Privacy policy

Last updated: 4 September 2026

Good Message Studio ("we", "us", "our") runs this online store. This policy explains what personal data we collect, why, who else sees it and what you can ask us to do about it. It is written to be read, not to be skimmed past.

Contact for anything in this policy: hello@goodmessagestudio.com

  1. WHAT WE COLLECT

When you place an order:

  • your name
  • your email address
  • your shipping address and, if different, your billing address
  • your order contents and order history
  • confirmation that payment succeeded, and the last four digits and card brand

We never receive or store your full card number, expiry date or security code. Those go directly to the payment provider.

When you browse the site:

  • device and browser type, operating system, language
  • your IP address and approximate region derived from it
  • pages viewed, referring site, and how you moved through the store
    This is collected through cookies and similar technologies.

When you contact us:

  • your email address and whatever you choose to put in the message

When you subscribe to emails:

  • your email address, and whether you opened or clicked

We do not ask for, and do not want, your date of birth, your identity document number or any special category data.

  1. WHY WE USE IT
  • To take, pack, ship and track your order, and to talk to you about it.
  • To process refunds and returns.
  • To answer your emails.
  • To detect and prevent fraudulent orders and chargebacks.
  • To understand, in aggregate, which pages and products people look at, so we can improve the store.
  • To send marketing emails, but only if you asked for them.
  • To meet our legal and tax obligations.

Our legal grounds, where the GDPR or a similar law applies to you: performance of the contract (orders and delivery), legitimate interests (fraud prevention, security, basic analytics), consent (marketing emails and non-essential cookies), and legal obligation (accounting records).

  1. WHO ELSE SEES IT

We do not sell your personal data, and we do not share it for anyone else's marketing. We share the minimum necessary with:

  • Shopify Inc., which hosts this store and processes orders on our behalf.
  • Payment providers (including Shopify Payments, PayPal and the wallet providers shown at checkout), which process the payment itself.
  • Our production and fulfilment partner, which receives your name, address and order contents in order to make up and dispatch your parcel.
  • Shipping carriers, which receive your name, address and contact email to deliver the parcel and provide tracking.
  • Analytics providers, which receive usage data about the site.
  • Professional advisers and authorities, where we are legally required to disclose something.
  1. INTERNATIONAL TRANSFERS

Our production partner, and some of the services above, are located outside Singapore. That means your name and delivery address are transferred abroad in order to fulfil your order. Where the law requires it, those transfers are made under appropriate safeguards such as the European Commission's standard contractual clauses.

  1. HOW LONG WE KEEP IT
  • Order and transaction records: kept for as long as required by Singapore tax and accounting law, currently five years.
  • Email correspondence: up to 24 months after the conversation ends.
  • Marketing contacts: until you unsubscribe, and then a minimal suppression record so we do not email you again by accident.
  • Analytics data: normally up to 26 months, in a form that does not identify you by name.
  1. COOKIES

Essential cookies keep the cart and the checkout working, and cannot be turned off without breaking the store. Analytics and marketing cookies are optional and are used only where you allow them. You can clear or block cookies in your browser settings; the store will still work, but the cart may behave oddly.

  1. YOUR RIGHTS

Depending on where you live, you can ask us to:

  • tell you what personal data we hold about you, and give you a copy
  • correct anything inaccurate
  • delete your data, where we are not legally required to keep it
  • restrict or object to a particular use
  • withdraw consent at any time, including for marketing
  • receive your data in a portable format

Email hello@goodmessagestudio.com and we will respond within 30 days. We may ask you to confirm the email address the order was placed with, so that we do not hand your data to somebody else.

If you are in Singapore, this policy is written in line with the Personal Data Protection Act 2012, and you may complain to the Personal Data Protection Commission. If you are in the EEA or the UK, you may complain to your local data protection authority.

  1. MARKETING

We only email marketing to people who asked for it. Every marketing email has an unsubscribe link, and unsubscribing takes effect immediately. Order confirmations, dispatch notices and replies to your questions are not marketing and will still be sent.

  1. CHILDREN

This store is not directed at children and we do not knowingly collect data from anyone under 13. If you believe a child has given us personal data, email us and we will delete it.

  1. SECURITY

The site runs over HTTPS and payment data is handled by PCI-compliant providers. No system is perfectly secure, so we do not promise absolute security, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.

  1. CHANGES

If this policy changes materially we will update the date at the top and, where the change affects how we use data you have already given us, tell you by email.

  1. CONTACT

hello@goodmessagestudio.com