Your data
Personal data policy
How Anna's Jagua Studio collects, uses and protects your personal data, in line with the Hong Kong Personal Data (Privacy) Ordinance (PDPO).
What we collect
- To fulfil an order: your name, phone number, delivery address, and email.
- For your member account: your login email (or phone number / Google / Apple identity), an encrypted password, and the details you choose to save for faster checkout.
- Payment receipt screenshots you upload, used solely to verify your payment.
- We never see or store your card numbers, bank credentials or wallet balances — payments happen entirely inside your own banking app.
How we use it
- Processing and delivering your orders, verifying payments, and answering your questions.
- Sending transactional emails only: order confirmations, account confirmation and password-reset links. We do not send marketing emails and we never sell or rent your data.
Where it lives & how it's protected
- Data is stored with Supabase (our database provider) and served through Vercel, both protected with encryption in transit (HTTPS) and at rest.
- Access is locked down: customers can only ever read their own orders via secret links or their own account; receipts are in private storage visible only to the store owner; all sensitive operations run on the server, never in the browser.
Third parties we rely on
- Supabase (database & login), Vercel (website hosting), Resend (transactional email), and SF Express (delivery — they receive your name, phone and address to deliver your parcel). Each processes only what its job requires.
How long we keep it
- Order records are kept while the store operates, for accounting and warranty purposes. Your account and its saved details exist until you ask us to delete them.
Your rights (PDPO)
- You may request access to, correction of, or deletion of your personal data at any time — email us and we'll respond within 40 days as the Ordinance requires. Deleting your account removes your saved details and login; order records may be retained where the law requires.
Cookies
- We use only functional cookies: your login session and your language choice. No advertising or cross-site tracking cookies, ever.