Data Collection

We collect as little data as possible. We do not use third-party advertising trackers, social media pixels, or behavioural profiling tools. What we collect is either something you actively give us, or anonymised technical data that helps us understand how our website performs.

No third-party tracking. No Google Analytics, no Facebook Pixel, no Hotjar, no ad network cookies.
No tracking cookies. Our analytics do not use cookies; they use browser localStorage with a random identifier.
No data selling. Your information is never sold or shared with advertisers.

When you submit a project brief or contact form, we collect and store the following fields:

Where it goes: Stored in our secure PostgreSQL database (Supabase). Only our team can access it.
How long we keep it: Up to 3 years for business records, then permanently deleted.
Why we collect it: To respond to your enquiry and discuss your project.

Every page you visit on our website is recorded by our self-hosted analytics system. Here is exactly what is captured:

Where it goes: Our own database — no third-party analytics service receives this data.
How long we keep it: Up to 12 months, then deleted.
No cookies used.The visitor ID lives only in your browser's localStorage and is never transmitted to other sites.

We write the following entries to your browser's storage:

You can clear these at any time by clearing your browser's site data or local storage for vanaila.com. Doing so will not affect your access to any part of the website.

To be explicit, we do not collect or process:

• Financial or payment information (we have no payment forms)
• Social media profile data or login credentials
• Location data beyond what may appear in your IP address in server logs
• Biometric or health data
• Data from children under 16
• Information from third-party data brokers

You have the following options:

• Clear localStorage — removes your visitor ID. In your browser developer tools under Application → Local Storage → vanaila.com.
• Request deletion of contact data — email care@vanaila.com with the subject "Data deletion request" and we will remove your submission records within 30 days.
• Access your data — email us and we will send you a copy of any personal data we hold about you.

We have designed our data practices to comply with the following frameworks:

• UU PDP (Indonesia) — Undang-Undang Perlindungan Data Pribadi No. 27 Tahun 2022. As an Indonesian-registered company, this is our primary regulatory framework.
• GDPR (European Union) — General Data Protection Regulation. We apply GDPR-equivalent practices for all visitors regardless of location.
• PDPA (Thailand / ASEAN) — Personal Data Protection Act and similar ASEAN data protection laws where applicable.

Questions or regulatory enquiries may be directed to care@vanaila.com. We are Vanaila Digital, registered in Indonesia.