1. Core Payment Principle
HuoPuo currently uses Stripe Elements / Stripe Payment Element for payment-card functionality. HuoPuo may use Stripe where applicable and may add other approved payment service providers from time to time.
HuoPuo does not receive or store sensitive payment-card data, including full payment card numbers (full PAN), CVV/CVC codes, PINs, or full magnetic-stripe/track data. Sensitive card information is entered through Stripe’s payment interface and transmitted directly to Stripe.
2. Data HuoPuo Does Not Store or Receive
▪Full payment card number (full PAN);
▪CVV/CVC;
▪PIN;
▪Full magnetic-stripe/track data;
▪Reusable sensitive card credentials;
▪Card expiry month/year as part of HuoPuo’s application payment record under the current payment architecture.
4. Recurring Payments and Tokenization
For recurring or subscription payments, HuoPuo uses tokenization or provider-issued references where supported by the payment service provider. When Customer saves a payment method, HuoPuo stores the token, payment-method identifier, or provider reference issued by the payment service provider, not the underlying full card number.
HuoPuo uses the token or provider reference to instruct the payment service provider to charge the corresponding saved payment method. HuoPuo does not independently hold reusable card credentials.
5. Current Payment Architecture Summary
| Question | HuoPuo position |
|---|---|
| Payment method used now | Stripe Elements / Stripe Payment Element |
| Full PAN reaches HuoPuo server | No |
| CVV/CVC reaches HuoPuo server | No |
| HuoPuo stores payment token/reference | Yes |
| HuoPuo stores Stripe Customer ID or equivalent | Yes, where required for saved or recurring payment functionality |
| HuoPuo stores last4 | Yes |
| HuoPuo stores card brand/type | Yes |
| HuoPuo stores expiry month/year | No |
| Recurring/subscription payments | Yes |
| Payment provider other than Stripe now | No |
6. Payment Data Summary
| Information | Held by HuoPuo | Held/processed by payment service provider |
|---|---|---|
| Full payment card number (full PAN) | No | Yes - handled by Stripe/provider |
| CVV/CVC | No | Used by the provider at authorization; not retained by HuoPuo as reusable card data |
| PIN or full magnetic-stripe/track data | No | Handled only by card network/provider systems where applicable; not held by HuoPuo |
| Payment token / Payment Method ID / provider reference | Yes - where needed for transactions, saved payment methods, or subscriptions | Yes - corresponding provider reference |
| Transaction, PaymentIntent, authorization, settlement, or refund reference | Yes | Yes |
| Provider name, amount, currency, date/time, payment status, invoice and billing data | Yes | Yes, as applicable |
| Limited payment-method metadata: last four digits and card brand/type | Yes - where provided by Stripe/provider and needed | Yes, as provider/payment-network data |
| Card expiry month/year | No under current HuoPuo application payment record | Yes, as provider/payment-network data where applicable |
7. Provider-Neutral Operation
This statement is compatible with a payment-provider-neutral legal framework. If HuoPuo later adds another approved payment service provider, HuoPuo may update its Subprocessor List, Privacy Notice, Payment Terms, or related legal materials where required by applicable law or written agreement. As of this statement, Stripe is the only identified payment provider.
8. Contact
▪General Contact: info@huopuo.com
▪Security Contact: security@huopuo.com
▪Legal/Privacy Contact: legal@huopuo.com