Privacy Policy

1. Two roles: HaanLao and the store

HaanLao decides how the data of merchants and their staff (accounts, subscriptions, platform payments) is used: for that data HaanLao is the data controller.

Each store decides how the data of its own customers (names, phone numbers, delivery addresses, orders, payment slips, customer accounts) is used: for that data the store is the data controller and HaanLao processes it only on the store's behalf, to run the store. If you bought from a store, contact that store first about your data; its name and contact details are shown on its pages.

2. Data we collect

• Merchant and staff accounts: name, email, phone number, store name and address, password (stored only as a one-way hash), roles and sign-in history.
• Subscriptions and platform payments: plan, billing dates, payment records and proofs of payment sent to HaanLao.
• Store data processed for merchants: products, orders, customer names, phone numbers, delivery addresses, payment slips and messages related to orders.
• Technical data: IP address, browser and device information, time of requests and security logs, used to run and protect the Service.
• Cookies: necessary cookies only, to keep you signed in, protect forms against forgery and remember settings. We do not use advertising cookies.

3. Why we use it

• To provide the Service: create and run stores, process orders and show stores to the public.
• To manage accounts, subscriptions and payments, and to provide support.
• To keep the Service secure: prevent fraud and abuse, limit sign-in attempts, investigate incidents.
• To meet legal obligations and answer lawful requests from competent authorities.
• To improve the Service, using aggregated data that does not identify individuals.

We do not sell personal data, and we do not use stores' customer data for our own marketing.

4. Who we share it with

• The store concerned: a store sees the data of its own customers and orders, never another store's.
• Service providers that host and deliver the Service on our behalf, under confidentiality obligations: cloud servers and database (DigitalOcean), file storage (DigitalOcean Spaces) and network and security services (Cloudflare).
• Competent authorities, when the law requires it.
• A buyer or successor of HaanLao's business, under the same protections.

5. Where the data is stored

The Service runs on servers in Singapore, and traffic passes through Cloudflare's global network. Personal data may therefore be stored or processed outside the Lao PDR. We choose providers with strong security practices and use them only to provide the Service.

6. How we protect it

• Encrypted connections (HTTPS) for all traffic.
• Passwords stored only as strong one-way hashes; sign-in attempts limited.
• Each store's data separated from other stores' data.
• Payment slips kept in private storage and shown only through short-lived links to authorised staff.
• Access to production systems limited to authorised HaanLao staff, with two-step sign-in and audit logs.

No system is perfectly secure. If a security incident affects personal data, we will act to contain it and inform the affected stores and, where required, the authorities.

7. How long we keep it

We keep personal data while the account or store is active. After a store is closed, its data may be exported for 30 days and is then deleted, except where the law requires us to keep it (for example payment records) and copies that remain in backups until they expire. Security logs are kept for a limited period.

8. Your rights

Subject to the law, you may ask to see, correct or delete your personal data, or object to its use. Merchants can view and correct most of their data in the admin panel. Customers of a store should contact that store, which can act on the request; HaanLao will help the store do so.

9. Children

The Service is for businesses. Merchant accounts are for people aged 18 or over.

10. Changes and contact

We may update this policy and will publish the new version here with its date; we will tell merchants about substantive changes. Questions or requests: contact HaanLao through the contact channels listed on haanlao.com.