Privacy Policy

This service is operated by AGGS TECHNOLOGY SERVICES CO., LIMITED ("the Company"), which is incorporated in the Hong Kong Special Administrative Region and acts as the data controller under this privacy policy.

The virtual credit card brand the Company operates, "RDVCC" ("we" or "the Platform"), is a virtual credit card platform for Chinese-speaking users, offering card opening, top up, spending records and management for Visa / Mastercard virtual cards. The Platform works with licensed card issuers, which actually issue and settle the virtual cards.

To run the service and meet compliance requirements, we collect only what is directly needed:

• Basic account data: email (required at sign-up) and password hash; no phone number or ID document is needed at registration;
• Identity verification data: document type and number, name, date of birth, nationality, expiry date, the address on the document, plus photos of the front and back of the document and a face photo. Collected once before your first card, performed by a third-party verification provider — see the KYC Policy;
• Payment and card data: top-up orders, card limits and transaction detail, on-chain USDT top-up records;
• Usage logs: login IP and the approximate location inferred from it (country / region / city level), device information and operation records (for risk control, unusual-login alerts and dispute handling);
• Cookies / local storage: the session token that keeps you logged in, UI preferences and similar technical data.

We do not collect unnecessary device information (contacts, device GPS location, microphone and the like), and we integrate no third-party advertising SDK. The location referred to above is inferred solely from your network IP and is accurate only to city level; we neither request nor can obtain your device's precise location.

• Full card number and CVV are never stored: the database holds neither. When you view them on the card detail page, the system fetches them live from the upstream card issuer each time and returns them straight to your browser, with no local caching. All the database keeps long term is the last four digits, for list display and reconciliation;
• Field-level encryption: sensitive fields that require encrypted storage use the AES-256-GCM algorithm;
• Irreversible password hashing: passwords are stored as a one-way bcrypt hash (12 rounds), so we cannot recover yours;
• Transport encryption: all HTTPS traffic enforces TLS 1.2+ and HSTS;
• Least-privilege access: decryption keys are held separately and application code has no decryption rights by default;
• Access auditing: every administrator access to sensitive data is written to a tamper-proof audit log.

• Providing the service: opening cards, top up, transaction processing, account management;
• Card eligibility and anti-fraud: in-person document verification plus risk-control rules (the same document across multiple accounts, unusual IPs, abnormal changes in login location, brute force, cash-out patterns); when a card is issued we use the region you are in at that moment to match a billing address that satisfies the issuer's rules;
• Card issuance and compliance reporting: when a card is opened, cardholder identity data (name, document details, etc.) is provided to the upstream licensed card issuer as its compliance rules require, for issuing the card and compliance review; it is not shared with any other third party;
• Support disputes: relevant data is retrieved only when you open a ticket or support handles a dispute;
• Compliance audit: to meet the retention requirements that apply to cross-border payment services.

We never sell your information to third parties, nor use it for advertising unrelated to the service.

• Core account data: kept while the account exists; logically deleted and anonymised once the account is closed;
• Identity verification data (including document and face images): for the life of the account plus at least 5 years after the service ends (cross-border payment compliance requirement);
• Transaction and card records: 7 years after the service ends (standard international payment compliance requirement);
• Login and operation logs: 18 months;
• Support tickets: 2 years after the ticket is closed.

• Right of access: you can view all transaction details, card data, your identity verification status and verification time in your account area;
• Right to correction: if your document details change (name change, new document, etc.), contact support to verify again; your email can be changed on the profile page;
• Right to close: you can request account closure; the account is then frozen and identity verification data is retained as the law requires;
• Objection: if you object to your account data or how it is handled, raise it through support .

The following categories of third party receive the data they need, under strict authorisation. Following data minimisation, each receives only the fields required to do its job:

• Upstream licensed card issuer — receives card operation requests (open, top up, close) to actually issue and settle cards; when a card is opened it also receives cardholder identity data (name, document details, etc.) as its compliance rules require, for issuing the card and compliance review;
• Payment and settlement providers — receive top-up order numbers, amounts and on-chain transaction information to confirm funds were received; they receive neither your account password nor sensitive card data;
• Email provider — receives your email address and message body, to send verification codes, notifications and announcements;
• Instant-messaging provider — receives the conversation content when you contact support over Telegram; not involved if you do not use that channel;
• Web analytics service — receives anonymous page-visit behaviour (no account identity), for traffic statistics and product improvement; you can refuse it through your browser settings or as described in the Cookie Policy;
• Infrastructure and security providers — supply servers, CDN, DDoS protection and WAF. To be explicit: all site traffic passes through CDN edge nodes, which terminate TLS, so technically they can see plaintext in transit; we rely on their contractual obligations and industry compliance certifications as the safeguard. The same CDN also supplies country / region / city-level geographic indicators derived from the visitor's IP; we use these solely for risk control and the purposes described above.
• Identity verification provider (currently Didit) — receives the document and face images you capture during verification, performs the checks and returns the result and extracted document data to us; bound by its privacy policy and our contract;

We do not integrate third-party ad networks, social plugins or any other channel that shares identity-level user data.

Web analytics: to keep improving the product we use Google Analytics 4 (GA4) to collect anonymous site-visit data (page views, time on page, device type, traffic source). This tool never receives your name, mobile number, email, card number or anything else that identifies you; your IP address is anonymised before it reaches Google (anonymize_ip=true); and page paths containing a specific card ID or ticket ID are replaced with a placeholder before being reported (for example /account/cards/[id]). The admin area (/admin/*) is outside GA tracking entirely.

• Session cookies: keep you logged in (`rdvcc_session` on the user side / `rdvcc_admin_session` on the admin side), HttpOnly + Secure with a strict SameSite policy;
• Attribution cookie: `rdvcc_attr` records only which channel brought you here (UTM parameters / referring domain), for internal product work; valid 30 days, containing no identity information;
• Visit-analytics cookie: `rdvcc_tid` is an anonymous random visitor identifier used to count daily visits and sign-up conversion; HttpOnly + Secure, valid 400 days; the records stay on our own servers and are shared with no third party, with page-level detail retained for at most 180 days;
• Analytics cookies (Google Analytics): `_ga` / `_ga_*` are written automatically by GA4 to distinguish unique visitors, with a default lifetime of 13 months. You can disable them through your browser privacy settings or by installing the Google Analytics opt-out add-on;
• No advertising-tracking cookies: RDVCC deploys no ad-retargeting or cross-site tracking cookies;
• Local storage: used only for UI preferences (such as collapsed state); no sensitive data.

RDVCC applies layered encryption to sensitive user data:

• Card number / CVV: the full card number and CVV are not stored in the RDVCC database and are not cached locally — they are fetched live from the upstream card issuer each time you view them. All the database keeps long term is the last four digits.
• Data at rest: sensitive fields that must be stored encrypted use AES-256-GCM field-level encryption, with keys rotated on trigger events and annually. Document numbers and full addresses are stored encrypted; document and face images are kept in private storage with an off-site backup, and viewing them requires an administrator's one-time code and is written to the audit log.
• Passwords: bcrypt hash (12 rounds), irreversible — we cannot recover your original password.
• In transit: HTTPS site-wide, TLS 1.2 or above enforced. CDN edge nodes provide DDoS protection and WAF (that hop terminates TLS — see section 7).
• Backups: database backups are encrypted too, stored off-site, retained 5 years.

Under section 18 of Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) you may ask RDVCC for a copy of all your personal data. This is currently handled manually through a ticket:

• log in → support ticket → submit a "data export request", saying which data you need (account information / transaction records / card records);
• we verify your identity and then deliver JSON / CSV data as an encrypted attachment to your registered email within 15 business days;
• the export covers account information, transaction history, cardholder details (redacted) and login records;
• exports are free, up to 4 times a year.

A self-service export is in development; this section will be updated when it ships. If you have questions about the export format, contact [email protected].

If this policy changes materially, we notify you by in-app notice and email at least 7 days before the change takes effect. Continuing to use the service counts as acceptance of the new policy.

For any question about this policy or your data, reach us at:

• Email: [email protected]
• Support: /contact