Privacy Policy

We collect personal data that you give us directly, and a small amount collected automatically:

• Account information - your name, email address, and a securely hashed password (we never store your password in plain text).
• Contact and shipping details - phone number and shipping address(es) you save to your account or enter at checkout.
• Order and payment information - your order history, items purchased, amounts paid, and the payment-proof screenshots you upload to confirm a bank or InstaPay transfer (these may show details like your bank/e-wallet name, reference number, and the last few digits of an account number).
• Wishlist and browsing activity - items you save to your wishlist and, for security purposes, basic request metadata (like IP address) used to prevent abuse of account-security features such as password resets.
• Social sign-in information - if you choose to sign in with Google or Facebook, we receive your name, email address, and profile photo from that provider.

We use your personal data only for purposes connected to operating this shop, specifically to:

• Create and manage your account, and let you log in securely.
• Process, fulfill, and ship your orders and pre-orders.
• Verify manual payments (bank transfer or InstaPay QR) against the proof you upload.
• Send transactional emails - order/payment updates, email verification, and password-reset links.
• Respond to customer support requests and handle refund requests.
• Detect and prevent fraud, abuse, and unauthorized account access.
• Comply with tax, accounting, and other legal record-keeping obligations.

We do not use your personal data for third-party advertising, and we do not sell your personal data to anyone.

We process your data on the basis of your consent (given when you register, or, for social sign-in, by continuing through Google/Facebook after seeing our Terms and this Policy), because it's necessary to perform our contract with you (fulfilling an order you placed), and, where relevant, our legitimate interest in keeping this store secure and functioning, or a legal obligation we're subject to.

We disclose personal data only where necessary to run the shop, specifically to:

• Couriers/logistics partners, to deliver your order (name, phone, and shipping address only).
• Our email delivery provider (Resend), solely to send you the transactional emails listed above.
• Our hosting provider (Railway), which stores the database and uploaded files on our behalf.
• Google or Facebook, only if and when you choose to sign in with one of those providers.
• Government authorities, if required by law, regulation, or a valid legal order.

Each of the above only receives the minimum data needed for that specific purpose.

• Passwords are hashed (bcrypt) - we cannot see or recover your actual password, ever.
• Email-verification and password-reset links use single-use, expiring, unguessable tokens.
• Payment-proof images are stored privately and only accessible to you and our admin staff.
• The admin dashboard is restricted to authorized staff accounts only.
• Data is transmitted over HTTPS.

We keep your account and order data for as long as your account is active, and afterward for as long as needed to meet our legal, tax, and accounting record-keeping obligations. If you ask us to delete your account, we will do so, except that we retain records tied to any order you've placed (as required by law) rather than delete them outright.

Under the Data Privacy Act, you have the right to:

• Be informed that your personal data will be, is being, or has been processed (this policy).
• Access your personal data that we hold about you.
• Object to or withdraw consent for processing, subject to legal or contractual restrictions.
• Correct any inaccurate or outdated personal data.
• Erase or block your personal data, subject to our legal retention obligations above.
• Data portability - receive a copy of your data in an electronic format.
• Be indemnified for damages from unlawful processing of your personal data.
• File a complaint with the National Privacy Commission.

To exercise any of these rights, contact us using the details below - we'll verify your identity and respond within a reasonable time.

We use one essential session cookie to keep you logged in. We do not use third-party advertising or tracking cookies.

This site is intended for users who are at least 18 years old, or who have a parent or guardian's permission and supervision to make a purchase. We do not knowingly collect personal data directly from children without such consent.

We may update this Privacy Policy from time to time. Material changes will update the effective date above, and your account keeps a record of the version you originally agreed to.

For any questions about this policy, or to exercise your data privacy rights, contact our Data Protection Officer at dokiescollectibles@gmail.com.