Legal

Privacy Policy

Last updated: 23 June 2026

MS SO98 Beauty (“we”, “us”) operates the website msso98beauty.com (the “Service”). This page describes what personal data we collect, why we collect it, how we process it, and the rights you have over it. We aim for plain language — if anything is unclear, write to us at contact@msso98beauty.com.

1. Data we collect

Account data — email address (and, when you sign in with Google, your name and profile picture as provided by the OAuth provider).
Order data — products ordered, delivery address, phone number, order total, payment method (we never store full card numbers — card payment is processed securely by Shopify, our checkout provider).
Loyalty & preferences — points balance, wishlist, beauty advisor profile if you complete the consultation.
Technical data — IP address, browser type, pages visited, approximate location (city/country), and minimal cookies required to keep you signed in.

2. Why we collect it

To create and operate your account.
To process and deliver your orders.
To send you transactional emails (sign-in links, order confirmations).
To improve the site, prevent fraud, and meet our legal obligations.

We do not sell your data, and we do not share it with advertising networks.

3. Third-party processors

We rely on a small set of vetted providers to operate the Service:

Vercel — website hosting and content delivery.
Supabase — database (account, orders, loyalty).
Shopify — secure card payment and checkout. Your payment and order details are processed under Shopify’s own privacy and PCI-compliant security terms.
Resend — sending of transactional emails (sign-in links).
Telegram — internal order notifications to our team (recipient name, phone and delivery address are sent so we can prepare and dispatch your order).
Google — only when you choose to sign in via Google. It shares with us your email, name and profile picture per its policy.

4. How long we keep it

Account and order data are kept for as long as you keep your account active, and up to 10 years after closure where the Cambodian Commercial Code or tax law requires it for accounting. Marketing data is deleted as soon as you ask, or after 24 months of inactivity, whichever comes first.

5. Your rights

You can ask us, at any time, to:

Access a copy of the personal data we hold about you.
Correct any inaccurate information.
Delete your account and associated data (see Data Deletion).
Object to or restrict certain processing.
Receive your data in a portable format.

Send your request to contact@msso98beauty.com — we reply within 30 days.

6. Security

Data is transmitted over HTTPS, stored encrypted at rest, and access within our team is limited to what is strictly necessary. We never store passwords — sign-in is passwordless (magic link or OAuth).

7. Cookies & analytics

We use a small number of essential cookies for authentication (session token) and language/currency preference. No third-party advertising or cross-site tracking cookies are installed.

With your consent, we also use Vercel Analytics and Vercel Speed Insights to measure aggregate, anonymous usage (page views, performance) so we can improve the site. This measurement is off by default and only starts after you choose “Accept” in the consent banner. You can change your mind at any time via Cookie preferences at the bottom of any page — declining leaves every essential feature fully working.

8. Children

The Service is not intended for users under 16. We do not knowingly collect data from minors. If you believe a child has provided data, contact us and we will delete it.

9. Changes

We may update this Policy. Material changes will be announced on the site at least 14 days before they take effect.

10. Contact

MS SO98 Beauty · Phnom Penh, Cambodia · contact@msso98beauty.com