Last updated 5 August 2026
This policy explains how afterkard handles personal data, in line with Singapore's Personal Data Protection Act (PDPA).
What we collect
When you create an account: your name, email address, mobile number, and the shipping and billing addresses you save.
When you place an order: the same contact and delivery details, plus what you ordered, what you paid, and any delivery notes you add at checkout.
When you ask us to buy your cards: whatever you send us — your name, contact details, and the photos and descriptions of the cards you want to sell.
Automatically: basic technical data your browser sends with every request, such as IP address and browser type, which our hosting provider logs for security and reliability.
We do not collect anything we don't need, and we never sell your data.
Card details
Card payments are processed by Stripe. Your card number never reaches our servers and we never store it — Stripe handles it directly and tells us only whether the payment succeeded, along with the last four digits and card type so we can identify the transaction.
Why we use it
- To take, pack and deliver your order, and to contact you about it.
- To run your account — signing you in, saving your address so you needn't retype it.
- To answer your messages and quote on cards you want to sell.
- To keep records we're required to keep, such as records of sale.
- To detect and prevent fraud and abuse of the site.
We do not send marketing email unless you ask us to, and you can stop it at any time.
Who else handles it
We use a small number of service providers to run the shop. Each only receives what it needs:
- Supabase — our database and sign-in system. Your account and order records live here.
- Vercel — hosting. Serves the site and keeps request logs.
- Stripe — payments. Receives your payment and billing details directly.
- Resend — transactional email, such as sign-in links and order confirmations.
- WhatsApp (Meta) — if you message our desk, that conversation is on WhatsApp's platform and subject to their privacy terms as well as ours.
Some of these providers operate servers outside Singapore. Where data is transferred abroad, we rely on providers that offer protection comparable to the PDPA.
We'll also disclose data where the law requires it — a court order, or a valid request from a regulator or law enforcement.
Cookies and what's stored in your browser
We don't run advertising or third-party tracking cookies. What we do use:
- Sign-in cookies — set when you log in, so you stay signed in. Essential; the site can't keep you logged in without them.
- Your cart — kept in your browser's local storage on your own device, not on our servers. Clearing your browser data empties it.
- Checkout details — if you fill in the checkout form, those details are saved on your device so you don't lose them if you navigate away. They reach us only when you place an order.
How long we keep it
- Account data — for as long as your account is open, and then removed once you ask us to close it.
- Order records — kept as long as the law requires us to keep records of sale, even after an account is closed.
- Buy-back enquiries — kept while we're dealing with the enquiry and for a reasonable period afterwards, then deleted.
Keeping it safe
Traffic to the site is encrypted in transit. Access to the database is restricted by row-level rules, so a signed-in customer can only read and change their own record. Administrative access is limited to accounts that need it.
No system is perfectly secure. If a breach ever affects your data in a way likely to cause you significant harm, we'll notify you and the PDPC as the PDPA requires.
Your rights
Under the PDPA you can ask us to:
- Tell you what personal data we hold about you, and how we've used it.
- Correct anything that's wrong — you can edit most of it yourself on your account page.
- Delete your data and close your account, subject to records we must keep.
- Withdraw consent to any use of your data that isn't needed to complete an order.
Message us and we'll deal with it. We aim to respond within 30 days. If you're not satisfied with how we've handled a request, you can complain to Singapore's Personal Data Protection Commission.
Children
The shop isn't aimed at children, and we don't knowingly collect data from anyone under 13. If you believe a child has given us personal data, tell us and we'll delete it.
Changes to this policy
If we change how we handle personal data, we'll update this page and the date at the top. If a change is significant, we'll tell account holders directly.
Contact
Questions about your data, or want a copy of what we hold? Message the desk on WhatsApp.
Ask about your data
Access, correction or deletion — message the desk and we'll sort it out.