Who is responsible for your data
HerbHou is operated by KOKOSHUNGSAN Ltd, which acts as data controller for the HerbHou service. For privacy questions or rights requests, contact support@kokoshungsan.co.uk. Available rights and handling procedures depend on applicable law.
Data we process
- Registration data: email address, hashed password and account role.
- Security data: web sessions, CSRF protection data, and hashed revocable mobile-session tokens with a device label and usage times.
- Business data: applications, authorised public profiles, membership roles, directory content, verification summaries and review status.
- Platform activity: saved content, enquiries, RFQs and quotes, research or education collaboration submissions, and necessary security and operational audit records.
- We do not ask you to submit medical records, diagnoses or other sensitive health data. Do not enter such data in platform forms.
Why we use it
We use data to provide sign-in and the shared-account experience, review and publish authorised content, support legitimate industry enquiries and collaboration, secure the platform, handle support and deletion requests, and meet applicable legal obligations.
Publication and sharing
Only authorised and reviewed business or content information is made public. HerbHou does not sell personal data and does not use advertising SDKs. 20i provides website and database hosting; Google Play and Apple may distribute the mobile apps. If you follow an external-resource link, that site processes data under its own policy.
Retention, deletion and security
Data is kept only for as long as reasonably necessary to provide these functions, maintain security, resolve disputes or meet applicable legal obligations. We do not claim an unverified fixed retention period. Passwords are stored as hashes, mobile tokens are stored server-side only as hashes, and the service uses HTTPS, access controls, CSRF protection and revocable sessions. No internet system can guarantee absolute security.
You can submit a verified request through the account deletion page. Shared business records, transactional or security records, and information subject to legal obligations may first need to be separated, anonymised or reduced to the minimum necessary.
Your choices and rights
You may request access, correction or deletion of account data, or ask how it is handled. Use the deletion workflow or contact the email above. We may verify your identity to avoid disclosing or changing data for an unauthorised person.
