Privacy notice
Version cards-privacy-2026-10-09.
Who we are
Lockette is run by PAWRUP DIGITAL ENTERPRISE (202503318426 / PG0579828-V). Contact for anything about your data: [email protected].
This website
The site sets no cookies and loads no advertising pixels. Our host Cloudflare adds two small scripts that set no cookies and store nothing on your device: Web Analytics, which sends Cloudflare the page address, the page you came from, your browser and device type and how fast the page loaded, so we can count page views and keep pages fast (legal basis: legitimate interests); and email protection, which hides our email address from spam robots. Cloudflare also processes your IP address to deliver the pages; we do not store it. We count visits only as daily totals per campaign tag in the link (utm_source, utm_medium, utm_campaign, utm_content) and country, to see which ads work. These totals hold no IP address, no device details and nothing that identifies you, and your visit is not counted if your browser sends Do Not Track or Global Privacy Control.
Early-access list
We collect: your email address, the occasions you ticked (optional), the page language, your country as seen by our host, the campaign tags in the link you arrived from (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the time and wording version of your consent.
Why: to send you one email when orders open. Legal basis: your consent (GDPR art. 6(1)(a); PDPA 2010 section 6).
Double opt-in: we first send one confirmation email. If you do not confirm, we delete your address within 30 days. Once confirmed, we keep it until six months after the launch email, then delete it. Every email has a link that deletes your address at once.
Bespoke enquiries
We collect: your name, email, occasion, the date you need it by, your budget range, your story, the page language, your country and the campaign tags.
Why: to answer your enquiry and prepare a quote (steps you asked for before a contract: GDPR art. 6(1)(b)). We keep it for 24 months, then delete it, unless it becomes an order.
When you buy a card
We collect: your email, your country, the amount and currency, payment references, the checkout boxes you ticked (with their wording version and time) and the campaign tags of the link that brought you. Card and bank details go straight to Stripe; we never see them. Why: to take payment, deliver your card and gift page, send receipts and handle refunds (legal basis: contract). We keep the order record for as long as tax law requires; if you delete your gift, we remove your email from it.
Your gift: the photo (re-encoded, with location and camera data removed), both names, your message, the memory questions and hints (answers are stored only as a keyed one-way hash), the PDF and our review record. A person on our team checks every order before delivery. A gift page lasts 12 months from delivery; its content is deleted 30 days after it ends, or at once if you choose "Delete everything".
If you choose "Bring my photo to life", Alibaba Cloud (Singapore) makes a short silent clip from your photo on our instructions, and may not use your photo to train its models. Our reviewer checks the clip before delivery.
Emails about your order: if you start checkout but do not pay, we may send you one reminder; if you pay but do not finish your gift, up to two reminders, each with a link to stop them. "My gifts" emails you a sign-in link that works once, for 15 minutes, and keeps you signed in for 7 days.
Where it is stored and who processes it
On our own server (database and backups) and with these providers, who act only on our instructions: Stripe (payments), Cloudflare (hosting, security, Web Analytics, email protection and file storage for photos and PDFs), Resend (sending emails), Alibaba Cloud Singapore (the moving photo, only if you choose it) and Meta (ad measurement, only if you say yes). Data is processed in Malaysia, Singapore, the United States and on Cloudflare's global network. We do not sell or rent your data.
Your rights
You can ask to see, correct, export or delete your data, withdraw consent at any time, and complain to a data protection authority (in Malaysia, the Personal Data Protection Commissioner). Write to [email protected]; we answer within 21 days.