Your privacy, in plain English

Most privacy policies are written to never be read. We’d rather just tell you what we collect, why, and what we don’t do. Anything unclear? Email hello@asianmall.com and a real person will explain it.

What we collect

Only what we actually need:

Your email, when you make an account. That’s the starting point.

Whatever you put in a review or photo: your display name, your words, your pictures. Reviews are public; that’s the whole point of them.

Your name, email, and phone, if you submit or claim a business, so we can check you really run the place.

Business correspondence, if you ask about advertising, sponsorship, creator work, support, or another partnership. Those records may not be connected to your consumer account because you can contact us while signed out.

If you sign in with Google, Google confirms your identity to us and shares your name and email, the same basics as an email signup. We never see your Google password.

Payment details, if you buy a Member subscription. These go straight to our payment processor (Stripe). We never see or store your full card number; we only keep a reference id so we know your subscription is active.

Your location, but only on your phone. When you tap “Near me,” your browser uses your location right there to sort spots by distance. It never gets sent to us, never gets stored, and never ends up in a link. Close the tab and it’s gone.

Usage and diagnostics. We measure which pages get visited via Vercel’s analytics, which doesn’t use tracking cookies. We also keep limited first-party events such as listing views, referral source, saved/visited actions, and subscription-checkout steps so we can understand whether the directory works. Signed-in events may be linked to your account until you delete it; account deletion removes that link. If something errors, our error-monitoring tool (Sentry) records diagnostic details about that session (including, in some cases, a replay of the page interactions) to help us fix bugs; it’s configured to mask text you type and block media.

What we don’t do

We don’t sell your data. We don’t run ad networks that follow you around the internet. And we don’t email you marketing you didn’t ask for. Every marketing or engagement email has an unsubscribe link, and we honor it.

Who else touches it

A few trusted services keep the lights on, and we only ever hand each the bare minimum it needs: Supabase (our database and sign-in), Vercel (hosting and cookieless page analytics), Resend (the emails), Stripe (payments, if you subscribe), Google (“Continue with Google” sign-in, and business location info for a listing), OpenRouter (the AI behind “Ask AI”, business-submission screening, review summaries, and admin-requested feedback summaries: the relevant question, submission, public review, or feedback text is passed through no-collection/zero-retention routing to generate a response, and we also redact common contact details before review and feedback summaries), Anthropic (a fallback for staff-created listing drafts based on public catalog facts),Sentry (error monitoring), Cloudflare (the bot check on sign-up and business submissions, which sees your IP address), and Upstash (rate limiting to prevent abuse, which also sees your IP address). Each keeps your data only to provide its part of the service.

Cookies

Just the essential one that keeps you signed in. No advertising trackers. The bot check on sign-up and business submissions may set a short-lived Cloudflare cookie to confirm you’re human.

Your choices

You can download a copy of your account data or delete your account yourself from your dashboard. Deletion removes your profile, reviews and photos, saved lists, account-linked submissions, listing-owner contact details, mailing history, and consent record; it cancels any subscription and removes your account identifier from aggregate analytics. We retain only narrow records needed for safety, fraud/security, and legal compliance: reports you filed about abuse or illegal content, the history of a privacy request, privileged-action audit records, payment records Stripe must keep, and the minimum email-suppression entry needed to make sure we do not market to the deleted address again. Records you submitted while signed out or as part of a separate sponsor, creator, or business relationship may not be linked automatically; email hello@asianmall.com so we can locate them. You can also unsubscribe from any marketing or engagement email using the link at the bottom of it, and ask us for help editing or removing a review.

How long we keep it

Public contributions and account data stay until you remove them, delete your account, or we remove them under our rules. Newsletter and delivery history stays until you unsubscribe or delete your account; a minimal suppression entry remains so the preference keeps working. Short-lived security and diagnostic data is kept only as long as it remains useful for abuse prevention and reliability. The narrow safety, audit, privacy-request, suppression, and payment exceptions above may be kept as long as reasonably necessary for those purposes. Deleted data may remain temporarily in restricted disaster-recovery backups and ages out under our infrastructure providers’ backup schedules; it isn’t used for ordinary product activity.

Your California privacy rights

We don’t sell or share your personal information, and we never have. If you’re a California resident, you still have the right to know what we hold about you, to get a copy, and to have it deleted. Use the in-app deletion above, or email hello@asianmall.com, and we’ll honor it within the timeframes the law requires, without treating you differently for asking.

Kids

You need to be 18 to create an account (see our Terms). AsianMall isn’t built for children, and we don’t knowingly collect information from anyone under 13.

If this changes

We’ll update the date below when we tweak this, and flag anything significant.

Last updated August 2026 · hello@asianmall.com