How information may be handled when someone visits ONCEFORMED, checks out through PayPal, receives an exact piece, or asks for support.
Pre-launch legal draft. Operator identity, contact details, jurisdiction-specific notices, and final counsel review remain outstanding.
Pre-launch legal draft
Updated September 7, 2026
This Privacy Policy is a working draft, not the final live-commerce version.
Before orders open, ONCEFORMED must insert the operating legal entity, business address, privacy and support contact, governing law, dispute forum, final tax and duty allocation, and any jurisdiction-specific consumer notices. U.S. counsel should review the completed text before it becomes effective.
01
Data should be collected because the site, payment, fulfillment, security, or a requested conversation needs it—not because a permanent profile is useful by default.
When the published site is visited, its hosting and analytics systems may process technical and usage information such as IP address, browser and device type, referring page, pages viewed, interactions, approximate location derived from network information, timestamps, and security logs.
When PayPal checkout is used, ONCEFORMED stores the PayPal order and capture identifiers, the Stone Record and product identifiers, amount, currency, payment status, payer email, shipping details returned by PayPal, and order timestamps. Reservation records also connect a temporarily held piece with a checkout identifier and expiration time.
If a visitor later contacts ONCEFORMED through an announced support channel, the message, contact details, attachments or images voluntarily supplied, and the response history may be retained to answer the request, support an order, or document a return or dispute.
02
Information may be used to display and secure the site, maintain availability, reserve an exact piece during checkout, confirm payment, prevent duplicate sales, prepare a Stone Record, fulfill and track an order, process an authorized return or refund, and preserve the object’s status history.
Information may also be used to answer requests, investigate fraud or misuse, protect purchasers and the business, maintain transaction records, enforce site terms, comply with legal obligations, and establish or defend legal claims.
Aggregated or limited analytics may be used to understand site traffic, page use, campaign attribution, and technical performance. ONCEFORMED should avoid using analytics data to make unsupported claims about demand or scarcity.
03
Payment approval and capture are processed by PayPal under PayPal’s own terms and privacy practices. ONCEFORMED does not receive or store a purchaser’s full card number or PayPal password. It does receive the transaction identifiers, status, payer email, shipping details, and payment amount needed to complete and document the order.
Information may be shared only as reasonably needed with site hosting and database providers, analytics and security services, PayPal, couriers and shipment-protection providers, professional advisers, and service providers supporting fulfillment or customer care.
04
Order, payment-status, fulfillment, return, and accounting records may be kept for the period reasonably needed to complete the transaction, meet legal and tax obligations, resolve disputes, prevent duplicate sale of a one-of-one piece, and preserve the object’s non-private Archive history. Other information should be deleted or de-identified when it is no longer needed.
Reasonable technical and organizational measures should be used to protect stored information and restrict access. No website, transmission, or storage system can be guaranteed completely secure.
Depending on where a visitor lives, they may have rights to request access, correction, deletion, restriction, portability, or information about disclosures, and to appeal or complain to a regulator. Identity may need to be verified before a request is completed. Privacy requests can begin through the Contact & Support form; a dedicated public privacy email must still be added before live orders open.
The site and products are not directed to children under 13, and ONCEFORMED does not knowingly seek personal information from them. If such information is identified, it should be deleted as required by law.
05
ONCEFORMED operates from China and plans to serve supported North American destinations. Information may therefore be processed in countries whose privacy laws differ from those where a visitor lives, including through international payment, hosting, and shipping providers. Appropriate protections should be confirmed for the final operating structure before launch.
The site and its providers may use essential browser storage or similar technology for security, functionality, checkout, and measurement. The live version should describe the technologies actually enabled and provide any consent or opt-out controls required for the visitor’s location.
The effective policy may be updated when services, legal requirements, or operating practices change. Material changes should be identified by an updated date and, where required, additional notice.