Privacy Policy

1. Data we collect

We collect the following personal data when you place an order, sign in, or contact us:

• Identity and contact: name, email address, phone number
• Delivery: shipping address
• Transaction: order details, amounts paid (card details are handled by Stripe — we never see or store them)
• Account: saved profile details, order history, and preferences you choose to save
• Sign-in: one-time sign-in codes we email you (stored only in scrambled form, valid for 10 minutes, and deleted once used or expired), and a record of sign-in attempts with a scrambled form of your IP address
• Referrals and cashback credit: your referral code, codes you use, and the cashback credit you earn, spend and lose, with dates
• AI assistants: when an assistant shops for you, the cart, delivery details and order it creates, and which assistant connection created them
• Reviews: display name and review content you voluntarily submit
• Skin Age Scan: photos you upload or capture, AI-generated skin age estimates, score outputs, and quality notes when you choose to use the Skin Age Scan
• Usage data: pages visited, browser type, IP address (collected automatically via server logs)
• Personalization: products and pages you view, searches, and items you add to cart — linked to your account if you are signed in, or otherwise to a first-party cookie on your device — used to tailor recommendations

We do not collect NRIC or payment card details. Skin Age Scan photos are optional and are used only if you choose to upload or capture an image for that feature.

2. How we use your data

We use your personal data to:

• Process and fulfil your orders
• Send order confirmations and delivery updates
• Create and maintain a customer profile so you can view order history and saved preferences
• Tailor product rankings, search results, and "you may also like" recommendations to your interests
• Generate Skin Age Scan results, improve personalization, improve the scan experience, and support AI model improvement where you have uploaded an image for that feature
• Respond to enquiries and provide customer support
• Sign you in, and let an AI assistant you have given a sign-in code use your account for that session
• Run the referral programme: issue your code, credit cashback, and check for misuse, for example by comparing the phone number and address on a referred order with the referrer's orders
• Email you about your cashback credit, including a reminder before it expires
• Display your name alongside reviews you submit (masked if you choose)
• Prevent fraud and maintain site security
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for unsolicited marketing without your consent.

3. Sharing with third parties

We share data only as necessary to operate the business:

• Stripe — payment processing. Stripe is PCI-DSS compliant. See stripe.com/privacy.
• Delivery partners — your name and address are passed to the courier to fulfil your order.
• Resend — sends our order, sign-in code and credit emails, so it receives your email address and the content of those emails.
• Cloudflare — our infrastructure provider. Traffic passes through Cloudflare's network. See cloudflare.com/privacypolicy.
• AI service providers - photos submitted through the Skin Age Scan are sent to an AI service to generate the visual estimate and may be used to improve AI models, personalization, and the scan experience.
• AI assistants you use — when you shop through an assistant, it receives the product, cart, order and account information it asks for on your behalf. Each assistant's use of that information is covered by its own provider's privacy policy.
• Meta — unless you turn Meta tracking off, the Meta Pixel shares eligible store page views, product views, cart additions and checkout starts with Meta for catalog matching, advertising measurement and relevant product ads. Meta receives browser/network information and may set advertising cookies. See Meta's privacy policy.

4. Data retention

We retain order and personal data for 5 years for accounting, tax, and legal compliance purposes, or longer if required by law. Skin Age Scan photos and generated results may also be retained for personalization, service improvement, and AI model improvement unless deletion is requested and no legal retention obligation applies. You may request deletion of your data subject to these obligations.

5. Cookies and personalization

We use cookies for the following purposes:

• Essential: maintaining your shopping cart and, when you sign in, keeping you authenticated
• Personalization: a first-party cookie that lets us remember your browsing on this device so we can tailor recommendations, even before you sign in
• Analytics: Google Analytics and Microsoft Clarity help us understand aggregate site usage so we can improve the store

We do not sell your data. Our store recommendations use your activity and the product catalog. Optional Meta advertising cookies and shopping-event sharing are on by default. You can turn them off below at any time.

If you allow analytics, pseudonymous Google Analytics client and session identifiers may be stored with an order so completed purchases and refunds can be measured reliably. We do not send your name, email, phone number, or delivery address to Google Analytics.

Completed purchase and refund totals may also be reported without browser, account, contact, or device identifiers for aggregate transaction reporting. Turning optional analytics off prevents behavioural and session attribution; it does not remove the store's aggregate transaction record.

You can turn personalized recommendations off at any time. When off, you'll see standard, non-personalized recommendations and we stop building a personalization profile for guest browsing on this device. Signed-in customers can also view, edit, or clear their saved profile from the My beauty profile section of their account.

Optional analytics

Analytics and personalization are separate choices. You can change whether optional analytics storage and Microsoft Clarity run on this device at any time. Google Analytics measures visits by default; turning analytics off below disables its storage and removes its cookies. Advertising storage, ad personalization, and ad user data remain disabled.

Optional Meta tracking

Meta tracking is on by default and is a separate choice from analytics and store personalization. It sends numeric product identifiers, quantities and SGD values for supported shopping events. Our event payloads do not include names, email addresses, phone numbers, delivery addresses, search text, account/order pages or Skin Age Scan data. Do Not Track and Global Privacy Control signals also prevent these events. You can withdraw permission here at any time; this stops future events and removes Meta's first-party tracking cookies from this browser. It does not erase events already received by Meta.

6. Security

All data is transmitted over HTTPS. Access to personal data is restricted to authorised personnel only. We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse.

7. Your rights under PDPA

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Withdraw consent for uses not required for contract fulfilment
• Request deletion subject to legal retention obligations

To exercise any of these rights, contact our Data Protection Officer at . We will respond within 10 business days.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised effective date.

9. Contact

WELL IN STYLE PTE. LTD.
77 High Street #10-12B High Street Plaza
Singapore 179433

10. Beauty Shelf browser extension

Tanatasa Beauty Shelf is published by WELL IN STYLE PTE. LTD. for Google Chrome and Microsoft Edge. The website data practices described above apply when you visit our website; the extension handles your saved shelf locally as described in this section.

What the extension saves

Product names, shelf status, opening dates, printed expiry dates, months after opening, and notes that you enter are saved only in your browser profile using chrome.storage.local. The extension does not send your shelf to Tanatasa or another server and does not use cloud sync.

Permissions and browser access

The only extension permission is storage, which keeps your shelf between visits. The extension does not read web pages, your current tab, browsing history, cookies, or account information. It contains no analytics, advertising SDKs, tracking pixels, remote scripts, or background requests. We do not collect or sell your extension shelf data, use it for advertising, or transfer it to third parties.

Links and searches

Choosing Search or Find at Tanatasa opens our shop in a new tab with your search words or saved product name in the URL. This sends those words to tanatasa.sg as an ordinary website visit, covered by the website practices above, including website analytics and cookies. Notes and recorded dates are never included in these links. Other links open the page you choose.

Backups, deletion, and retention

You can edit or remove individual products, delete the entire shelf, or export and import a JSON backup from About Tanatasa in the extension. Import replaces your shelf after confirmation. Exported files contain your products and notes; keep them private and delete them when no longer needed. Anyone with access to your browser profile or a backup may be able to read this data. Local extension storage is not encrypted by the extension and is removed when you uninstall it. There is no server copy for us to restore. The website retention periods above do not apply to the shelf stored locally by the extension.

Limited Use and contact

Use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. For extension support or privacy questions, contact Tanatasa or email [email protected].