Privacy Policy

For the purposes of the Mauritius Data Protection Act 2017 (Act No. 20 of 2017), the Data Controller responsible for your personal data is TheCrazyLab (Kenfragrance), operating in the Republic of Mauritius via thecrazylabperfumes.com.

Questions, access requests, or privacy inquiries can be sent directly to the owner via WhatsApp at +230 5827 1125.

You can browse the storefront without creating an account. We collect personal data only when you open the checkout drawer and place an order or contact us on WhatsApp:

• Identity & contact details: Your full name, your WhatsApp / mobile phone number (normalized to the Mauritian country code 230 where applicable), and your email address.
• Delivery details: Your chosen fulfilment method (delivery or pick-up in person). We request and store a delivery address only when you select a delivery option that requires an address; pick-up orders do not store an address.
• Order & payment verification data: Your order reference (TCL-XXXX), quantity, optional discount code, total in Mauritian Rupees (Rs), and the payment proof you provide in Step 3 of checkout—either your bank FT reference number, an uploaded payment screenshot, or a screenshot sent via WhatsApp.
• Anti-abuse & security signals: A single-use Cloudflare Turnstile verification token and a one-way cryptographic hash (HMAC-SHA256) of your IP address and phone number to prevent automated spam. We do not store raw visitor IP addresses in our database.

Under the Mauritius Data Protection Act 2017, we process your personal data on the following lawful bases:

To protect your data we implement technical and organizational measures built directly into our checkout pipeline:

• Application-layer AES-256-GCM encryption: Before an order is saved, your phone number, email address, and delivery address are encrypted in server memory using AES-256-GCM with a unique 96-bit initialization vector (IV) and column-bound Additional Authenticated Data (AAD). The database stores only ciphertext.
• Keyed HMAC-SHA256 lookup hashes: To link repeat orders to your customer profile and enforce rate limits (maximum 5 orders per hour per phone number and 15 orders per 10 minutes per IP) without exposing plaintext contact data, we compute a one-way HMAC-SHA256 digest using a separate server-side secret.
• Payment screenshot sanitization: When you attach a payment screenshot at checkout, your browser downscales large images before upload, and our server verifies the file signature, re-encodes the image into WebP format (maximum 1600 px), and strips all embedded EXIF, camera, and GPS location metadata.
• Private storage with short-lived signed URLs: Sanitized payment screenshots are stored in a non-public storage bucket. They can only be viewed by authenticated shop administrators via temporary signed links that expire automatically after 5 minutes.
• Role-restricted database access: All customer, order, and inventory tables sit behind PostgreSQL Row-Level Security (RLS) with anonymous and public table privileges revoked. Every administrative action is recorded in an append-only audit log.

We never sell, rent, or trade your personal data. Because our cloud infrastructure operates outside Mauritius, encrypted data and order metadata are processed through the following infrastructure partners:

• Supabase: Hosts our PostgreSQL database (storing AES-256-GCM encrypted contact fields and order records) and private object storage for payment screenshots.
• Vercel: Hosts our Next.js web application, executes server-side encryption, and provides privacy-friendly aggregate Web Analytics.
• Cloudflare Turnstile: Verifies that checkout submissions come from a human buyer without using invasive tracking cookies.
• WhatsApp (Meta): Used by the shop owner to confirm your order, share delivery or pick-up timing, and receive payment screenshots if you choose the WhatsApp fallback option.

We keep client-side storage minimal and strictly functional:

• Checkout recovery (sessionStorage): While you are filling in the checkout drawer, your current step, form inputs, and price quote are saved in your browser's sessionStorage under tcl-checkout-*. This ensures that if you switch to the your banking app to make your transfer and your phone reloads the browser tab, you do not lose your order number or form details. This data stays on your device, is wiped automatically the moment your order is submitted, and disappears when you close the browser tab.
• Storefront analytics: We use Vercel Web Analytics (/_vercel/insights) to measure aggregate page views and device performance without setting advertising cookies or tracking you across other websites.

• Unpaid orders (48-hour automatic expiry): Website orders left in Pending Payment without an uploaded payment screenshot are automatically cancelled after 48 hours so reserved bottles return to stock.
• Payment proof screenshots: Stored in our private verification bucket for order reconciliation and used only to verify your payment and resolve any payment dispute.
• Completed order records: Kept for as long as needed to meet our accounting, tax, and legal record-keeping obligations.

Under the Mauritius Data Protection Act 2017, you have the right to:

• Request access to the personal data we hold about you and receive a copy free of charge.
• Request rectification of any inaccurate or incomplete contact or delivery details.
• Request erasure of personal data that is no longer required for the purpose for which it was collected (subject to statutory tax and accounting retention obligations).
• Request restriction of processing or object to processing carried out on the basis of legitimate interests.