Privacy Policy

To fulfil orders and provide our services, we collect:

• Account data: email or Telegram username and avatar from sign-in
• Delivery data: recipient name, phone number, shipping address, postcode
• Order data: products purchased, amounts, payment method, order time
• Payment proof: bank transfer screenshots (only when uploaded for manual review)
• Device data: IP address, browser type, access time (for fraud prevention)
• Bot-check results: whether a CAPTCHA challenge passed, plus risk score

Your information is used only for:

• Processing orders, arranging delivery and providing after-sales support
• Verifying account authenticity and transaction security (fraud and abuse prevention)
• Sending order status notifications such as shipping updates
• Improving our products and services (based on anonymised statistics)
• Meeting legal obligations such as retaining tax records

We never sell, rent or trade your personal information to third parties.

We never send marketing email without consent (newsletter opt-in is separate and can be withdrawn at any time).

We never store your card number or CVV — card payments are handled directly by licensed processors such as Stripe.

We share only the minimum necessary with:

• Couriers: recipient name, phone and address (delivery only)
• Payment processors: order amount and transaction reference (never the full card number)
• SMS providers: phone number (verification codes only)
• Cloud hosting: data storage under a data processing agreement
• Law enforcement: only where legally compelled

We apply the following technical and organisational controls:

• HTTPS encryption for all traffic
• Passwords stored as salted hashes, never reversible
• Secrets (payment keys, TOTP seeds) encrypted at rest with AES-256-GCM
• Database reachable only on a private network, never publicly exposed
• Critical operations written to a tamper-evident audit log
• Least-privilege access for staff accounts

Different data is kept for different periods:

• Orders and transactions: 7 years (tax and legal requirements)
• Account data: purged within 90 days of account deletion
• Payment proofs: 3 years (financial reconciliation)
• Access logs: 90 days

Under the Personal Data Protection Act you may:

• Access: request a copy of the data we hold about you
• Correct: ask us to fix inaccurate information
• Erase: request deletion of your account and data (subject to legal retention)
• Object: refuse processing for marketing purposes
• Port: export your data in a machine-readable format

We use the following:

• Session cookie: keeps you signed in (HTTP-only, not readable by JavaScript)
• Language preference: remembers your chosen locale
• Cart identifier: associates a guest cart with your browser

This site is not intended for anyone under 18. We do not knowingly collect personal data from minors and will delete it if discovered.

We will announce material changes on the site and notify registered users. Continued use of the site constitutes acceptance of the updated policy.