Legal
Privacy, in plain words.
What we collect, the legal basis for collecting it, how long we hold it, and what you can ask us to do about it. No dark patterns, no data broking.
Last updated 22 July 2026
Who we are
Clauset is a curated index for independent designers and makers in Southeast Asia. When you use clauset.shop, we are the controller of the personal data described here — we decide what is collected and why. Privacy questions, and any request about your own data, go to Contact. We have not appointed a data protection officer; the platform’s processing is not large-scale or systematic enough to require one, and privacy requests are handled by the owner directly.
What we collect
- Newsletter — your email address, if you sign up for it, plus the proof of consent the law requires us to keep: the date you signed up, the page you signed up from, and the IP address the signup came from. Nothing else, and nothing we go looking for.
- Seller accounts — the email and password you register with (passwords are stored hashed, never in the clear), your brand profile, business and billing details, and everything you upload: photos, product copy, and any certificates you choose to add.
- Orders — when checkout is live, the items, delivery address, and contact details needed to fulfil and ship an order. Card details are handled by the payment processor and never reach our servers.
- Preferences — cookies holding your chosen language and display currency, and a session cookie that keeps you signed in to the seller portal.
- Server logs — standard request logs (IP address, time, page) kept briefly for security and debugging.
What we do not do
We do not run advertising trackers or third-party analytics on this site, we do not build advertising profiles, and we do not sell or rent your personal data to anyone. No decision affecting you is made automatically — there is no profiling and no automated decision-making of the kind Article 22 of the GDPR is about. If any of that ever changes, this page changes first.
Why we use it, and our legal basis
Under the GDPR every use of your data needs a lawful basis. Ours, purpose by purpose:
- Running your seller account and listings — performance of our contract with you (Art. 6(1)(b)).
- Taking and delivering an order — performance of the purchase contract (Art. 6(1)(b)).
- Sending the newsletter — your consent (Art. 6(1)(a)), which you can withdraw at any time from the unsubscribe link in every issue. Withdrawing does not affect what we sent before.
- Language and currency preferences — our legitimate interest in showing you a site that works (Art. 6(1)(f)); these cookies are strictly necessary or preference cookies, not tracking.
- Security, fraud prevention, and debugging — our legitimate interest in keeping the platform standing (Art. 6(1)(f)).
- Accounting and tax records — our legal obligations (Art. 6(1)(c)).
Who we share it with
Only the services needed to run the platform: our hosting provider, Resend (our email provider, once the newsletter starts sending — no message has gone out yet), the payment processor once checkout is live, and the logistics partner carrying your parcel. Each acts as our processor under a written agreement, and each gets the minimum needed to do its job. Sellers receive a buyer's name and delivery address solely to fulfil the order, and the seller agreement forbids any other use. We also disclose data where the law requires it.
Where your data lives
The platform is hosted in Singapore and the makers are largely in Thailand, so your data is processed in both. If you are in the European Economic Area or the UK, that means your data is transferred outside it: those transfers rest on standard contractual clauses with our providers, or on an adequacy decision where one covers the destination. Ask us and we will tell you which applies and send you a copy of the safeguards.
How long we keep it
Newsletter emails until you unsubscribe — after which we keep the address flagged as unsubscribed, with the consent record, so we can prove we had permission and can honour the opt-out. Ask us and we delete the row outright. Seller accounts and listings for as long as the account is open, and up to a year after closure for accounting and dispute purposes. Order records for as long as tax and consumer-protection law requires — typically five years under the Thai Revenue Code. Server logs for a matter of days. When a retention period ends, the data is deleted.
How we protect it
Traffic is encrypted in transit (HTTPS), passwords are stored as argon2 hashes, the database is not reachable from the public internet, and access is limited to the people who need it. No system is perfectly secure, but if a breach ever put your rights at risk we would notify the relevant regulator within 72 hours and tell you directly where the law requires it.
Your rights
Wherever you are, you can ask us to do all of the following, free of charge, and we answer within one month:
- Access — get a copy of the data we hold about you.
- Rectification — have anything wrong corrected.
- Erasure — have it deleted, including closing a seller account and taking the listings down, where we have no overriding legal reason to keep it.
- Restriction — have us pause using it while a dispute about it is sorted out.
- Portability — receive the data you gave us in a machine-readable file, or have it sent to another provider.
- Objection — object to any processing we base on legitimate interests, and object to direct marketing at any time, which we always honour.
- Withdraw consent — unsubscribe from the newsletter, and clear the preference cookies from your browser whenever you like.
Write to us via Contact and we will action it. If you think we have handled your data badly, you can complain to a supervisory authority: your local data protection authority in the EEA, the ICO in the UK, the Personal Data Protection Committee in Thailand, or the PDPC in Singapore. We would rather you came to us first, but that is your right either way.
Cookies
Three cookies run on this site: your chosen language, your display currency, and — for sellers — the session cookie that keeps you signed in. All three are strictly necessary or preference cookies, so no consent banner is required. There are no analytics, advertising, or third-party cookies. The day that changes, a consent banner arrives with it.
Children
Clauset is not intended for under-16s and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.
Changes
When this policy changes we update the date at the top of this page. Material changes get a note in the newsletter, and where the change relies on your consent we ask for it again.