Privacy policy

Who we are

The Fun FAB is a small home workshop in Singapore. We are responsible for the personal data described on this page.

Our Data Protection Officer can be reached at dpo@funfab.sg.

What we collect

Only what a given interaction actually needs.

• When you place an order — your name, email address, phone number, delivery address and any delivery notes, what you ordered, and the payment reference you enter for PayNow. If you upload a screenshot as proof of payment, we keep that image.
• When you make an account — the same contact details, any delivery addresses you save, and whether you asked to hear about new designs. There is no password: we email you a six-digit code instead, so we never hold one.
• When you send us a design — your name, email, phone, the file you upload, and the quantity, material, colour, date you need it and any notes you add.
• When you message us on WhatsApp — your phone number, your display name as WhatsApp provides it, and the contents of the conversation.
• As you browse — aggregate page analytics through Vercel Web Analytics. It sets no cookies, does not follow you to other sites, and does not build a profile of you.

Why we need it

Contact details and addresses exist so we can make your order, tell you when it is ready and get it to you. Order records exist so that you and we have the same account of what was bought, and because we are required to keep business records. Design files exist so we can quote and print them. Analytics tell us which pages people use, which is how the shop gets less confusing over time.

We do not sell personal data, and we do not use it for advertising.

Who else touches it

We keep the list of companies involved deliberately short. Each one handles data only to provide its part of the shop.

• Supabase — stores the database and runs sign-in.
• Vercel — hosts the site and provides the aggregate analytics described above.
• Google and Meta — only if you choose to sign in with Google or Facebook.
• Anthropic — if you message us on WhatsApp, the conversation is sent to Anthropic's API so a reply can be drafted. A person at the workshop reads and edits every draft before anything is sent to you; nothing is ever sent automatically.

Signing in with Google or Facebook

If you use the Google or Facebook buttons, that provider tells us your name and email address and nothing else. We never see your password for either service, and we cannot post anything or read anything else from your account there.

Your email address is the key we use to tie orders to you. That is also how an order you placed as a guest can appear in your account later: if the address matches, we attach it. If you would rather keep them separate, use a different address at checkout.

How long we keep it

Order records: retention period, 5years. Uploaded design files and payment screenshots: 5 years. WhatsApp conversations: 5 years. Account details stay until you ask us to remove them.

Your rights under Singapore's PDPA

The Personal Data Protection Act gives you rights over the data above, and places duties on us.

• Access — you can ask what personal data we hold about you, and how we have used it in the past year. Write to our Data Protection Officer and we will respond as soon as we reasonably can.
• Correction — if something we hold is wrong, tell us. We will correct it, and pass the correction on to anyone we had shared it with.
• Withdraw consent — you can withdraw consent for any use of your data at any time. Some withdrawals mean we cannot finish an order already in progress; we will tell you plainly if that is the case rather than simply going quiet.
• Marketing and Do Not Call — we email about your orders only. We do not make marketing calls or send marketing texts; if that ever changes it will be to people who opted in, and we will check the national Do Not Call registry first.
• Complaints — if you are unhappy with how we have handled your data, tell us first and we will try to put it right. If we cannot, you can raise it with the Personal Data Protection Commission at pdpc.gov.sg.

If personal data is ever exposed in a way likely to cause significant harm, we will notify the people affected and the Commission, as the law requires.

Children

We make things for children, but we sell to the adults buying for them. Accounts and orders are meant for adults, and we do not set out to collect anything from children. If you think we hold a child's details, tell us and we will remove them.

Changes

If this policy changes we will update the date at the top. If a change matters to orders already placed, we will say so directly rather than leave you to notice.