Privacy Policy

1. Who this is from

Himalayan Bullion Company Limited. Contact: info@himalayanbullion.com.

2. What this covers

The HBC customer app and the HBC systems behind it.

3. When we collect information

When you use the app, when you buy from us, when you pay, when our staff serve you at our counter, and when you contact us.

4. What we collect

• - Your name, email address and telephone number.
• - Your addresses, where you give them.
• - Your PAN/VAT number, where you give it. This is a tax attribute we record. It is not an identity check.
• - Your membership number, which we issue and which is permanent.
• - Your sign-in details. Authentication is handled by our provider, Supabase. HBC staff cannot view your password.
• - A notification token for each device you allow notifications on, so we can send you notifications. We store it encrypted.
• - Your notification preferences, and a record that a message was sent to you.
• - A device sign-in key, if you turn on signing in with your device. This is a public key, along with device attestation information. Your fingerprint or face never leaves your device. HBC receives no biometric template and never receives your device's private key.
• - Your checkouts and orders.
• - Your payments and your credit balance and history.
• - For payments you make online: the payment reference, the amount, the date and time, and whether the payment succeeded. Our payment processor, Nepal Payment Solution, collects your card, bank or wallet details on its own page. HBC never receives them.
• - The short description we give each online payment, which shows your membership number and which payment it is, so that you and we can match it to your statement.
• - Your receipts and documents.
• - Your layaway, if you use it.
• - Your custody arrangements, if you leave products with us.
• - Handover records, when we physically hand a product to you.
• - Buyback records, if we buy a product back from you.
• - Identity documents you give our staff at our counter, where we collect them.
• - Business verification evidence, where we collect it for a business account.
• - A record of who did what — ours and our staff's — so actions are attributable, and security records.

We do not send you SMS.

5. Why we collect it

To sell you a product and complete your order; to run your account; to send you messages about things you have done, such as a confirmed payment, a transfer, a Buy-Back or the use of your HBC Credits; to send you news and offers from HBC, where section 17 allows it; to issue and keep the documents we owe you; to verify identity where a transaction or security operation needs it; and to keep an accurate, attributable record of what happened.

6. How we collect it

Through the app, through HBC Control when our staff serve you, and in person at our counter.

7. Who sees it

HBC staff see only what their role allows. Identity documents and sensitive review material are restricted to staff authorised to review them, and every access is logged.

8. How we protect it

Access is controlled per person and per role, enforced in our database and not only in the interface. Records that matter are append-only: they are added to, not edited. Identity documents are held privately, never behind a public link, and every retrieval is recorded and checked against the stored fingerprint of the file.

9. Who else processes it

• - Supabase — authentication and our database.
• - Vercel — hosting of our servers.
• - Resend — email, including the news and offers described in section 17.
• - Expo — delivery of push notifications to your device.
• - Apple Push Notification service — delivery of notifications to iPhones.
• - Google Firebase Cloud Messaging — delivery of notifications to Android phones.
• - Nepal Payment Solution (NPS) — processing of online payments.

We share your information with others only where you have consented, or where the law requires it of us.

10. How long we keep it

Some records — receipts and other documents we issued, the record of money and metal that moved, and the record of who did what — we keep because they are permanent records. The rest we delete when you delete your account. Section 12 lists exactly which is which.

We do not state a number of days or years here. We will not put a period in front of you that we have not confirmed.

11. Your consent

Consent to this policy is recorded separately from the policy itself, against the exact version and digest you were shown. You can withdraw it at any time, in the app. Withdrawing it does not delete your account or the records in section 12; if you want your account deleted, section 12 explains that.

12. Deleting your account

You can ask us to delete your account from inside the app, under More → Account → Delete my account, or from our public page if you no longer have the app.

We delete your HBC account and your access to it: your sign-in identity, your authentication access, your signed-in sessions, your device sign-in keys, your device notification tokens, your notification preferences, unfinished checkouts you never submitted, and the profile and platform details that can be deleted.

If you have bought from us or paid us, we keep some of your details — only where we are required to. That may include your name, your contact details, your address and your PAN, where we are required to keep them for anti-money-laundering, billing, tax or another legal obligation. Where we are not required to keep something, we delete it or make it anonymous.

We also keep the records themselves, where we are legally or operationally required to: receipts and documents we already issued; the record of money and metal that moved; payments; orders you completed; ownership records; which version of which document you agreed to, and its digest; the record of who did what; identity records collected at our counter; and your membership number, which is never reissued to anyone else.

What we keep is not kept available to you or to us in the ordinary way. Access to it is restricted, it is not used for marketing or ordinary platform purposes, and it is deleted or made anonymous once the obligation to keep it ends — unless we are lawfully required to keep it for something else.

Deleting your account never erases an ownership, custody, payment, invoice, acceptance or compliance record.

Deactivating an account is not deleting it, and we never present one as the other. Deactivation is a deliberate, reasoned status change that can be reversed. Deletion cannot.

13. Children

The app is general-audience commerce. It is not designed for children and we do not knowingly direct it at them.

14. Changes

We publish a new version when this changes. Every version stays available by version number and digest.

15. Contact

Himalayan Bullion Company Limited Wada No. 1, Gyaneshwor Kathmandu Metropolitan City, Nepal

Email info@himalayanbullion.com · Telephone +977 9700020999

Privacy questions, consent questions and deletion requests are handled by the HBC Team.

16. Our public bar verification page

Every HBC bar carries an engraved verification link. Anyone who scans it — you, a jeweller, a person you sell it to later — reaches a page that confirms the bar is a genuine HBC bar and describes the metal.

That page never shows who owns the bar. It carries no name, no membership number, no contact detail, no address, no price, no payment and no exact location. About custody it says only whether the bar is currently held in HBC custody or has been released from HBC custody, and nothing more precise than that.

It verifies the product, not the ownership. Scanning a bar tells you that HBC made and recorded it. It is not evidence that the person showing it owns it, and we never treat it as evidence of that.

HBC coins are different, and we say so plainly. A coin carries a batch number shared with every coin struck alongside it. Its individual reference is one we assign inside our own records — it is not stamped on the coin — and there is no public verification page for a coin.

Deleting your account does not change any of this, because none of it is about you: the bar record describes the bar.

17. Messages we send you

We send you notifications on your phone, and emails, about things you have done: a confirmed payment, an offer to transfer a product to you, a completed or declined transfer, a completed Buy-Back, a Buy-Back cheque ready to collect, and the use of your HBC Credits. A notification never shows an amount, so that a phone you no longer have does not show your figures.

We may also send you news and offers from HBC by email and on your phone.

• - Every news or offer email has an unsubscribe link. Using it stops those emails, but not the messages about things you have done.
• - You can turn phone notifications off at any time in the app, under More → Account → Notifications, or in your phone's settings.

We do not send you SMS, and we do not sell your information or share it for others' advertising.