Privacy Policy

This policy explains what personal data Manyloom collects, why we use it, who can see it, how long we keep it, and what you can ask us to do with it. It covers this website, our creator programme, drop alerts, and the orders we fulfil from our marketplace stores.

We handle personal data in line with Indonesia's Personal Data Protection Law (Law Number 27 of 2022, known as UU PDP).

If you are an artist with a creator account:

• your email address and password (stored as a secure hash, so we never see it);
• your name, creator name, location, bio, and portfolio or social links;
• the designs you submit: artwork files, titles, descriptions, stories, colour and placement choices;
• the terms you accepted and when, and the review history of each design;
• when you are due a payout, the bank account details we need to pay you and the tax details the law requires.

If you sign up for drop alerts: your email address.

If you buy a tee: you order on Shopee, Tokopedia and TikTok Shop. The marketplace shares the details we need to pack and send your order, such as your name, delivery address and what you ordered. Your payment details stay with the marketplace. We never see them.

If you contact us: your name, contact details and what you tell us.

If you visit the site: our hosting provider records basic technical data when a page loads, such as your IP address, browser and device type, the page requested and the time. We only use cookies that are needed to keep you signed in and keep the site secure. We do not use advertising cookies.

• To run the creator programme: your account, reviewing designs, making and selling approved products, and crediting you by your creator name. We need this to carry out our agreement with you.
• To pay royalties: calculating what you earned, paying you, withholding tax and keeping financial records, as our agreement and Indonesian law require.
• To deliver orders: packing and sending your tee, and handling returns, exchanges and questions.
• To send drop alerts: only with your consent. You can unsubscribe at any time.
• To keep Manyloom safe: protecting accounts, preventing fraud and misuse, and fixing problems with the site.

• Our team, only the people who need it for their work.
• Service providers that run the site for us: Supabase stores our database and files and handles sign-in, and Vercel hosts the website. They process data only to provide their service to us.
• Banks and tax authorities, to pay royalties and meet our tax duties.
• Authorities, when the law requires it.

Your creator name appears publicly on products made from your designs. Artists never see shoppers' personal data, and never see other artists' data. We do not sell personal data.

When you buy on a marketplace, that marketplace also handles your data under its own privacy policy.

Our data is stored with Supabase and the site is hosted on Vercel. Their servers may be outside Indonesia. When data is processed abroad, we rely on providers that protect it to at least the standard UU PDP requires.

• Creator account details: while your account is open. When you close it, we delete or anonymise them, except for the records below that we must keep.
• Submissions, accepted terms and review decisions: as long as we need them to handle rights questions and keep an audit trail, including for designs that were not selected.
• Royalty, payout and tax records: for as long as Indonesian tax and accounting law requires.
• Order details from marketplaces: as long as we need them to deliver, handle returns and keep the sales records the law requires.
• Drop-alert email: until you unsubscribe.
• Messages to us: as long as we need them to help you and follow up.
• Technical logs: for a short period, kept by our hosting provider.

Original artwork is kept in private storage. Access to personal data is limited by role, so each person sees only what their work needs. The site uses encrypted connections. If a data breach affects you, we will tell you and the authorities as UU PDP requires.

Under UU PDP, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• give you access to it, or a copy;
• correct anything that is wrong or out of date;
• delete it, or stop using it;
• withdraw a consent you gave, such as for drop alerts.

To ask, send us a message through the Contact page and say what you need. We may ask you to confirm who you are first. We will reply within the time UU PDP sets. Artists can also update most profile details themselves in their creator account.

Some records, such as tax and royalty records, must be kept by law even if you ask us to delete them. If that applies, we will tell you.

When we change this policy, we update the date at the top of this page. If a change affects how we use artists' data in a meaningful way, we will also tell artists in their creator account or by email.

Questions about your data or this policy? Reach us through the Contact page.