Privacy Policy

What we collect

When you place an order, we collect your name, email address, and phone number. We use this information solely to fulfil your order, contact you about your purchase, and send you transactional updates related to that order.

How we use your data

Your personal data is used only for order processing, payment coordination, and communication about your order. We do not use it for unrelated marketing unless you have separately agreed to that.

Sharing and sale of data

We do not sell your personal data. We do not share it with third parties for their own marketing. We may use trusted service providers (for example, hosting, email delivery, or payment-related tools) strictly as needed to operate the shop, and only under appropriate safeguards.

Service providers & where your data goes

We use a small number of service providers (processors) to run the shop. Each only receives the data it needs to do its job:

• Supabase - hosts our database and admin login, so it holds your order and contact details.
• Vercel - hosts this website and serves every page you view.
• Resend - sends the transactional emails about your order (received, paid, ready for pickup).
• Cloudinary - hosts our product photos; it does not receive your personal data.

These providers operate on servers outside Singapore, so your personal data may be transferred to and processed in other countries as part of running the shop. We only use providers that give equivalent protection to your data wherever it is processed, as required under the PDPA.

Cookies & local storage

We do not use a cookie consent banner because everything we store is strictly necessary or functional - there is no advertising or tracking cookie on this site. Here is everything we store on your device:

• splash_dismissed - remembers you have seen the intro screen, so it does not show again.
• last_submission - a short-lived, security-only cookie that stops the order form being submitted twice in a row.
• Supabase auth cookies - set only if you are the shop owner signed in to the admin dashboard.
• Your cart - kept in your browser’s local storage so it survives a page refresh; it never leaves your device until you check out.

We also use Vercel Analytics, which is cookieless and does not identify you individually.

Retention

We run two separate retention clocks. Your name, email address, and phone number are anonymised automatically two (2) years after your order. Separately, Singapore’s IRAS record-keeping requirements mean we keep the financial details of the order (order reference, items ordered, and total paid) for five (5) years, as required by law. Only your personal data is removed at the two-year mark - the order record itself, stripped of anything that identifies you, is kept for the longer period the law requires.

Your rights & deletion requests

Under the PDPA, you may request access to or correction of your personal data, or ask us to stop using it in certain ways. You may also request deletion of your personal data where applicable.

To request deletion or to exercise your rights, contact us via WhatsApp. Please include your order reference or the email you used when ordering so we can verify your request.

Data Protection Officer

Under the PDPA we have designated a Data Protection Officer responsible for this policy and for handling your requests.

One Crunch Lady (Data Protection Officer)
Email: privacy@onecrunchlady.sg

You can also reach us on WhatsApp for anything else about this policy or your order.