keep improving the product we use Google Analytics 4 (GA4) to collect anonymous site-visit data (page views, time on page, device type, traffic source). This tool never receives your name, mobile number, email, card number or anything else that identifies you; your IP address is anonymised before it reaches Google (anonymize_ip=true); and page paths containing a specific card ID or ticket ID are replaced with a placeholder before being reported (for example /account/cards/[id]). The admin area (/admin/*) is outside GA tracking entirely.

• Session cookies: keep you logged in (`rdvcc_session` on the user side / `rdvcc_admin_session` on the admin side), HttpOnly + Secure with a strict SameSite policy;
• Attribution cookie: `rdvcc_attr` records only which channel brought you here (UTM parameters / referring domain), for internal product work; valid 30 days, containing no identity information;
• Visit-analytics cookie: `rdvcc_tid` is an anonymous random visitor identifier used to count daily visits and sign-up conversion; HttpOnly + Secure, valid 400 days; the records stay on our own servers and are shared with no third party, with page-level detail retained for at most 180 days;
• Analytics cookies (Google Analytics): `_ga` / `_ga_*` are written automatically by GA4 to distinguish unique visitors, with a default lifetime of 13 months. You can disable them through your browser privacy settings or by installing the Google Analytics opt-out add-on;
• No advertising-tracking cookies: RDVCC deploys no ad-retargeting or cross-site tracking cookies;
• Local storage: used only for UI preferences (such as collapsed state); no sensitive data.

RDVCC applies layered encryption to sensitive user data:

• Card number / CVV: the full card number and CVV are not stored in the RDVCC database and are not cached locally — they are fetched live from the upstream card issuer each time you view them. All the database keeps long term is the last four digits.
• Data at rest: sensitive fields that require encrypted storage use AES-256-GCM field-level encryption, with keys rotated on an "event-triggered plus annual" schedule. Cardholder details (name, mobile number) are stored in clear text, but under strict access minimisation and audit logging.
• Passwords: bcrypt hash (12 rounds), irreversible — we cannot recover your original password.
• In transit: HTTPS site-wide, TLS 1.2 or above enforced. CDN edge nodes provide DDoS protection and WAF (that hop terminates TLS — see section 7).
• Backups: database backups are encrypted too, stored off-site, retained 5 years.

Under Article 45 of China's Personal Information Protection Law you may ask RDVCC for a copy of all your personal data. This is currently handled manually through a ticket:

• log in → support ticket → submit a "data export request", saying which data you need (account information / transaction records / card records);
• we verify your identity and then deliver JSON / CSV data as an encrypted attachment to your registered email within 15 business days;
• the export covers account information, transaction history, cardholder details (redacted) and login records;
• exports are free, up to 4 times a year.

A self-service export is in development; this section will be updated when it ships. If you have questions about the export format, contact [email protected].

If this policy changes materially, we notify you by in-app notice and email at least 7 days before the change takes effect. Continuing to use the service counts as acceptance of the new policy.

For any question about this policy or your data, reach us at:

• Email: [email protected]
• Support: /contact