Privacy notice

Your details, kept with care.

This page explains what we collect when you order from us or make an account, why we need it, who helps us handle it, and how you can see or delete it.

Last updated

Who we are

DAR is a small studio making hand-embroidered pieces in Beirut. We run this website and decide what happens to the details you give us here. You can reach us at:

What we collect and why

When you place an order

We ask for your first and last name, email, phone number, delivery address (address, city, region and country) and any delivery notes you add. We also keep what you ordered: the pieces, the options you chose, and the name or text you want embroidered with its lettering, size and thread colour.

We use this to make your piece, deliver it, contact you about it (by email, and on WhatsApp at the phone number you give us), and keep a record of the sale. Each order gets a private link so you can follow it without an account.

You pay cash on delivery. We don’t take card payments on this site, so we never see or store card details.

When you make an account

An account is optional. It holds your email, your name, your phone number if you add it, the delivery addresses you save, and your orders.

  • Google or Apple: if you choose to continue with Google or Apple, they tell us your name, your email, whether that email is verified, and an ID for your account with them. We don’t get your Google or Apple password.
  • Email and password: if you sign up with an email and password, we store only a scrambled form of the password (a scrypt hash), never the password itself. We email you a link to confirm your address, and a link to reset the password if you ask for one.

Technical data

We use only the cookies needed to sign you in. There are no analytics, advertising or tracking cookies, and no analytics or ad scripts on the site.

dar_customer
Keeps you signed in to your account. Set when you sign in, lasts up to 30 days, and is removed when you sign out. We store only a hash of it.
dar_oauth
Set for 10 minutes while you sign in with Google or Apple, to check that the reply really comes from your own sign-in. Cleared when you’re done.
dar_admin
Used only by the shop owner to sign in to the shop’s dashboard. Customers never get it.

Your bag and any personalisation you haven’t ordered yet are saved in your own browser (local storage) so they’re still there when you come back. They stay on your device and aren’t sent to us until you place an order.

To stop abuse, we count sign-in, sign-up, password-reset and order attempts. These counts are kept against your IP address and, for sign-in and reset, a hash of your email rather than the address itself. Counts older than a day are cleared regularly.

Who helps us handle it

We don’t sell your details or share them for advertising. A few services run parts of the shop for us and handle data only to do that:

  • Vercel hosts the website. Product photos are stored with Vercel Blob.
  • Neon hosts the database where orders and accounts are kept.
  • Resend sends our emails: order confirmations, order updates, and account confirmation and password-reset links.
  • Google and Apple, only if you choose to sign in with them.
  • WhatsApp, only if you message us there, or when we message you about your order at the number you gave us.

The couriers who deliver your order receive what they need to do it, such as your name, phone and address.

How long we keep it

  • Orders are kept for as long as we need them for our records and legal obligations.
  • Accounts stay until you delete yours, or ask us to.
  • Sign-in sessions and emailed links expire on their own (confirmation links after 48 hours, reset links after 1 hour) and expired ones are cleaned up.

You can ask us to delete your details at any time. Once an order is finished (delivered, cancelled or refunded), we can erase you: your name, contact details, address, notes and embroidered text are removed from the order, and only what our accounts need is kept, such as the amounts, the pieces and the destination country.

Your choices

  • Order as a guest. You don’t need an account to buy from us.
  • Download your data. In your account, “Download your data” gives you a file with your details, saved addresses, sign-in methods and orders.
  • Delete your account. “Delete my account” on the same page removes your details, saved addresses and sign-ins, and signs you out everywhere. Past orders stay for our records, no longer linked to you.
  • Guest orders, or a full erase. Message us on WhatsApp or by email and we’ll delete your details from your orders as described above.
  • Correct your details. Change your name, phone and saved addresses in your account, or ask us to correct anything else.

Security

The site runs over HTTPS. Passwords are stored only as scrypt hashes, and sign-in cookies and emailed links are stored only as hashes, so a copy of our database can’t be used to sign in as you. Sign-in cookies can’t be read by scripts on the page. Repeated sign-in and order attempts are limited, and the dashboard where we manage orders needs the owner’s password. No system is perfectly secure, but we keep what we hold to what the shop needs.

Changes and contact

If we change how we handle your details, we’ll update this page and the date at the top. Questions, or a request to see or delete your data? Get in touch: