Privacy policy
Last updated: 4 September 2026
Good Message Studio ("we", "us", "our") runs this online store. This policy explains what personal data we collect, why, who else sees it, and what you can ask us to do about it. We also handle our Singapore customers' information in strict compliance with the Singapore Personal Data Protection Act (PDPA) and similar international regulations.
Contact for anything in this policy: hello@goodmessagestudio.com
WHAT WE COLLECT
- When you place an order: your name, email address, shipping address (and billing address, if different), order contents, order history, and confirmation that payment succeeded (along with the last four digits and card brand). We never receive or store your full card number, expiry date, or security code. Those go directly to the payment provider.
- When you browse the site: device and browser type, operating system, language, your IP address (and approximate region derived from it), pages viewed, referring site, and how you moved through the store. This is collected through cookies and similar technologies.
- When you contact us: your email address and whatever you choose to put in the message.
- When you subscribe to emails: your email address, and whether you opened or clicked.
We do not ask for, and do not want, your date of birth, your identity document number, or any special category/sensitive data.
WHY WE USE IT
- To take, pack, ship, and track your order, and to talk to you about it.
- To process refunds and statutory remedies.
- To answer your emails and provide customer support.
- To detect and prevent fraudulent orders and chargebacks.
- To understand, in aggregate, which pages and products people look at, so we can improve the store.
- To send marketing emails, but only if you explicitly asked for them.
- To meet our legal and tax obligations.
Our legal grounds, where the GDPR, PDPA, or a similar law applies to you: performance of the contract (orders and delivery), legitimate interests (fraud prevention, security, basic analytics), consent (marketing emails and non-essential cookies), and legal obligation (accounting records).
WHO ELSE SEES IT
We do not sell your personal data, and we do not share it for anyone else's marketing. We share the minimum necessary with:
We do not sell your personal data, and we do not share it for anyone else's marketing. We share the minimum necessary with:
- Shopify Inc., which hosts this store and processes orders on our behalf.
- Payment providers (including Shopify Payments, PayPal, and the wallet providers shown at checkout), which process the payment itself.
- Our production and fulfilment partner, which receives your name, address, and order contents in order to make up and dispatch your parcel.
- Shipping carriers, which receive your name, address, and contact email to deliver the parcel and provide tracking.
- Analytics providers, which receive usage data about the site.
- Professional advisers and authorities, where we are legally required to disclose something.
INTERNATIONAL TRANSFERS
Our production partner, and some of the services above, are located abroad. That means your name and delivery address are transferred abroad in order to fulfil your order. Where the law requires it, those transfers are made under appropriate safeguards such as the European Commission's standard contractual clauses or equivalent cross-border transfer agreements.
Our production partner, and some of the services above, are located abroad. That means your name and delivery address are transferred abroad in order to fulfil your order. Where the law requires it, those transfers are made under appropriate safeguards such as the European Commission's standard contractual clauses or equivalent cross-border transfer agreements.
HOW LONG WE KEEP IT
- Order and transaction records: kept for as long as the applicable tax and accounting law requires, normally five years.
- Email correspondence: up to 24 months after the conversation ends.
- Marketing contacts: until you unsubscribe, and then a minimal suppression record so we do not email you again by accident.
- Analytics data: normally up to 26 months, in a form that does not identify you by name.
COOKIES
We use cookies that are strictly necessary for the store to work (keeping the cart and checkout active), and they cannot be turned off without breaking the store. Analytics and marketing cookies are optional and are used only where you allow them. You can clear or block cookies in your browser settings.
We use cookies that are strictly necessary for the store to work (keeping the cart and checkout active), and they cannot be turned off without breaking the store. Analytics and marketing cookies are optional and are used only where you allow them. You can clear or block cookies in your browser settings.
YOUR RIGHTS
Depending on where you live (including Singapore and the EEA), you can ask us to:
Depending on where you live (including Singapore and the EEA), you can ask us to:
- Tell you what personal data we hold about you, and give you a copy.
- Correct anything inaccurate.
- Delete your data, where we are not legally required to keep it.
- Restrict or object to a particular use.
- Withdraw consent at any time, including for marketing.
- Receive your data in a portable format.
Email hello@goodmessagestudio.com and we will respond within 30 days. We may ask you to confirm the email address the order was placed with so that we do not hand your data to somebody else. You may also complain to the relevant data protection authority where you live (such as the PDPC in Singapore).
MARKETING
We only email marketing to people who asked for it. Every marketing email has an unsubscribe link, and unsubscribing takes effect immediately. Order confirmations, dispatch notices, and replies to your questions are not marketing and will still be sent.
We only email marketing to people who asked for it. Every marketing email has an unsubscribe link, and unsubscribing takes effect immediately. Order confirmations, dispatch notices, and replies to your questions are not marketing and will still be sent.
CHILDREN
This store is not directed at children and we do not knowingly collect data from anyone under 13. If you believe a child has given us personal data, email us and we will delete it.
This store is not directed at children and we do not knowingly collect data from anyone under 13. If you believe a child has given us personal data, email us and we will delete it.
SECURITY
The site runs over encrypted connections (HTTPS) and payment data is handled by PCI-compliant providers. No system is perfectly secure, so we do not promise absolute security, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.
The site runs over encrypted connections (HTTPS) and payment data is handled by PCI-compliant providers. No system is perfectly secure, so we do not promise absolute security, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.
CHANGES
If this policy changes materially we will update the date at the top and, where the change affects how we use data you have already given us, tell you by email.
If this policy changes materially we will update the date at the top and, where the change affects how we use data you have already given us, tell you by email.
CONTACT: hello@goodmessagestudio.com