Privacy Notice

Jadeite Pavilion is operated by Jadeite Pavilion Hub, a sole proprietor registered in Malaysia. For any privacy matter, contact us at jadeitepavilionhub@gmail.com.

• Order data - name, delivery address, email, phone, items, and total. Purpose: fulfilling your order. Lawful basis: performance of a contract.
• Messages - what you send us by email or form. Purpose: answering you. Lawful basis: legitimate interest.
• Email sign-ups - if you join our drop list, we store your email (with Supabase and our email provider, Klaviyo) to send first access to new pieces and occasional jade notes. Purpose: marketing you opted into. Lawful basis: consent. Unsubscribe from any email at any time.
• On your device - your country, currency, and cart are stored in your browser (localStorage) on your own device, not on our servers. We also keep which channel referred you; if you order, that one field is saved with the order. Purpose: making the shop work. Lawful basis: necessary for a service you asked for.
• Analytics and advertising measurement - only if you accept them. Google Analytics and Microsoft Clarity tell us how the gallery is used; a Google Ads tag tells us which advert led to a sale, recording the order value and the piece but never your name, email, or card details. Purpose: improving the shop and measuring what our advertising costs. Lawful basis: consent, which you can withdraw any time on the Cookies page. In the UK, EEA, and Switzerland none of it runs before you agree.
• Payment - your card number goes directly to Stripe. We never see or store it; we only receive a confirmation token.

Only what is needed to deliver your order:

• Stripe (payment processing, United States).
• Supabase (our order database, hosted in Singapore).
• UPS, FedEx, or Aramex (shipping): your address and phone for delivery.
• Google and Microsoft (analytics and advertising measurement, United States), only with your consent, and only usage data: pages viewed, device and approximate location, and for a purchase the order value and piece. We do not send them your name, email address, or any customer list.
• Google (our Your Personal Jade Guide, United States) - what you type in the guide is sent to Google's Gemini model to write a reply, occasionally routed via OpenRouter. We send your messages and our product list, never your name, email address or order history.

We never sell or rent your data, and we never share it for anyone else's marketing.

• Order records: 7 years (required for Malaysian tax law).
• Email correspondence: 2 years after our last contact.
• Abandoned carts: 30 days, then deleted.

Email us to access, correct, or delete the data we hold on you, or to withdraw consent for any optional processing. We respond within 30 days.

Your order data may be processed by Stripe (United States) and our database provider Supabase (Singapore region). Both providers maintain industry-standard security practices.