Privacy policy.

1. Who we are

Cozy ("we", "us", "our") is a baby care products brand operating in the Kingdom of Cambodia. We sell diapers, baby wipes, and skin-care products through this website. Our contact email is hello@cozy.com.kh.

2. What data we collect

When you place an order or contact us, we collect the information you provide:

• Identity data — your full name and, if applicable, the gift recipient's name.
• Contact data — phone number and email address.
• Delivery data — city, street address, and the GPS coordinates you pin on the delivery map.
• Order data — products, quantities, pricing, payment method, and any delivery notes or gift message you provide.

We do not collect payment card details. Cash-on-delivery payments are handled in person. ABA PayWay online payments are processed directly by ABA Bank — we receive only a transaction confirmation, not your card number.

3. How we use your data

• Order fulfilment — to process, pack, and deliver your order and to contact you if there is a problem.
• Customer service — to respond to enquiries, returns, or complaints.
• Order history — to allow you to track and manage past orders on the "Manage order" page.
• Legal compliance — to retain records as required by Cambodian law.

We do not sell or rent your data to third parties. We do not use your data for targeted advertising.

4. Who we share data with

We share your data only where necessary to operate our business:

• Supabase — our database and back-end infrastructure provider. Order data is stored on Supabase servers. Supabase processes data under its own privacy policy and uses industry-standard encryption at rest and in transit.
• MapTiler— provides the map tiles displayed on the delivery pin picker. When you use the map, MapTiler's servers serve the map imagery. No personal data is sent to MapTiler.
• ABA Bank / PayWay— if you choose online payment, you will be redirected to ABA Bank's secure payment page. We receive only the transaction result; ABA Bank handles all card data under their own privacy policy.
• Delivery partners — our fulfilment team receives your name, phone, and delivery address to complete delivery.

5. Cookies and tracking

This website uses only essential, functional cookies — for example, to remember your cart contents between pages. We do not use analytics cookies (Google Analytics, Facebook Pixel, or similar) and we do not track you across other websites.

6. Data retention

Order records are retained for two years from the date of purchase for accounting and customer-service purposes. After that period, personal identifiers are deleted or anonymised.

7. Your rights

You may at any time:

• Request a copy of the personal data we hold about you.
• Ask us to correct inaccurate information.
• Ask us to delete your data (subject to our legal record-keeping obligations).

To exercise any of these rights, email us at hello@cozy.com.kh with the subject line "Data request". We will respond within 14 days.

8. Security

All data is transmitted over HTTPS. Order data in our database is encrypted at rest. Access to the database is restricted to authorised team members only. While we take reasonable precautions, no system is completely secure — if you believe your data has been compromised, please contact us immediately.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the website after a change constitutes acceptance of the revised policy.

10. Contact

For any privacy questions or requests, please contact us at hello@cozy.com.kh. This policy is governed by the laws of the Kingdom of Cambodia.