Privacy Policy

When you create an account Your name, email address, phone number and date of birth. If you sign in with Google or Facebook instead of a password, we receive and store the access tokens that let us recognise you on return visits. If you set a password, we store it hashed — never as readable text. You may add a profile picture.

When you sign in The IP address and browser user-agent of the device you signed in from, kept with your session so we can secure your account.

When you shop Your shipping and billing addresses, the contents of your cart, the items on your wishlist, and your order history. When you place an order we save a copy of the delivery address onto the order itself, so your order records stay correct even if you later edit or delete the saved address.

When you pay We do not receive, see or store your card number. Card payments are handled by Stripe, and your card details go directly to them. What we keep is the transaction reference Stripe returns, the amount, the currency and whether the payment succeeded. If you pay cash on delivery there is no card data at all.

When you write a review Your review text and rating. Reviews are published publicly on the product page alongside your name, so do not include anything in a review you would not want other shoppers to read.

When you contact us or subscribe Your messages to us, and your email address if you sign up for our newsletter.

Customer records We keep a customer record keyed to your phone number so that repeat orders, loyalty totals and any notes our staff add about your orders stay together in one place.

• To perform our contract with you — processing, packing, delivering and invoicing your order, handling returns and refunds, and contacting you about an order.
• Because the law requires it — keeping accounting and tax records.
• With your consent — marketing email, which you can withdraw at any time using the unsubscribe link in any message, or by contacting us. We also use your date of birth to send you a birthday offer.
• For our legitimate interest in running the store — securing accounts, preventing fraud, and understanding which products sell.

This store sets a cookie that keeps you signed in and remembers your cart. It is essential to the site working, and there is nothing to opt out of because we do not run advertising pixels, analytics trackers or third-party marketing scripts on this site.

We do not sell your personal data. We share only what is needed, with:

• Our delivery courier — your name, address and phone, so your order can be delivered.
• Stripe — payment processing.
• Resend — sending order confirmations and account email.
• UploadThing — storing product and profile images.
• Neon — our database.
• Upstash — rate limiting that protects the sign-in form.
• Vercel — hosting.
• Google and Facebook — only if you choose to sign in with them.

Every provider listed above operates outside Egypt, so your personal data is processed abroad — our database is hosted in the European Union, and the others process data in the European Union or the United States.

We rely on written data-processing terms with each provider. Where Egyptian law requires an approval, permit or licence for a particular transfer, we obtain it. [CROSS-BORDER TRANSFER STATUS]

Order, payment and invoice records are kept for as long as accounting and tax law requires. Your account and the data attached to it are kept until you ask us to delete them. Marketing subscriptions are kept until you unsubscribe.

You may ask us to:

• tell you what personal data we hold about you, and give you a copy
• correct anything inaccurate or incomplete
• delete your data, where we are not legally required to keep it
• stop using your data for marketing, at any time
• withdraw a consent you previously gave
• object to a particular use of your data

You can delete your account yourself from your account settings. When you do, your orders remain in our records as anonymous entries, because tax law requires us to keep the transaction — but they are no longer linked to you.

To exercise any of these rights, contact [PRIVACY CONTACT EMAIL]. If you are not satisfied with our answer, you may complain to Egypt's Personal Data Protection Centre, or to the Consumer Protection Agency on 19588.

Passwords are stored hashed. Card details never reach our systems. Access to customer records is limited to staff who need it for their work.

If we change this policy we will update the date at the top. Material changes will be brought to your attention rather than made quietly.