Privacy Policy

Account data: name, email, phone, encrypted password.

Order data: shipping addresses, order history, governorate, country.

Payment data: NOT collected by us — only the last 4 digits and card brand for receipt display, returned by MyFatoorah.

Device data: IP, user agent, language, device id (mobile), and Expo push token if you accept notifications.

Behavioural data: pages viewed, search queries, items added to cart. Only when you have accepted analytics consent.

Fulfil orders: ship items, process payments, send receipts.

Service communications: order updates, password resets, security alerts. Sent via email and SMS as required.

Marketing (only with explicit opt-in): promotional emails, SMS, push notifications.

Fraud prevention and compliance: detect chargeback fraud, comply with Kuwait Central Bank AML requirements.

Product improvement: aggregate analytics on storefront performance.

We share data only with processors necessary to operate the service:

— MyFatoorah (payment processing, Kuwait)

— Supabase (database hosting, EU)

— Upstash (cache + queue, US-East / EU-West)

— Resend (transactional email, US)

— Unifonic (SMS, KSA)

— Expo (push notifications, US)

— Sentry (error tracking, EU region)

— Axiom (log storage, EU region)

— ScraperAPI / Bright Data (product imports — no customer data shared)

All processors are bound by data-processing agreements that meet PDPL standards.

You have the right to:

— Access the personal data we hold about you (request an export from /account/privacy).

— Correct inaccurate data (edit your profile or contact us).

— Request deletion of your data (subject to our legal obligation to retain order records for 7 years for tax/AML).

— Withdraw analytics or marketing consent at any time.

— Lodge a complaint with the Kuwait competent authority (Communication and Information Technology Regulatory Authority — CITRA).

Account data: kept while your account is active, plus 1 year after deletion.

Order and payment records: 7 years from the order date, as required by Kuwait commercial and tax law.

Logs and analytics: 90 days.

Marketing consent records: until withdrawn, plus 3 years to demonstrate compliance.

Passwords are hashed with bcrypt. Database connections use TLS. Backups are encrypted at rest. Access to production data is restricted to named staff and logged.

We will notify affected users within 72 hours of any confirmed breach of personal data.

The platform is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe we have, contact ⟪CUSTOMER_SERVICE_EMAIL unset⟫ and we will delete it.

We will update the "Effective" date and notify registered users by email at least 30 days before any material change takes effect.

Privacy questions or data-subject requests: ⟪CUSTOMER_SERVICE_EMAIL unset⟫.