Privacy Policy

Effective date: 8 May 2026

Who we are

and den is a curated vintage and replica furniture shop based in Subang, Selangor, Malaysia.

Contact us at: [TODO: contact email]

Address: [TODO: business address, Subang, Selangor]

What data we collect

  • Account users (staff): name, email address, bcrypt-hashed password.
  • Customers: name, contact number or social handle, purchase history, deposit and payment records, delivery address, and delivery contact details.
  • Session data: a NextAuth.js session cookie is stored in your browser to keep you logged in. No third-party tracking cookies are set.

Why we collect it

  • To fulfil purchase and reservation orders.
  • To coordinate delivery of purchased items.
  • To contact customers regarding their orders.
  • To maintain an accurate inventory and sales record for business operations.

How we store and protect it

Data is stored in a PostgreSQL database hosted on Neon (or a similar Vercel-partnered provider) and served through a Next.js application deployed on Vercel. Both providers maintain SOC 2-compliant infrastructure with encryption at rest and in transit.

Passwords are hashed using bcrypt (cost factor 10–12) and are never stored in plain text.

Retention

Customer and sales records are retained for as long as the business operates or until you request deletion. Session cookies expire after 30 days of inactivity.

Your rights under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Withdraw consent to processing (subject to contractual obligations).
  • Request deletion of your data where no legal obligation requires us to retain it.

To exercise any of these rights, contact us at [TODO: contact email]. We will respond within 21 days.

Governing law

This policy is governed by the laws of Malaysia. Any disputes shall be subject to the exclusive jurisdiction of the courts of Selangor.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated to registered users by email. The effective date at the top of this page reflects the latest revision.