Privacy Policy

What we collect, who else sees it, and what you can ask us to do with it.

Please have this reviewed by a lawyer before you rely on it. It is a working draft written to describe how this site actually behaves. It is not legal advice.

Last updated: August 2026

Calyn Cadeau operates this online store. This page says what personal data we collect, why we have it, who else sees it, and what you can ask us to do about it.

It is written to describe this site specifically. If something here is vague, it is because we are unsure — not to leave ourselves room.

What we collect

When you place an order

your name, email address and phone number
your delivery address, and any delivery note you write
what you ordered and what you paid
a reference from the payment provider confirming the payment

If you create an account — the same details, kept so you do not have to type your address again, plus a password. We store your password only as a one-way hash with a salt unique to your account. We cannot read it, and nobody who steals the database can read it either.

Automatically, as part of serving the site — ordinary technical information such as your browser type and your network address. We do not build a profile from it.

When someone repeatedly fails to sign in we count the failures against a hashed identifier so we can slow an attack down. The raw address is never written to our database.

What we never collect

Your card number, your CVV and your online banking password never touch this site. Payment happens on Billplz's own page. What comes back to us is a confirmation that a payment succeeded or failed, and a reference for it.

There is no advertising or analytics tracking here. No Google Analytics, no advertising pixel, no third-party tracker, no profile of what you looked at. We do not sell or share your data for anyone else's marketing, and there is no arrangement under which we could.

Cookies

Only what the site needs to work:

What	Why	How long
`cc_customer`	Keeps you signed in. Only set if you sign in.	30 days
`cc_admin`	Signs in the shop's own staff.	One staff session
Your bag	Remembers what you put in your basket. Stored in your browser, never sent to us until you check out.	Until you clear it

Both cookies are httpOnly, which means scripts on the page cannot read them. There is nothing here to accept or decline, which is why you are not asked.

Why we use it

to pack and send your order, and to talk to you about it
to handle returns, refunds and questions
to let you sign in and see your own past orders
to keep the payment records that let a disputed payment be reconstructed
to protect the shop from fraud and from attacks on sign-in
to keep the business and tax records the law requires us to keep

That is the whole list. We do not use your data for anything else, and we do not email you about anything other than your order — see Marketing below.

Who else sees it

Only the services needed to run the shop, and only what each one needs:

Who	What they get	What for
Billplz	your name, email, phone and the amount	to take the payment
The courier	your name, address and phone	to deliver the parcel
Supabase	the database itself	to store orders and accounts
Vercel	the site, and requests to it	hosting
Resend	your email address and the message	to send order emails
Cloudflare	the domain name only	DNS

We may also disclose data if the law requires it. If that ever happens we will tell you, unless we are forbidden from doing so.

We do not sell your data. If the business is ever sold, customer records would pass to the buyer — and we would say so here before it happened.

Where your data is kept

The database is hosted in Singapore (ap-southeast-1). Our hosting and email providers are international companies and may process data outside Malaysia in the course of running their services.

How long we keep it

Orders and payment records — 7 years. That is the period Malaysian tax law requires business records to be kept, so this is the one thing a deletion request cannot reach.
Your account — until you ask us to close it.
Sign-in sessions — they expire on their own, and are deleted when you sign out.
Sign-in failure counts — cleared once the lockout passes.

How we protect it

Card and banking details never reach us at all — the safest data is the data you do not hold.
Passwords are stored as salted, deliberately slow hashes, never as text.
Sign-in cookies are httpOnly and the token in our database is stored hashed, so a stolen database cannot be used to sign in as you.
Failed sign-ins are counted and locked out.
The site is served over HTTPS.

No one can honestly promise a system is unbreakable, and we will not. What we can say is what the damage would be: there is no card data here to lose.

If a breach ever did affect your data, we would tell you what happened, what was affected and what to do — promptly, and without waiting to be asked.

Your rights

Under Malaysia's Personal Data Protection Act 2010 — and Singapore's PDPA 2012 if you are there — you can ask us to:

show you what we hold about you
correct anything wrong
delete what we are not required to keep
stop using it for anything you have not asked for

Write to hello@calyncadeau.com and we will answer. We may ask you to confirm who you are first — otherwise anyone could ask for your address.

The one limit is above: an order we are legally required to keep stays for 7 years. We will say so plainly rather than quietly keeping it.

Marketing

We do not currently send marketing email. The only emails you get from us are about an order you placed.

If we start a newsletter, it will be something you opt into deliberately — never something you are added to because you bought something — and every message will have a one-click unsubscribe.

Children

This shop is not intended for children. You must be 18 or older to order, and we do not knowingly collect data from anyone under that age. If you think a child has given us their details, tell us and we will delete them.

Changes

If we change this page we will update the date at the top. A change is never applied backwards to data we have already collected under an older version.

Contact

Questions, or a request about your data: hello@calyncadeau.com, or the contact page.