Privacy policy

Effective date: 18 October 2026

This Privacy Policy explains how Khâu handles personal information when you browse khau.store, contact us or use our optional AI Try-on. It applies to the US and UK versions of our website. The store is currently a catalogue and enquiry service; online checkout is not open.

1. Who is responsible for your information

Khâu is operated by EXORA STUDIOS PTE. LTD., a company registered in Singapore (UEN 202401662E), with its registered office at 470 North Bridge Road, #05-12, Bugis Cube, Singapore 188735. EXORA STUDIOS PTE. LTD. is responsible for the uses of personal information described here. Our development, customer support and workshop coordination take place in Vietnam.

For privacy questions or requests, email [email protected], call +84 966 660 730, or write to the business address above. Please use “Khâu privacy request” as your email subject. The Singapore registered office is not a parcel return address.

2. Information we collect

When you submit a design request on the website, we store your name, email address, delivery country, any optional watch model, wrist measurement and notes, and a snapshot of the selected product, SKU, lug width, lining and hardware. We also store a request reference, processing status, timestamps and a hashed network identifier to prevent abuse. The form asks permission for us to contact you about that request; it does not subscribe you to marketing. Submitting it requests a quote and does not create a paid order.

When you contact us by email, we receive the information you choose to send, such as your name, email address, phone number, delivery country, watch model, measurements, preferred design and correspondence. Product enquiry links open your email application; Khâu receives the message only if you send it. Please do not send payment-card details, identity documents or unnecessary sensitive information by email.

When you visit the site, our hosting and security services process technical information such as your network address, requested pages, request time, browser information and security events. This helps deliver the site, diagnose faults and protect it from abuse. These services may see a network address even though the Try-on application stores a hashed network identifier rather than the original address.

If you choose AI Try-on, we process the wrist photo you submit, your chosen product and fit, a temporary generated image, and technical job records. These records include random identifiers, hashes of the browser session and image input, a hashed network identifier, the selected product/SKU, processing status and timestamps. We do not use the photo to identify you, create a facial or biometric identity template, or measure your wrist.

You do not need an account or Google sign-in to browse, enquire or use Try-on. We do not currently collect card details or process website payments. Any future ordering or payment service will be described before it is introduced.

3. Why we use information

We use enquiry information to answer you, discuss a design and take steps you request before a potential purchase. Where UK data protection law applies, the relevant basis is taking steps at your request before a contract, or our legitimate interest in answering general questions and providing customer support.

We use technical and security information for our legitimate interests in running a reliable site, preventing fraud and abuse, controlling the free Try-on allowance and protecting visitors. We limit this use to what is reasonably needed for those purposes. We may retain relevant information to meet a legal obligation or establish, exercise or defend legal claims.

The optional AI photo processing is based on your consent, requested beside the Create my preview button. You can decline and still browse or contact us. We do not use your wrist photo for Khâu advertising, publish it in the catalogue, or add it to a Khâu training dataset. We do not make decisions with legal or similarly significant effects about you through AI; Try-on produces a visual styling simulation.

4. AI Try-on: what happens to your photo

Selecting a photo prepares a smaller image in your browser. It does not by itself submit the photo to the AI provider. After you tick the processing-consent box and press Create my preview, the prepared wrist image and selected catalogue image are sent through Khâu to GPTi2 Store, an external AI service. Original EXIF metadata, including embedded location data, is removed during image preparation. Visible private details inside the picture are not automatically removed, so keep faces, documents and other people's information out of the frame.

Khâu processes the submitted wrist image in memory and does not save the original upload as a file. The generated preview is stored temporarily outside our public media library, accessible through the originating browser's fitting session. It expires one hour after submission; scheduled cleanup removes local result files within one hour of file creation during normal operation. Use the Remove photo control to clear the displayed photo and request removal of the current result from Khâu. Closing the page alone does not send a deletion request. Copies you download remain on your device until you remove them.

Deleting a result or withdrawing consent does not recall an image already transmitted to GPTi2 or cancel all remote processing. GPTi2's documentation says generated images expire after approximately one day. We have not confirmed its uploaded-reference retention period, processing locations, subprocessors or use of references for model training, and cannot promise immediate deletion or no retention by that provider. Contact us if you want help requesting upstream deletion. Only submit a photo you are comfortable sharing on this basis; the feature is optional.

5. Cookies and browser storage

The khau_fitting cookie is an essential, signed fitting-session cookie lasting up to seven days. It lets your browser access its own temporary previews and supports the three-previews-per-rolling-24-hours allowance. It is not an advertising identifier. The fitting cookie is HttpOnly and uses Secure on HTTPS and SameSite restrictions.

Session storage remembers a temporary fitting job ID and the selected product/SKU so a page reload can resume the preview. It does not store the wrist photo. The shopping bag, when used, stores product IDs, variants, quantities and custom choices (leather, grain, stitching, colours, lining, buckle and fit) in local storage under khau-bag-v1 until you clear it or your browser removes it. Authorised staff sign-in uses a separate khau_session cookie lasting up to eight hours.

Cloudflare also provides network delivery and security and may set operational or anti-abuse cookies according to its privacy policy. We have not integrated advertising pixels or marketing analytics into the storefront. We do not use cross-site behavioural advertising. A browser Do Not Track signal does not change essential site processing; we do not sell or share personal information for targeted advertising, including when Global Privacy Control is enabled. Browser settings let you block cookies or clear storage, but doing so may reset the bag or prevent access to a preview.

6. Who receives information and overseas processing

Information is accessible to authorised Khâu personnel and service providers as needed for hosting, security, email and support. Cloudflare handles site delivery and security. GPTi2 receives the two image references only when you request AI Try-on. Email providers process messages you send us. We do not sell personal information or supply mailing lists to advertisers.

If you later agree an order with us, we will explain any additional information needed for payment, workshop fulfilment, delivery and customs before collecting it. We may also disclose information when legally required, to protect rights or safety, or in a business transfer subject to applicable data-protection requirements.

Our company is registered in Singapore and operations include Vietnam, so information may be accessed outside your country. Service providers may also process information elsewhere. Local privacy protections may differ from those in the UK. Where transfer rules apply, the appropriate legal basis and safeguards must be established for the transfer; this policy does not claim that every provider has a verified adequacy status or approved transfer agreement. The specific limits of our knowledge about GPTi2 are explained above. You may ask us about the arrangements relevant to your information before using an optional service.

7. How long we keep information

Local Try-on images follow the short periods described above. Try-on job metadata is removed after approximately 24 hours, with cleanup running every five minutes; the fitting cookie can remain longer without preserving the image. Hashed values and random job IDs are still treated as personal information where they can be linked to a session.

Website design requests are automatically removed 365 days after their last status update during normal operation. Their hashed network identifiers are cleared after 24 hours; cleanup runs every five minutes. Correspondence you exchange with us separately may be retained for the purposes described below.

We keep email enquiries for as long as reasonably needed to respond, manage the relationship and resolve follow-up issues. Any later transaction, accounting or dispute records are kept for the period required by the applicable legal obligation or claim. Security records are kept for a period proportionate to troubleshooting, abuse prevention and investigation. These periods depend on the purpose and any legal hold; we do not promise the same deletion date for every type of correspondence or provider log.

Restricted backups may retain database records until the relevant backup is rotated or removed; routine deletion does not immediately rewrite every backup. Temporary Try-on image files are stored separately from the content database and are not intentionally included in content-database backups. Provider-controlled copies follow the provider's arrangements rather than Khâu's local expiry timer.

8. Your choices and rights

Depending on the law that applies, you may request access to or a copy of your personal information, correction, deletion, restriction, portability, or information about our processing. You may object to processing based on our legitimate interests. You may withdraw consent for future AI processing at any time by not submitting another request and by contacting us about an existing request. Withdrawal does not affect processing that was lawful before withdrawal.

Email [email protected] with your request. Describe the information or interaction concerned; for an active preview, include its job ID if available, without sending the wrist photo again. We may need proportionate information to verify the request, and we may be unable to locate an anonymous session without its identifier. We will respond within the applicable statutory period; UK rights requests are generally answered within one month, subject to lawful extensions. We will explain any refusal, permitted charge or extension and do not penalise you for exercising applicable rights.

Under Singapore’s Personal Data Protection Act, you may also request access to or correction of personal information and withdraw consent, subject to applicable exceptions. Our privacy contact above handles these requests. If we cannot respond to a Singapore access request within 30 days, we will notify you of the expected response date.

You may complain to the authority responsible for data protection where you live. For Singapore data-protection concerns, contact the Personal Data Protection Commission. UK visitors can contact the Information Commissioner's Office. You can contact us first, but you do not have to do so before approaching an authority.

9. Security, children and external sites

We use HTTPS, restricted administrative access, private result storage and limited retention to protect information. No online system can be guaranteed completely secure. Do not share a browser session or downloaded preview if you want it to remain private.

The store and Try-on are intended for adults and are not directed to children under 13. People under 18 should browse with a parent or guardian and must not upload a child's photo. If you believe a child has provided personal information, contact us so we can investigate and remove it where appropriate.

Links to social media, source credits or external services lead to sites with their own privacy practices. Opening an email draft or visiting an external link does not give Khâu control over that service.

10. Changes to this policy

We will post changes here with a revised effective date and give additional notice or request new consent where required. A material change to photo handling, analytics, payments or other collection must be explained before the new use begins. See our Terms and conditions for the rules governing the website and its previews.