Privacy Policy

What we collect

• Account: your email address, the name you give us, and your password (stored securely hashed by our authentication provider).
• Designs: the bracelets you save, and whether you share them or add them to the gallery (with the display name you choose).
• Orders: what you ordered, gift options (recipient name, message), the delivery name and address, and your email for receipts.
• Payments: handled by Stripe. We receive a payment reference and the amount, never your full card number.
• Community: likes and comments you post, shown with your first name.
• Technical: a login session cookie, and your unsaved design draft kept in your own browser's storage. We don't use advertising or tracking cookies.
• Camera: AR try-on runs on your device. Camera images and photos you choose are not uploaded to us.

Why we use it

• To run your account, save your designs and let you share them.
• To make, pack and deliver your orders, including gift messages, and to send receipts and order updates.
• To handle payments, refunds and support requests.
• To keep the service secure and the community safe (for example, moderating comments).

Who we share it with

We use trusted providers to run Sunny Beads, and share only what each needs:

• Supabase (database and login, hosted in Singapore)
• Vercel (website hosting)
• Stripe (payments)
• Delivery partners (the delivery name and address for your order)
• jsDelivr and Google (to download the AR hand-tracking software to your device; no images are sent)

We don't sell your personal data. Some providers may process data outside Singapore; where they do, we rely on their contractual commitments to protect it to a standard comparable to the PDPA.

How long we keep it

We keep your account data while your account is open. Order records are kept for as long as needed for accounting and legal purposes (typically up to 5 years). When you delete your account, we delete or anonymise your personal data unless the law requires us to keep it.

Your rights

Under the PDPA you can ask to access or correct your personal data, and withdraw consent for its use (which may mean we can't provide some services). You can also ask us to delete your account. Email syint999@gmail.com and we'll respond within 30 days.

Children

Sunny Beads isn't intended for children under 13 without a parent or guardian's involvement.

Security

Your data is protected in transit (HTTPS) and at rest, and access is restricted by row-level security so members can only see their own designs and orders.

Contact and changes

Our data protection contact is reachable at syint999@gmail.com. If we change this policy we'll update the date above and, for significant changes, let you know.