Privacy Policy

1. Introduction

At Free's, we value your privacy as much as we value visionary design. This Privacy Policy outlines how we collect, use, protect, and handle your Personally Identifiable Information (PII) when you visit our website, register for an account (including via Google OAuth), or make a purchase.

2. Information We Collect

We collect information from you when you register on our site, place an order, subscribe to a newsletter, or enter information on our site. This includes:

• Account Information: Name, email address, and profile picture (especially when utilizing Google OAuth for login).
• Order Information: Shipping address, billing address, and contact details necessary for fulfillment.
• Technical Logs: Server access logs (IP address, browser user-agent, timestamp, requested page) and the cookies needed to keep you logged in and to remember your cart. We do not install Google Analytics, ad pixels, or any third-party behavioral tracking tools. Other than the necessary server logs and session cookies, we do not build cross-site browsing footprints.

* Note: We do not store your credit card information on our servers. All payment processing is handled by secure, compliant third-party payment gateways.

3. How We Use Your Information

We may use the information we collect in the following ways:

• To personalize your experience and deliver product offerings aligned with your aesthetic preferences.
• To quickly process your transactions and manage order fulfillment.
• To manage your account, including authenticating your identity via Google OAuth.
• To send periodic emails regarding your order or other products and services.

4. How We Protect Your Information

Passwords are stored as salted hashes, never in plain text, and card numbers never touch our servers (see section 2). Traffic to the site is served over HTTPS.

Who can see your data internally, stated plainly: our back office is protected by a single staff-account check, which means every account we mark as staff can currently view all orders and all customer contact details. Currently, our back office uses a single-tier permissions system. Everyone with access can see all orders and customer data. We mitigate this by only granting access to those who strictly need it, and by logging all actions into an audit log.

We would rather tell you this than imply an access-control model we have not built yet. We will update this page when role-based access control is introduced.

5. Third-Party Disclosure

We do not sell or trade your Personally Identifiable Information. We do share the minimum necessary data with the service providers that make the shop work:

• Payment service providers (Taiwanese gateways such as ECPay / NewebPay) - to take payment and to process refunds. Payment pages are handled by payment gateways, card numbers do not pass through our servers.
• Cloud hosting and storage (AWS - servers, database, media files and CDN) - where the site and its images run.
• Google - only if you choose to sign in with Google OAuth.
• Email delivery - to send order, production and shipping notifications to you.
• Delivery carriers - your name, address and phone number, so the parcel can reach you.

We may also disclose information where we are legally required to do so.

6. Your Rights and How Long We Keep Data

Under the Personal Data Protection Act, you have the right to inquire, review, request a copy of, supplement, correct, cease collection/processing/use, and delete your personal data held by us.

There is currently no self-service account deletion button - please email [email protected], and we will process your request manually. Google OAuth authorization can be revoked directly in your Google account settings.

Order and transaction records are kept for as long as Taiwanese tax and accounting law requires (accounting vouchers: at least 5 years under Article 38 of the Business Entity Accounting Act), even after an account is closed. After account closure, order and transaction records will still be kept for the statutory period, and other personal data will be deleted or anonymized.

7. Contacting Us

If there are any questions regarding this privacy policy, email us at [email protected] or use our Customer Care page.