What we know about you.

• Account: your name and email address.
• Orders: recipient name, phone number, delivery address, the items you bought, and the order total.
• Payments: the payment slip image you upload and any reference number on it.
• Support: whatever you write in the contact form, plus the email address you send it from.
• Technical: a cart session cookie, a sign-in cookie, and the server logs your request creates.

We never see or store card numbers - there is no card gateway on this site.

• To take payment, pack your order, and get it delivered.
• To answer your messages and handle returns or warranty claims.
• To keep your cart, addresses and order history available when you sign back in.
• To spot fraud and abuse, and to keep the shop running.

We do not use your details for advertising, and we do not build profiles on you.

• The courier delivering your parcel - name, phone number and address only.
• Google, if you choose to sign in with a Google account.
• Cloudflare, which stores product photos and payment slips. Slips sit in a private bucket that only the site can read.
• Our email provider, which sends order and account emails on our behalf.
• Government authorities, where the law requires it.

Order alerts to the shop owner go through a Telegram bot. Those messages contain an order reference, not your full address.

Order records stay while the account exists, and afterwards only for as long as tax and accounting rules require. Payment slips are kept while a claim or refund is still possible. Contact messages are cleared once the question is closed.

• Passwords are stored as bcrypt hashes, never as text.
• The site is served over HTTPS with strict transport security.
• Payment slips are held in a private bucket and streamed only to signed-in owners of the order.
• Admin screens are limited to shop staff accounts.

The site sets two cookies, both strictly necessary: one keeps your cart attached to your browser for 30 days, the other keeps you signed in until you sign out. Your browser also holds a little local storage for the guest cart and wishlist.

There is no Google Analytics, no advertising or retargeting pixel, and no cross-site tracking - which is why you are not asked to click through a consent banner. Any browser can clear cookies for a single site from its privacy settings.

• Ask for a copy of what we hold about you.
• Correct anything wrong - addresses and account details are editable in your account.
• Ask us to delete your account and its data, where no legal duty requires us to keep it.

Send any of these through the contact page and we will act within 30 days.

The shop is meant for adults. We do not knowingly create accounts for anyone under 16. If one exists, tell us and we will remove it.

If this notice changes we update the date at the top of the page. merxylab operates from Mandalay, Myanmar, and data is processed under Myanmar law. Anything unclear goes through the contact page.