Privacy Policy

Written against what this site actually does, not against a template.

Checked against

src/lib/cart/index.ts
src/app/api/newsletter/route.ts
src/app/api/corporate-enquiry/route.ts
src/app/api/checkout-intent/route.ts
src/lib/server/store.ts

This page was written from the code that performs the behaviour, not from a template.

What is stored

These four things are the whole list. Nothing else about you is written down.

Your cart: Cart contents are kept in your browser's local storage so the basket survives a reload. It is not sent to us until you act on it.
Your language choice: One cookie remembers whether you read the site in English or Bahasa Melayu.
Newsletter sign-ups: Your email address, the timestamp and proof that you ticked the consent box. Nothing else, and no consent means no record is written.
Enquiries: What you type into the corporate enquiry form: company, contact person, email, phone, quantity, preference, budget, destination, date, personalisation notes and additional notes. An attached logo filename is recorded as text; the file itself is deliberately not retained.

What is not stored

An empty set is a legitimate answer. This list matters as much as the one above.

No payment card data, because no payment provider is connected.
No advertising or behavioural tracking scripts.
No product reviews, ratings or purchase counts, because none exist yet.

Where it lives

This preview runs in a managed development environment. Records are held in the project's own store and remain under the owner's control; the deployment target for the live site is still to be confirmed.

In concrete terms: each submission is appended as one JSON line to a small file inside the project's own data directory. That file is not committed to source control and does not survive a container rebuild, so the owner taking periodic backups is part of the operation rather than an assumption. Phase B replaces the files with a database.

Your requests

Ask for a copy or deletion of anything held against your email address and it will be done by hand if no tooling exists yet. Malaysia's Personal Data Protection Act framework will be reflected in the final published version.

The address published here (hello@sarawakproduct.com) has not been confirmed by the owner yet, so use the corporate enquiry form for anything urgent until it is.

Stores

localStorage · sp_cart_v1: Your cart lines — product slug, variant id and quantity, or a gift-box configuration including the message and recipient/sender names. It stays in your browser until you submit checkout.
localStorage · sp_dev_notice_dismissed_v1: A single flag recording that you dismissed the development-preview notice. No personal information.
cookie · sp_locale: The only cookie this site sets: “en” or “ms”, path=/, SameSite=Lax, for one year, so the next page arrives in the language you chose.
POST /api/newsletter: The email address (lower-cased), proof of consent plus the exact wording version you agreed to, the language, a reference and a timestamp. Without the consent tick, nothing is written. No confirmation email goes out yet, so the record is stored as unconfirmed — there is no email provider connected.
POST /api/corporate-enquiry: The twelve form fields: company, contact person, email, phone, quantity, product preference, budget, destination, required date, personalisation, notes and the logo. From the logo file only its name, size and MIME type are kept — the file bytes are deliberately not persisted. Plus a reference, the CRM stage “new”, the language and the page it was sent from.
POST /api/checkout-intent: Name, email, phone, delivery address, notes, destination zone, the cart lines re-resolved on the server, the money, and `payment.status: “not-attempted”` — no payment was attempted and no order number was issued. The user-agent and Accept-Language headers are stored truncated, for abuse triage only.

Does not store

Payment card numbers
None exist. No payment provider is connected, so there is no card field to fill in.
Analytics and advertising pixels
No third-party tracking script is loaded, there is no `next/script`, and the page makes no request to an external analytics or media host.
IP addresses or device fingerprints
The application code does not read a client address and sets no fingerprint. The hosting layer may keep its own access logs; that belongs to the platform, not to this page.
Reviews, ratings and sales counts
Nothing is collected, because no purchase has happened. The data layer actively rejects those fields at build time.

Field by field

Open it when you want it. Nothing below is hidden, it is simply long.

What an enquiry submission keeps

Required: company, contact person, email, phone, quantity and destination. Optional: product preference, budget, required date, personalisation, logo file and additional notes.

Values are stripped of angle brackets and cut to a field limit before being written, so a record cannot later be replayed as markup in an admin view.

The logo file is not uploaded anywhere. Its name, size and MIME type are recorded so the requirement survives to Phase B, and the response says exactly that rather than implying a successful upload.

What a checkout submission keeps

Prices are recomputed on the server from the catalogue; the browser's figures are not trusted. The record carries `payment.status: “not-attempted”` and the reason for it, because no gateway exists yet.

No order number is issued, because nothing was sold. The reference shown is a record marker, not a receipt.

Status

This text describes current behaviour accurately, but it has not been reviewed by the owner or by legal counsel and is not yet the published policy of a trading business.

Changes

Material changes will be dated here when the policy is adopted.

A change to the code that stores your data is a change to this page; it will be dated when the owner adopts this document.