This policy explains what personal data we collect when you use this website or place an order with us, why we collect it, and what rights you have over it. We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA).
We only collect what we need to fulfil your order and answer your questions.
We never see or store your card number. Card payments are processed directly by Stripe, an independent payment provider. Your card details are sent from your browser to Stripe and never pass through our systems. We only receive confirmation that a payment succeeded, along with the amount and a reference number.
We do not sell your personal data, and we do not use it for advertising or profiling.
We share the minimum necessary with the service providers that make the shop work:
We may also disclose data where we are legally required to, for example in response to a lawful request from an authority.
Our shop is operated from Singapore and Thailand, and our hosting is provided by Google Cloud. This means your data may be stored or processed outside Singapore. Where data is transferred abroad, we take reasonable steps to ensure it receives a standard of protection comparable to the PDPA.
We keep order records for as long as needed to fulfil the order and to satisfy accounting, tax, and legal obligations. Enquiries and messages that do not lead to an order are deleted once they are no longer needed. When data is no longer required for any legal or business purpose, we delete or anonymise it.
This website does not use advertising cookies, analytics cookies, or third-party tracking pixels.
We use your browser's local storage for the things the shop needs in order to function — for example remembering the contents of your cart between pages. Stripe may set its own cookies on the checkout step for fraud prevention and to process your payment securely.
You have the right to:
To make any of these requests, contact us at the address above. We will respond within a reasonable time, normally within 30 days.
The site is served over HTTPS, and access to order data is restricted to authorised staff accounts. No system can be guaranteed completely secure, but we take reasonable technical and organisational measures to protect your data against loss, misuse, and unauthorised access.
Our shop is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact us and we will delete it.
If we change this policy we will update the date at the top of this page. Material changes will be highlighted on the site.
For any question about this policy, or to exercise the rights described above, write to us at yingyingyingamulet@gmail.com, or reach us through any of the channels listed on our home page.