Privacy

Glothlab, in Singapore, decides what happens to the information described here. For anything on this page, email glothlab@gmail.com.

When you buy something. Your name, email, delivery and billing address, what you ordered, and what you paid. We need all of it to take an order and get it to you.

When you have an account. Your saved addresses, sizes, wishlist, and email preferences.

When you browse. Which pages and products you looked at, tied to a random identifier stored in your browser. That identifier names a browser, never a person. If you later sign in we connect the two, so that history becomes yours; until then it belongs to nobody.

Card details we never see. Payment is handled entirely by Stripe. Your card number is entered into their form, sent to them, and never reaches our servers or our database. We are told whether a payment succeeded, and the last four digits — nothing else.

Order emails — confirmation, despatch, delivery — are part of the contract you entered when you bought something. They are not marketing, they carry no unsubscribe link, and turning off every preference on this site will not stop them.

Everything else asks first: the newsletter, using your browsing to personalise what we show you, and publishing your name alongside a review. Each is a separate choice and changing one never changes another. You can see and change all of them under email preferences.

We keep a dated record of every consent change — what you agreed to, when, and from where. That record is never edited or removed, because its whole purpose is to be able to show what was true at a given moment.

Nobody who is not needed to complete your order. We do not sell personal data and we do not share it for anyone else’s advertising.

• Stripe takes the payment and holds the card details we never receive.
• NinjaVan gets the delivery address and your name, because a parcel cannot arrive without them.
• Resend sends our email, so it handles your address and the message.
• Neon and Vercel host the database and the site itself.

Some of these operate outside Singapore. Where that happens, the transfer is covered by the contract we hold with them.

We use four, and none of them advertise to you.

• A sign-in cookie, so you stay signed in between pages.
• A browser id (glothlab_aid), which links your visits to each other and to nothing else.
• A region cookie remembering which store you chose, and a companion that stops us asking again.

There is no advertising pixel, no third-party analytics script, and nothing on this site reports your behaviour to another company.

These are deletions that actually run — a job sweeps them nightly, so data past its window is removed whether or not anyone asks.

Under the PDPA you can ask what we hold about you and ask us to erase it. Both are on your own account rather than behind an email request: go to email preferences.

Download gives you a file containing your orders, preferences, browsing history, and every email we have sent you.

Delete removes your account, addresses, preferences, wishlist and browsing history immediately and permanently. Two things survive it, and it is fairer to say so here than to surprise you: past orders remain as financial records with your name, address and email stripped out, and your email address stays on our do-not-contact list — because the alternative is that deleting your account quietly makes you contactable again.

If you never made an account, email glothlab@gmail.com and we will answer within two business days.

If we change how we handle your data, this page changes and the date at the top changes with it. We will not quietly widen what we do with information you already gave us.