Privacy Policy
This policy explains what personal data Pebble & Peak collects, why we collect it, how long we keep it, and how you can access, correct or delete it. It applies to everyone who visits the Site, places an order (including guests), or creates an account.
1. Who we are
Pebble & Peak is a sole proprietorship based in Singapore. We operate the online store at pebbleandpeak.com (the “Site”). We are the data controller for the personal data described in this policy. Contact: hello@pebbleandpeak.com.
2. What we collect and why
We collect only the minimum personal data needed to run the store. Each field has a stated purpose:
| Data | Purpose |
|---|---|
| Name | Order fulfilment — addressing your parcel and confirming your order. |
| Email address | Order confirmations, delivery notifications, and order-claim verification. Payment receipts are sent by our payment provider. |
| Shipping address | Delivery of your order by our carrier, SingPost. |
| Phone number (optional) | Delivery notifications and carrier contact if a parcel cannot be delivered. |
| Order contents and totals | Processing your purchase and keeping the accounting records Singapore law requires. |
Payment details: card numbers are processed by our payment provider, Stripe, and never touch our servers. Stripe may also offer PayNow, Apple Pay and Google Pay at checkout.
Website analytics: we use Umami, a cookieless analytics service, to understand aggregate site usage (pages visited, referrer, approximate country, device type). It stores no personal data, sets no cookies, and does not track you across other websites.
We do not use advertising pixels, remarketing trackers, or third-party cookies on the Site, and we never sell your data.
3. Guest orders
You can buy without creating an account. Guest orders store the name, email and shipping address you provide at checkout, held for fulfilment and for the same retention periods as account orders. After purchase you canclaim your order with your email and order number to see it in an account. If you want a guest order’s data deleted, email us athello@pebbleandpeak.com and we will delete or anonymise it as described in sections 5 and 6.
4. Cookies and the account session
When you are signed in, we use a strictly necessary cookie set by our authentication provider, Supabase, to keep you signed in. This cookie is required for account features to work; it is not used for advertising or tracking, and no consent banner is needed for it.
Guest carts may use a small anonymous identifier cookie so your bag survives across visits. Umami analytics is cookieless (section 2). We do not use any cookies for marketing.
5. Retention
- Account profile — kept until you delete your account or ask us to remove it.
- Order records — kept for as long as required for tax and accounting purposes (Singapore law: generally at least 5 years), then the personal data in them (name, email, address, phone) is anonymised while the order record itself is retained for audit and accounting.
- Deleted accounts — your profile is soft-deleted immediately (you can no longer sign in) and permanently erased after a 30-day grace period.
- Marketing contacts — we only email marketing to people who have opted in; you can unsubscribe at any time and we delete opt-in lists on request.
6. Deleting your data
Accounts: go to Account settingsand choose “Delete my account”. This signs you out immediately, blocks further sign-in, and confirms by email. Your profile is erased after a 30-day grace period. Order records are kept for accounting (section 5) with personal details anonymised once the retention window passes — we never destroy records Singapore law requires us to keep.
Guests and others: to request deletion or anonymisation of your personal data (including guest order data), emailhello@pebbleandpeak.com. We respond within 30 days.
7. Sharing
We share data only with the service providers needed to operate the store:
- Stripe — payment processing (including PayNow);
- SingPost — parcel delivery;
- Resend — transactional email (order confirmations, delivery updates, account notices);
- WhatsApp Business — customer support conversations.
We never sell or rent your personal data to anyone.
8. Data transfers
Our store data is hosted by Supabase in the Singapore region. Payment data is processed by Stripe, which operates globally with appropriate safeguards. Analytics data is stored by Umami in the EU (Frankfurt) region.
9. Security
We use HTTPS throughout, rely on Stripe’s PCI-compliant infrastructure for card data, and follow account hygiene best practices (strong unique passwords, least-privilege access, row-level database isolation). No system is completely secure, but we take reasonable measures to protect your data.
10. Breach notification
If a data breach is likely to result in significant harm to affected individuals, we will notify the Personal Data Protection Commission (PDPC) and the affected individuals as required under the PDPA, without undue delay.
11. Your rights
Under the Singapore PDPA, you may request access to and correction of your personal data, and withdraw consent where consent is the basis of processing. If you are in the EEA/UK, you additionally have rights to erasure, restriction, portability and objection, and may lodge a complaint with your local data protection authority.
To exercise any of these rights, emailhello@pebbleandpeak.com. We respond within 30 days, and we may ask you to verify your identity first.
12. Changes to this policy
We may update this policy; the current version is always on this page with a revision date. Material changes will be notified by email where we hold a contact address.
Last revised: 8 August 2026