Privacy Policy for BrightBuds Studio

1. Collection of Personal Data

We collect only the information necessary to serve you. You are not required to provide your real name for billing or shipping, provided the details are sufficient for successful delivery.

Personal Data we collect includes:

  • Contact Number & Shipping Address: These are treated as sensitive data required for delivery.
  • Email Address: Used for order confirmations and (optionally) our future newsletter.
  • Account Details: If you choose to register an account for easier checkout.

2. No Sensitive Payment Storage

We do NOT collect or store sensitive financial information such as credit card numbers or bank credentials. Our only payment method is PayNow QR, which involves an offline transfer performed by you within your own banking app. No payment credentials ever touch our servers.

3. Use of Personal Data

We use your data for:

  • Order Fulfillment & Delivery: Arranging shipment via our logistics partner.
  • Analytics: We use WooCommerce Analytics and Cloudflare Analytics to monitor site performance and sales trends. We do not use Google Analytics.
  • Customer Support: Responding to your queries.
  • Newsletter: If you opt-in, we may send you occasional updates (this service is currently being established).

4. Disclosure of Personal Data

We keep your data private. It is only shared with:

  • SingPost: Our sole logistics partner, for the purpose of delivering your orders.
  • Google LLC (via Cloudflare Zaraz): Website usage data is shared with Google Analytics for our internal performance tracking. We have disabled all data-sharing settings with Google, ensuring your data is not used for Google’s own product improvements or marketing. Furthermore, we use Cloudflare Zaraz to anonymize (trim) your IP address before any data is transmitted.
  • International Transfers: By using our site, you acknowledge that your anonymized analytics data may be transferred to and stored on servers located outside of Singapore (primarily in the United States) by Google. We ensure that such transfers comply with the PDPA through Google’s Data Processing Amendment, which we accepted on 9 April 2026.
  • Self-Managed Infrastructure: Our website is owned and managed directly by us. No third-party IT service providers are involved in the handling of your personal data.

5. Protection & Security (SSL)

Even though we do not store high-risk financial data, we take security seriously:

  • SSL Encryption: We use Secure Sockets Layer (SSL) technology for all data transmissions between your browser and our server to ensure your contact and shipping details remain private.
  • Privacy-First Analytics: We use Cloudflare Zaraz to manage third-party tools. This allows us to run analytics scripts on the server-side (“at the edge”), minimizing the amount of data exposed in your browser and preventing third-party scripts from accessing your full IP address.
  • Limited Access: Only authorized team members at BrightBuds Studio have access to order information.

6. Use of Cookies

Our website uses cookies to enhance your browsing experience, remember your preferences, and analyze traffic. You can manage cookie settings through your browser, but disabling them may affect website functionality.

Essential WooCommerce Cookies:

  • woocommerce_cart_hash: Helps WooCommerce determine when cart contents/data changes.
  • woocommerce_items_in_cart: Contains information about the items in your cart.
  • wp_woocommerce_session_: Contains a unique code for each customer so it knows where to find the cart data in the database for each customer.

Analytics Cookies (Google Analytics):

  • _ga / _ga_*: These help us understand how you use the site (e.g., which pages are most popular) so we can improve our store. They contain no personal information and do not identify you by name.

These cookies contain no personal information and expire when you close your browser or after a short period.

7. Data Retention

Under the PDPA’s Retention Limitation Obligation, we do not keep your personal data longer than is necessary for the purposes it was collected or for legal/business needs.

Specifically:

  • Business Records: We retain order information for a period of 5 years to comply with Singapore’s Inland Revenue Authority (IRAS) requirements for tax and accounting purposes.
  • Account Data: If you have registered an account, we will retain your data as long as the account is active.
  • Manual Deletion: You may request the deletion of your personal data at any time. We will fulfill this request unless we are legally required to retain the data (e.g., for an ongoing tax audit or legal dispute).

8. Your Rights (PDPA)

Under the PDPA, you have the right to access or correct your data, or withdraw your consent. To do so, please contact us at [email protected]

IMPORTANT

Consent: By placing an order, you consent to the collection and use of your shipping details and contact number for the sole purpose of order fulfillment via SingPost.

Last Updated: 9 April 2026