Privacy Policy

Thank you for your interest in DevinArt Craft ("DevinArt," "we," "our," or "us"). DevinArt operates an international B2B wholesale platform for American Indian style handcraft items produced in Bali, accessible via devinart-craft.com (the "Site") and associated wholesale quotation and customer portal services (collectively, the "Service").

This Privacy Notice explains how information that directly identifies you or makes you identifiable ("personal information") is collected, processed, and safeguarded when you access our craft catalog, register a buyer account, request quotations, or authenticate using social login providers.

1. Data Controller#

DevinArt Craft acts as the data controller for personal information collected through the Site and Service. We determine the purposes and means of processing personal data in accordance with the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).

2. Personal Information We Collect#

We collect only the minimum information necessary to authenticate legitimate commercial wholesale buyers and prepare international export consignments:

• Account and Contact Details: Full name, verified business email address, company or studio name, business type, destination country, city, and telephone or WhatsApp contact number.
• Social Authentication Credentials (OAuth): When you sign in using Google or Facebook (Meta), we receive basic profile identity attributes (name, verified email, and provider subject ID). We do not request, access, or store your friends lists, feed updates, or private messages.
• Wholesale Inquiries and Custom Commissions: Requested product stock-keeping units (SKUs), target quantities, desired price points, bespoke carving specifications, reference dimensions, and pro-forma invoice history.
• Technical Telemetry: Anonymized performance benchmarks collected via Vercel Speed Insights to monitor Core Web Vitals (Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift). Telemetry operates without persistent personal identifiers.

3. How We Use Personal Information#

We use collected personal information for the following specific commercial purposes:

• To generate official B2B wholesale quotations, calculate export shipping freight, and issue Pro-Forma Invoices.
• To communicate directly regarding production lead times, artisan carving stages, and container dispatch.
• To authenticate buyer sessions, protect private order records, and enforce access controls.
• To prevent automated scraping, fraudulent quotation requests, and platform abuse.

We never sell, rent, monetize, or disclose your personal information or business order history to third-party advertising networks or commercial data brokers.

4. Cookie and Local Storage Policy#

Cookies and local storage keys are small text files placed on your computer or mobile device when accessing our Service. We prioritize privacy by limiting our use strictly to essential session cookies and client-side functional preferences:

We do not use third-party advertising cookies, retargeting pixels, or behavioral tracking scripts. You can instruct your browser to reject all cookies, though essential session features like order list submission may be disabled as a result.

5. Third-Party Infrastructure Subprocessors#

We rely on enterprise cloud infrastructure providers adhering to stringent global security standards:

• Supabase Inc. (United States / Singapore): Cloud-hosted encrypted PostgreSQL database, row-level security management, and authentication token issuance.
• Cloudflare Inc. (United States / Global Anycast): Content delivery network, SSL encryption termination, and R2 object storage for product imagery.
• Vercel Inc. (United States / Global Edge): Serverless application compute hosting and privacy-compliant performance analytics.

6. User Rights and Data Deletion (Meta Platform Compliance)#

In compliance with the Meta Platform Data Policy and GDPR Article 17 ("Right to Erasure"), users retain the unqualified right to delete their account and request permanent erasure of all personal data held by DevinArt Craft.

You can exercise this right through three distinct channels:

1. In-App Self-Serve Deletion (Instant): Log in to your wholesale account and visit your Buyer Profile. In the "Account Deletion & Data Erasure" section, click Delete Account, type DELETE, and confirm. This triggers an immediate database cascade removing your buyer record, quote records, and Supabase auth.users entry.
2. Facebook Settings Disconnect: In your Facebook account, navigate to Settings & Privacy > Settings > Apps and Websites, select DevinArt Craft, and click Remove. Facebook automatically sends a deletion ping to our webhook endpoint at /api/auth/facebook-data-deletion.
3. Written Request: Email our privacy team at contact@devinart-craft.com with your registered email address. Requests are verified and completed within 24 business hours.

Email Reusability: When an account is deleted, the corresponding email address is completely purged from all authentication tables. You are free to register a new account using the same email at any time.

For detailed instructions and tracking status, visit our dedicated User Data Deletion Instructions page.

7. Data Retention#

We retain personal information only for as long as your wholesale account remains active or as required to fulfill commercial pro-forma orders, resolve disputes, and comply with statutory Indonesian accounting and export export regulations. When no longer required, data is permanently erased or irreversibly anonymized.

8. Contact Us#

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact our administrative desk: