Privacy Policy & Data Protection Notice

One document, two names. The footer links to this page as both Privacy Policy and Data Protection Notice (PDPA). They are the same page. Some sites keep two — a readable one and a formal one — and the two drift apart, which means you are held to whichever reads worse for you. Everything the law requires is here, written to be read.

THE SHORT VERSION

We do not know what you told the Routine Generator, unless you ask us to keep it. Your answers are stored in your own browser. If you choose to save your routine to an account, the finished routine is what gets saved, as it was on the day — not your answers — see clause 8A. Your pregnancy or breastfeeding answer is never saved and never sent to us, whatever you choose. It stays on your device. A saved routine is shown to you without asking; redoing it asks, because we cannot look it up. There is no database of who is pregnant and there never has been.

This website runs no analytics, and sets no cookies unless you create an account. We do not know how many people visit, which pages they read, or how long they stay. Reading this site sets nothing at all, apart from one note on your device that you have seen the pop-up introducing the Routine Generator; three cookies are set only once you start signing in — by pressing Save routine to your account, or Sign in in the header — and the Cookie Policy names them.

We hold personal data only when you hand it to us — when you email us through the Contribute page, and, if you choose to create one, the email address and saved routine described in clause 8A. Other than those two, nothing on this site collects anything.

If you read nothing else, that is the whole of it. The rest of this page explains it properly, and sets out your rights and how to use them.

PART A — WHO WE ARE

1. The organisation

1.1 This website is operated by SENSIBLE SKIN PTE. LTD. (UEN 202640831H), a private company limited by shares incorporated in Singapore ("we", "us", "our"). Our registered office address is on the public register at ACRA and can be looked up against that Unique Entity Number.

1.2 This document sets out how we collect, use, disclose and care for personal data, and the rights you have in relation to it, under the Personal Data Protection Act 2012 (No. 26 of 2012) ("PDPA").

1.3 "Personal data" has the meaning given in section 2(1) of the PDPA: data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.

2. Data Protection Officer

2.1 In accordance with section 11(3) of the PDPA we have designated a Data Protection Officer ("DPO") responsible for ensuring our compliance with the PDPA.

2.2 The DPO's business contact information, made available in accordance with section 11(5):

2.3 Direct to the DPO any question, access request, correction request, withdrawal of consent, or complaint concerning personal data. We aim to acknowledge within 5 working days and to respond substantively within 30 days. Where we cannot respond within 30 days we will tell you in writing when we expect to respond.

3. What this document covers

3.1 It applies to personal data we collect through:

(a) the website at sensible.com.sg and any subdomain of it, and any other domain from which we serve the same website;

(b) correspondence with us by email, including anything sent through the Contribute page;

(c) the purchase of goods through the website, from the Shop Opening Date; and

(d) any other interaction in which we obtain personal data about you.

3.2 It does not apply to third-party websites reached by a link from ours, which have their own notices.

PART B — WHAT WE DO NOT COLLECT

This Part comes first because it is the more significant fact about this website.

4. Your Routine Generator answers stay on your device unless you save them

4.1 The Routine Generator asks about skin type, skin concerns, sun exposure, and whether you are pregnant or breastfeeding. That last question exists so the tool can leave certain ingredients out. Those answers, and the routine produced from them:

(a) are stored in your own web browser, using the localStorage and sessionStorage facilities, under names beginning sensible_;

(b) are not transmitted to us, to any server, or to any third party unless you sign in and press Save routine to your account, which clause 4.2 and Part 8A describe; and

(c) are therefore not collected, used or disclosed by us within the meaning of the PDPA until and unless you do.

Your pregnancy or breastfeeding answer is the exception with no exception. It is not part of what gets saved, cannot be, and never reaches us — clause 8A.3.

4.2 Until 16 September 2026 the website had no server-side component, no user accounts and no analytics, and there was no mechanism by which your answers could reach us. Accounts changed the first three. Everything in clause 4.1 is still true of a visitor who does not create one: the answers stay in the browser and we cannot retrieve them. If you do create one, clause 8A sets out exactly what is saved and what is not. We still run no analytics.

4.3 We are not being modest about this. It is the reason the tool can ask about pregnancy at all without creating a record of your pregnancy somewhere you cannot see.

4.4 The consequences are yours to manage, and we state them plainly:

(a) anyone who can use your browser can see your answers. If you share a computer with family or colleagues, that includes them;

(b) clearing your browsing data, using private browsing, or using a different browser or device erases them, and we cannot restore them;

(c) your answers do not follow you to your phone; and

(d) there is a "Start over" control on the site that clears every item at once, on the pages where a finished routine is shown.

4.5 The complete list of what is stored in your browser, by name, is in the Cookie Policy, clause 6.

4.6 If this ever changes, this document changes first. Should we introduce accounts, cloud synchronisation, or any other facility that transmits Routine Generator answers to us, we will publish a revised notice, state the change prominently, and obtain your consent before it takes effect in respect of you. It will not arrive quietly in a revised policy.

PART C — WHAT WE DO COLLECT

5. Today: only what you email us

5.1 The Contribute page. The Contribute page lets you suggest a product, tell us where something is sold, report something wrong on the site, or ask to be told when a product is stocked.

5.2 It is not a form that submits to us. It composes a message and opens it in your own email application, which you then send yourself. Nothing is transmitted by the website. That means:

(a) we receive the message from your own email address, because you sent it;

(b) we receive whatever you typed into it; and

(c) if you do not press send in your mail application, we receive nothing at all.

5.3 What we then hold:

5.4 Please do not send us clinical details about yourself or anyone else. We cannot give individual advice by email, and we would rather not be holding your medical information at all. The message box says so. If you send it anyway we will treat it under this document and delete it when the matter is closed.

5.5 "Tell me when a row is stocked." If you choose this option you are asking us to send you one email about one product. We will send that email and nothing else. You can tell us to stop at any time, by reply or to the DPO, and we will. We will not use the address for anything you did not ask for.

5.6 On the 12-month retention period. No statute sets it. It is our choice, made so that we can find an earlier exchange if you write again, and it is stated here so you can hold us to it rather than discover that we kept things indefinitely.

6. Interest recorded on your own device only

6.1 The shop page has an "I'd buy this" control. As at 4 September 2026 pressing it writes a flag to your own browser (sensible_shelf_wants) and sends nothing to us. The card on the page says so.

6.2 We publish a count of interest in a product only where we have set that number ourselves, and it is worded as "people have told us". We do not present a device-local flag as though it were a tally. If we ever build a counter that transmits, clause 4.6 applies and this document changes first.

7. Server logs

7.1 Our hosting provider records standard server logs — IP address, request time, page requested, user agent — for security, fault diagnosis and defence against abuse. The basis is our legitimate interest in operating the website securely.

7.2 We do not use these logs to build a profile of you, and we do not combine them with anything else. Retention is as set by the hosting provider.

8. Orders — from the Shop Opening Date only

As at 4 September 2026 this website sells nothing and takes no payment. This clause is published in advance so that the terms are visible before they apply, not introduced at the point of purchase. Part C of the Terms of Use is dormant on the same basis.

8.1 What we will collect:

8.2 We will never see your full card number. Payment will be processed by the payment processor named in clause 20A. We receive a confirmation of payment, the card type, and the last four digits. We do not receive or store the full card number, the expiry date or the security code.

8.3 On the 5-year period. This is not our preference. IRAS requires a company to keep proper records and accounts of business transactions for at least 5 years from the relevant Year of Assessment, and the same 5-year period applies to GST records. We cannot delete an order record earlier than that even if you ask us to, and clause 13.4 says so plainly rather than promising something we cannot do.

8A. Accounts — from 16 September 2026

8A.0 In plain words, before the detail.

• An account keeps two things about you: your email address, and the routines you have saved — each as it was built, with the date you saved it.
• It never keeps your pregnancy or breastfeeding answer. That stays on your phone or computer. A saved routine is shown without asking; redoing it asks, because we cannot look it up.
• There is no password. When you sign in we email you a six-digit code.
• The email tick box is a separate choice. Saving your routine works whether you tick it or not, and you can stop the emails at any time.
• You can ask us to delete all of it whenever you want. We will, and we will tell you when it is done.

The rest of Part 8A says the same things more carefully, and it also describes two housekeeping values we keep — a date and a counter — which clause 8A.2 sets out. If the summary above and the careful version ever disagree, the careful version governs — but please tell us, because it would mean we wrote one of them badly.

8A.1 You can save your routine to an account. You do not have to. Everything on this website works without one, and the Routine Generator keeps your answers on your own device either way.

8A.2 What an account holds:

Nothing else. No name, no age, no address, no payment details, and no record of the pages you read.

8A.2A What a saved routine is. It is a copy of what the Routine Generator produced for you on the day you saved it: the concerns you chose, your skin type, and the steps and products it put together, with the date. You may save more than one. Each is shown to you exactly as it was; none of them is rebuilt or altered without you redoing the generator. We changed this on 30 September 2026 — before then an account held one set of answers rather than one or more finished routines — and clauses 8A.3 and 8A.4 were revised with it.

On the date, because it is the one thing here that could become a record of your visits and does not. We keep only the most recent one and write over it, so it can show that you used your account today and nothing else: not when you came before, not how often, not from where, and not what you looked at. It is stored as a day rather than a time for the same reason. We added it on 17 September 2026 and this clause was revised to say so, because until then clause 8A.6's period was measured against nothing we held.

8A.3 What an account does not hold, and this is deliberate. Your pregnancy or breastfeeding answer is not saved to your account and is not sent to Shopify. It stays on the device you gave it on. That is why a saved routine can be shown to you on any device without a question, but redoing it — with the Routine Generator — asks you again: we cannot look it up, because we did not keep it. Every saved routine carries a note asking you to redo it if your pregnancy or breastfeeding status has changed.

8A.4 A saved routine is a copy, not a live recommendation. What is saved is the routine as it was built on the day, not your answers. It does not change when our guidance changes. Each one is marked with the version of our guidance it was built under, and when that has moved on, the page says so and asks you to redo the generator. Until 30 September 2026 this clause said the opposite — that a saved routine was rebuilt on every sign-in and so always followed current guidance. That was true of the earlier design and is not true of this one; we would rather show you a routine that says plainly when it is out of date than rebuild one behind your back.

8A.4A You sign in on Shopify's page, not ours. Pressing "Save routine to your account" takes you to a sign-in page hosted by Shopify, where you enter your email address and the one-time code they send you, and then returns you here. Clause 12.8 sets out exactly what Shopify can see while you are there. That page shows one tickbox: "Email me about Sensible — when the shop opens, new guides, and occasional news and offers. You can stop at any time." It is not ticked for you, and you can sign in without touching it — signing in and hearing from us are two separate things, and only one of them is required. The same tickbox, with the same words, will also appear at checkout once the shop opens; buying something will no more subscribe you than signing in does. Ticking it in either place sets the same single permission clause 9 governs; it does not put you on a second list. We ask again on this site once you are signed in, because someone who already had an account never saw that tickbox, and either place will change your mind at any time.

8A.5 No password exists. Signing in is by a one-time code sent to your email address. We never create, receive or store a password, so there is no password of yours for us to lose.

8A.5A Signing out ends both halves. Pressing Sign out removes your sign-in from this website immediately, and then sends your browser briefly to Shopify's page so that the sign-in they hold is ended as well, before returning you to our home page. We do this because Shopify keeps its own record of your sign-in for as long as a year: without that second step you could be signed back in without being asked for a code, which matters most on a shared or borrowed device.

8A.6 On the 24-month period. No statute sets it. It is our choice, made because a skincare routine that old no longer describes your skin or our current guidance, so keeping it serves no purpose — and the Retention Limitation Obligation requires us to stop retaining personal data once the purpose has ended. If you do not use your account for 24 months, your account and the routine saved with it are deleted. Using it means signing in, or opening your routine while you are still signed in; either one starts the 24 months again, and the date at clause 8A.2 is what it is measured against.

8A.6A We changed one word of that on 17 September 2026, and it matters. It previously read "if you do not sign in for 24 months". Signing in can keep you signed in for a long time, so somebody who opens her routine every week might not sign in again for years — and the old wording would have deleted an account that was in active use. Use is the honest description of what we now measure, and it is the one that keeps a routine you are still using.

8A.7 Deleting it sooner. Ask us at any time at the address in clause 20 and we will delete your account, your saved routine and your email address. We will confirm when it is done.

9. Marketing

9.1 You will not hear from us unless you ask to. We do not add anyone to a list because they bought something, made an account, or read a page. We never use pre-ticked boxes.

9.1AA There is one list, and it is a broad one. We decided against several narrow permissions and asking you to manage them. Saying yes puts you on a single list that covers everything we might send: when the shop opens, new guides and corrections to old ones, and news and offers about Sensible. We would rather the box said so than have it say something narrow and then have to widen it later. You can leave at any time — on this site once you are signed in, or from the link in every message.

9.1A You may be asked more than once, and it is one permission. The same question appears in up to four places: on the Shopify sign-in page (clause 8A.4A), beside Save routine to your account before you sign in, on this site once you are signed in, and — once the shop opens — at checkout. There is one list and one setting behind all three: whichever you answer last is what we hold, and saying no in any of them is a no. More than one place exists because each catches someone the others miss — the sign-in box is never seen by anyone who already has an account, and the box beside Save is never seen by anyone who signs in from the header.

9.2 If you opt in, the basis is your express consent. If you have an account, the address is your account and clause 8A.2's period governs it — withdrawing consent stops the email, it does not delete the account. If you gave us an address without an account, we keep it until you withdraw and briefly afterwards, to record that you did, and every message carries a working unsubscribe facility, in accordance with the Spam Control Act 2007. Unsubscribing does not stop transactional messages about an order you have placed.

9.3 We do not conduct telephone or SMS marketing at all. If you give us a Singapore telephone number we will not send marketing messages to it unless you have given clear and unambiguous consent in writing, or we have checked the Do Not Call Registry, in accordance with Part IX of the PDPA.

PART D — HOW WE HANDLE IT

10. The eleven obligations

The PDPA imposes the following obligations. We set out how each applies here so that this document can be checked against our conduct rather than taken on trust.

11. Protecting personal data

11.1 We make reasonable security arrangements to protect personal data in our possession or under our control against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, as section 24 of the PDPA requires.

11.2 Those arrangements include:

(a) collecting as little as possible. The single most effective protection applied to this website is architectural. For a reader who never signs in, nothing is collected at all, so there is no store of it to be breached. For a reader who does, what exists is one email address and the saved routines per account — no name, no age, no address, no payment details and no record of the pages read — and the pregnancy or breastfeeding answer is not among it and cannot be, which is enforced by how the code is built rather than by a rule someone has to remember;

(b) serving the website over HTTPS;

(c) restricting access to enquiry and order data to those who need it to do their work;

(d) using established processors rather than building payment or order handling ourselves; and

(e) not storing full payment card details at any point.

11.3 No method of transmission or storage is completely secure, and we do not claim otherwise.

12. Disclosure and transfer

12.1 We do not sell personal data. We do not rent it, trade it, or hand it to anyone for their marketing. There is no exception to this and no "trusted partners" clause hiding elsewhere in this document.

12.2 As at 4 September 2026, the only personal data we hold is email correspondence, and we disclose it to no one.

12.3 No third-party request leaves your browser to display this site. Every file a page needs — text, images, styles, scripts and typefaces — is served from sensible.com.sg. There is no analytics package, no tag manager, no advertising or consent vendor, no embedded video, no social button and no content delivery network, so no other company is told your IP address or which page you were reading. This was not always true, and we are not going to delete the admission: until 7 September 2026 every page requested two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), and one page — the rosacea page — kept requesting a third until 9 September 2026. To serve those requests Google received the IP address and the Referer header, which identifies the page being read; on a website about skin conditions that was not trivial, and it disclosed to a party outside Singapore that a given IP address was reading a given page. We received nothing from it. We said the answer was to remove it rather than to describe it more elegantly, and that is what was done. Clause 5 of the Cookie Policy sets out how to verify this for yourself.

12.4 From the Shop Opening Date, order data will be disclosed to:

12.5 Transfer outside Singapore. Where personal data is transferred out of Singapore we will, in accordance with section 26 of the PDPA and the Personal Data Protection Regulations, take appropriate steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA. Those steps are ordinarily contractual, through the data processing terms in our agreement with the recipient.

12.6 Where a recipient acts as a data intermediary — processing personal data on our behalf and not for its own purposes — we remain responsible for that data as if we processed it ourselves, as section 4(3) of the PDPA provides.

12.7 Accounts are operated for us by Shopify. From 16 September 2026, if you create an account (clause 8A), Shopify Inc. holds the following on our behalf, as a data intermediary, on servers outside Singapore:

Clauses 12.5 and 12.6 apply to that transfer: we rely on the data processing terms in our agreement with Shopify as the legally enforceable obligations required by section 26, and we remain responsible for the data as if we processed it ourselves.

12.8 Your browser contacts Shopify twice: when you sign in, and when you sign out. We want to be exact about this rather than flattering.

• Reading this website contacts nobody. Every page requests files from sensible.com.sg and nowhere else. Clause 12.3 is unchanged and remains true, whether or not you have an account.
• Pressing "Save routine to your account" takes you to a Shopify sign-in page to enter your email address and the code they send you. That is a page on shopify.com, not on this website, and while you are on it Shopify can see your IP address and that you arrived from here. This is the same kind of departure as following any outbound link, and we are naming it because you should not have to discover it by watching the address bar.
• Pressing "Sign out" sends you briefly to Shopify a second time, so that the sign-in they hold is ended as well as ours. It is a redirect you will usually not see, and clause 8A.5A describes it. Without it Shopify would still remember you, and pressing Sign in again would let you back in without asking for a code — which matters most on a shared or borrowed device.
• Between those two departures your browser does not contact Shopify at all. Saving and showing your routines are done by our own server talking to Shopify on our behalf. No Shopify code runs on any page of this site.
• What Shopify can tell about when you are here. While you are signed in, our server asks Shopify for your saved routine each time you open a page. So Shopify can tell that you are using this website and when — but not which page you are reading, because we do not send that and there is nothing in the request that identifies it.

12.9 What we chose not to do. The sign-in could have been built so that your browser talked to Shopify continuously, on our pages, holding its own access tokens. That is the simpler way to build it and it is what the platform offers by default. We did not use it, because it would have meant Shopify being told your IP address every time you opened your routine, and clause 12.3 would have stopped being true.

PART E — YOUR RIGHTS

13. Withdrawing consent

13.1 You may withdraw consent to our collection, use or disclosure of your personal data for any purpose, at any time, by giving reasonable notice to the DPO.

13.2 On receiving your notice we will tell you the likely consequences of withdrawal, as section 16(2) of the PDPA requires. Withdrawal may mean we cannot continue to correspond with you, or to supply goods or process a pending order.

13.3 We will give effect to your withdrawal within 30 days and will tell you when we have.

13.4 Withdrawal does not affect the lawfulness of anything done before it, and it does not require us to delete data we are required by law to retain — see clause 8.3.

14. Access to your personal data

14.1 You may ask us, under section 21 of the PDPA, for a copy of the personal data about you in our possession or under our control, and for information about how it has been or may have been used or disclosed in the year before your request.

14.1A If you have an account, the quickest answer is to sign in. Clause 8A.2 lists everything an account holds, and the account screen shows you the same thing. You do not have to ask us for it, and you do not have to wait.

14.2 Send the request to the DPO. We may ask you to verify your identity — we are not permitted to disclose personal data to someone who has not shown they are entitled to it.

14.3 We may charge a reasonable fee for the administrative cost of an access request. If a fee will apply we will tell you the amount before doing the work, and you may withdraw the request.

14.4 There are limited circumstances in which the PDPA does not require or permit us to provide access — for example where doing so would reveal personal data about another individual. If we refuse, we will tell you why.

15. Correction of your personal data

15.1 You may ask us, under section 22 of the PDPA, to correct an error or omission in personal data about you.

15.1A If you have an account, you can change the routine saved to it at any time by generating a new one and saving it again. It replaces what was there.

15.2 We will correct it as soon as practicable unless we are satisfied on reasonable grounds that the correction should not be made, and we will send the corrected data to any organisation to which we disclosed it in the year before the correction, unless that organisation does not need it.

15.3 There is no fee for a correction request.

16. Complaints

16.1 If you are dissatisfied with how we have handled your personal data, tell the DPO first at dpo@sensible.com.sg. Set out what happened and what you would like us to do. We will investigate and respond.

16.2 If you remain dissatisfied, you may complain to the Personal Data Protection Commission, which regulates compliance with the PDPA. Its contact details are published at pdpc.gov.sg.

16.3 Nothing in this document limits your right to complain to the Commission, and you do not need our permission to do so. Nothing here is intended to discourage you from it.

PART F — WHEN THINGS GO WRONG, AND OTHER MATTERS

17. Data breaches

17.1 We will assess any suspected breach of personal data promptly after becoming aware of it.

17.2 A data breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or is, or is likely to be, of a significant scale (section 26B PDPA). The prescribed number of affected individuals for "significant scale" is 500 (regulation 4, Personal Data Protection (Notification of Data Breaches) Regulations 2021).

17.3 Where a breach is notifiable we will notify the Commission as soon as is practicable, but in any case no later than 3 calendar days after the day we make that assessment (section 26D(1)).

17.4 Where the breach is likely to result in significant harm to you, we will also notify you, in any manner reasonable in the circumstances (section 26D(2)), unless an exception in the PDPA applies.

18. Children

18.1 The website is not directed at children under 13, and we do not knowingly collect personal data from them.

18.2 If you believe a child under 13 has given us personal data, tell the DPO and we will delete it.

19. Changes to this document

19.1 We may revise this document. The revised version takes effect when published with a new effective date, and we will say what changed.

19.2 Where a revision materially changes how we handle personal data we already hold, we will notify affected individuals directly and, where the PDPA requires it, obtain fresh consent.

19.3 If we ever start collecting something we do not collect today — accounts, analytics, anything that sends your routine answers to us — we will say so prominently and ask you first.

19.4 Superseded versions are retained internally so that the terms applying at any past date can be established.

20. Contact

20A. Third parties named for the shop

20A.1 Clause 8 and clause 12.4 describe what will happen when we start selling. They refer to processors we have not appointed yet. This clause is where those are named, and it is deliberately incomplete today.

20A.2 We will not begin taking orders while a row above is blank, and we will publish a revised version of this document naming them before the first order is possible, not after.

Version 2.6 · In force from 30 September 2026.

Issued under the Personal Data Protection Act 2012. We review it at least once a year, and whenever our data flows change — a new processor, the introduction of accounts or analytics, or the opening of the shop. If we revise it we will publish the revised version with a new date and say what changed. Superseded versions are kept, so the terms that applied on any past date can be established.

What changed, and when

Clause 19.1 promises that a revised version says what changed. Until 17 September 2026 that record was kept but not published, which is not the same thing as saying it. It is published here now, and it goes back to the first revision.

What changed in 2.6

What changed in 2.5

What changed in 2.4

What changed in 2.3

What changed in 2.2

What changed in 2.1

Recorded late: this was not said at the time of the account work earlier on 16 September, and both changes are set out together here.