Privacy
Privacy Policy
Last updated: October 25, 2026
Need to make a request?
Read the policy, then use the data-rights route.
The Data Rights Portal starts an access, correction or deletion request and records when we have to respond by.
The policy
What we collect, and what you can ask us to do with it.
Introduction
Shoo Lab ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services, including when you sign in using Google authentication.
By using our services, you agree to the collection and use of information in accordance with this policy.
Information We Collect
Personal Information
When you create an account or use our services, we may collect the following information:
- Account Information: Name, email address, and profile picture (when signing in with Google)
- Contact Information: Phone number and address (when you provide them for order delivery or communication)
- Photos: New profile and registered-item photos you upload are stored privately and shown only to you and our team through short-lived links. Older public photo links may remain accessible to anyone who has the link, even after we copy the photo to private storage
- Order Information: Details about your orders, including item types, service preferences, and order history
- Payment Information: Payment method and transaction records (note: we do not store full credit card numbers)
Information from Google Sign-In
When you choose to sign in with Google, we receive access to your:
- Google account email address
- Name associated with your Google account
- Profile picture (if available)
We use this information solely to create and manage your Shoo Lab account. We do not access your Google contacts, emails, calendar, or any other Google services data.
Automatically Collected Information
When you visit our website, we may automatically collect:
- Device information (browser type, operating system)
- IP address and general location
- Pages visited and time spent on our site
- Referring website or source
How We Use Your Information
We use your order and message history to improve our service.
We use the information we collect to:
- Create and manage your account
- Process and fulfill your orders
- Send order updates and notifications via WhatsApp, SMS, or email
- Provide customer support and respond to inquiries
- Improve our services and user experience
- Send promotional communications (with your consent)
- Maintain our loyalty and rewards programs
- Comply with legal obligations
How We Share Your Information
We do not sell your personal information. We may share your information with:
- Service Providers: Third-party companies that help us operate our business (e.g., payment processors, Respond.io and Meta for WhatsApp messaging, hosting services)
- Franchise Partners: If you use services at a franchise location, relevant order information may be shared with that outlet
- Legal Requirements: When required by law or to protect our rights and safety
Data Security
We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
Data Retention
Base44 built-in AI: Per-customer insights derived from order and message history are limited to authorized staff and administrators. These insights are automatically deleted after 12 months from their original generation. Stored management briefs, including customer signals and evidence, are deleted 12 months after creation; this includes anonymous aggregates stored in those briefs. This retention period applies to derived insights, not the original orders, messages or other source records, which may be retained for service, legal and accounting requirements.
We retain your personal information for as long as your account is active or as needed to provide you services. We may retain certain information as required by law or for legitimate business purposes. You can request deletion of your account and personal data at any time by contacting us.
Your Rights
Under data protection laws, you have the right to:
- Right to Access: Request a copy of all personal data we hold about you
- Right to Rectification: Request correction of inaccurate information
- Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
- Right to Data Portability: Receive your data in a machine-readable format
- Right to Withdraw Consent: Opt-out of marketing communications at any time
- Right to Object: Object to processing of your data for specific purposes
- Revoke Google account access at any time through your Google Account settings
To exercise any of these rights, please visit our Data Rights Portal or contact us using the information below. We will respond to your request within 30 days.
Cookies and Tracking
We use cookies and similar tracking technologies to enhance your experience on our website. We categorize cookies as follows:
- Essential Cookies: Required for the website to function properly (always enabled)
- Analytics Cookies: Help us understand how visitors use our site (Google Analytics, Microsoft Clarity) - requires your consent
- Marketing Cookies: Used to deliver personalized promotions - requires your consent
You can manage your cookie preferences at any time through our cookie consent banner or by clearing your browser cookies and revisiting our site.
Regional Data Protection Compliance
We comply with applicable data protection laws in all regions where we operate:
Brunei - PDPA Compliance
In compliance with the Personal Data Protection Order (PDPO) of Brunei Darussalam:
- Obtaining your consent before collecting personal data
- Using your data only for purposes you have consented to
- Keeping your data accurate and up-to-date
- Protecting your data with appropriate security measures
Malaysia - PDPA Compliance
In compliance with Malaysia's Personal Data Protection Act 2010:
- Ensuring lawful and fair data processing
- Collecting data for specified and legitimate purposes
- Implementing security safeguards
- Honoring data access and correction requests
We respond to all data access, correction, and deletion requests within 30 days across all regions.
Third-Party Services
We use the following third-party services that may process your data:
- Google Analytics: Website analytics (anonymized IP)
- Microsoft Clarity: User experience analytics
- Respond.io: Our WhatsApp messaging platform. Your name, phone number and the messages we exchange pass through it
- Meta (WhatsApp and advertising): Delivers WhatsApp messages, and measures which Meta ads brought you to us
- OpenStreetMap: Shows the maps for delivery and pickup locations and turns an address into map coordinates, so the address you enter and your IP address are sent to it
- Base44 built-in AI: The AI features of the platform our app runs on process some text, such as order and enquiry notes, to help us work faster
- Google OAuth: Authentication services
Each of these services has their own privacy policies. Analytics services are only activated after you provide consent.
Children's Privacy
Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us: