Privacy policy

Privacy policy — draft for business review We collect account identity/contact information, delivery details, order records and consent preferences to provide the store, fulfil purchases, support customers and meet applicable record-keeping duties. Please do not send card details in messages or the shopping assistant. Passwords are stored using a one-way password hash. Account activation requires a verification link. Email delivery providers process account verification, invitation and service messages when configured. Payment providers process payment details through their own hosted services; the store retains order/payment references and confirmation status. Delivery information may be provided to your selected carrier to fulfil your order. WhatsApp opens only when you choose it and is subject to its own privacy terms. Social-profile links lead to external services. If AI matching is enabled, your question and public catalogue data are sent to the configured AI provider; do not include personal, financial or private order information. AI suggestions do not change prices, stock or orders. Essential storage supports sign-in, country preferences and shopping. Optional first-party analytics records public page paths, selected country and a random session identifier only after analytics consent. Declining analytics does not prevent shopping. Query strings, account pages and private order pages are excluded. Analytics records are retained for up to 90 days. Account, order and consent records are retained for service, dispute handling and applicable legal record-keeping requirements. Operational backups may retain older records until their normal retention period expires. We do not promise immediate deletion where records must be retained or an active dispute requires them. Depending on applicable New Zealand, Indian or UAE law, you may request access, correction, deletion or withdrawal of optional consent, and may complain to the appropriate authority. Contact the business using the details shown with this policy. We assess requests and explain any lawful retention requirements. Marketing consent is optional and can be withdrawn separately from essential account and order processing. Data may be processed by hosting, payment, delivery, email and optional AI providers outside your country. The business must confirm its provider agreements, transfer arrangements, retention periods and actual practices before publishing this policy. We apply appropriate access controls but cannot guarantee that any online service is free of every security risk. We update this policy when practices change and record the version accepted at registration. This policy does not remove rights granted by applicable consumer or privacy law. Material business-specific details and country requirements must be reviewed before publication.