Privacy Policy

Lunababy Privacy Policy

Last updated: 8 May 2026

Lunababy (“we”, “us”, “our”) respects your privacy. This policy explains what personal data we collect, why we collect it, who we share it with, and how you can exercise your rights under the Malaysian Personal Data Protection Act 2010 (PDPA).

1. Data we collect

  • Order & account data: name, shipping address, email, phone number, order history.
  • Payment data: handled by our PSPs (Stripe, HitPay, ToyyibPay, marketplace gateways). We do not store full card numbers.
  • Browsing data: pages viewed, interactions, device/browser info — collected via cookies, Meta Pixel, and similar analytics tools to improve the site and measure ad performance.
  • Communications: messages you send via WhatsApp, email, or our contact form.

2. Why we use your data

  • To process and fulfil your orders, including shipping and customer service.
  • To communicate with you about your orders, returns, and (where you’ve consented) marketing.
  • To measure the effectiveness of our advertising via Meta (Facebook/Instagram) Pixel and Conversions API, Google Analytics, and similar tools.
  • To detect and prevent fraud, abuse, and security incidents.
  • To comply with legal and tax obligations.

3. Who we share data with

  • Marketplaces: Shopee, Lazada, TikTok Shop — for orders placed on those platforms.
  • Payment processors: Stripe, HitPay, ToyyibPay, and marketplace gateways for payment authorisation.
  • Shipping partners: J&T, Ninja Van, GDEX, Pos Laju, and similar couriers we use to deliver your orders.
  • Advertising platforms: Meta (Facebook/Instagram), Google, TikTok — to measure ad performance and serve relevant ads.
  • Service providers: hosting (Hostinger), email (Gmail/Workspace), analytics (PostHog, Sentry).
  • Authorities: when required by Malaysian law.

We do not sell your personal data.

4. Data retention

Order records are retained for at least 7 years to meet Malaysian tax and accounting requirements. Marketing data is retained until you opt out. Other data is retained only as long as needed for the purpose collected.

5. Your rights

Under PDPA 2010, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate personal data.
  • Withdraw consent for marketing communications at any time.
  • Request deletion of your account and personal data (see Data Deletion).

6. Cookies & tracking

We use cookies for site functionality, analytics, and advertising. You can control cookies through your browser settings; disabling them may affect site functionality.

7. Contact

For privacy questions or to exercise your rights, contact us:

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to active customers or a banner on the homepage.