Privacy Policy

1. Who we are

ArAm is the brand of the business registered in Saudi Arabia as "خياط تصاميم ارام للخياطة النسائية" (the legal name is in Arabic; we do not use an official English translation). We are responsible for the personal data described here.

Email: info@aram-designs.com
Address: 8161 Al Muheet Street, Al Rabie, Riyadh 13316, Additional No. 3264, Saudi Arabia

2. What we collect and how

We collect data directly from you through our website and, where you choose, from sign-in and payment providers:

Account data: name, email address, phone number and password (passwords are handled by our authentication provider; we never see them in plain text). If you sign in with Google, Google shares your name and email with us.
Delivery data: address, city, country, postal code and Saudi short address.
Order data: items, sizes, notes you add, amounts, order language, order status, receipts and tax invoices.
Payment data: payment status and references from our payment providers. Card details are entered on the provider's own page and are not stored by us.
Bag and preferences: items saved in your bag, chosen display currency and language.
Messages: what you send us by email or WhatsApp if you contact us.
Technical data: your device and connection details (such as IP address) are processed by our hosting network to deliver and secure the website.

Fields marked as required at sign-up or checkout are needed to create your account or fulfil your order; without them we cannot provide that service. Anything else is optional.

3. Why we use it (purposes and legal bases)

We use personal data only for these purposes:

To create and manage your account and let you sign in — needed to provide the service you request.
To process orders, payments, delivery and after-sales service, and send order emails such as confirmations and receipts — needed to perform our agreement with you.
To keep accounting, VAT invoices and commercial records — required by Saudi law.
To secure the website and prevent misuse — our legitimate interest in a safe service.
To understand overall site use through anonymous statistics (see Analytics).

Ticking "I have read and acknowledge the Privacy Policy" at registration confirms that this policy was made available to you. It is not a blanket consent to every use: we rely on consent only where the law requires it, and we will ask for it separately. We do not send marketing messages and do not sell personal data.

4. Analytics and cookies

We use our website platform's built-in analytics, which according to the provider does not use analytics cookies or build profiles across visits. It reports aggregated figures such as visits, country, referring source, pages viewed and device type.

We do not use Google Analytics, Google Tag Manager, Meta (Facebook) Pixel, Snapchat Pixel or session-recording tools.

Functional storage only: we keep your sign-in session, bag, language, display currency and dismissed-message choices in your browser, plus secure cookies for preview access while the site is in pre-launch. Our hosting network may set a short-lived security cookie to protect against automated abuse. These are needed for the site to work and are not used for advertising.

5. Who receives your data

We share personal data only with service providers that help us run the shop, and only what each needs:

Supabase — stores our database and accounts (hosted in the EU, Frankfurt region).
Our website platform and its hosting network — serve the website and process connection data.
Google — only if you choose to sign in with Google.
Tamara — buy-now-pay-later provider; receives order, contact and delivery details to process your payment.
Tap Payments — card payment provider (currently in testing); receives order reference, amount and contact details. Card details are entered on Tap's page.
Qoyod — our accounting system; receives customer name, contact details, invoices and payment records for paid orders.
Resend — sends our order emails; receives your email address, name and order details.
DHL — shipments are booked manually by our team, who share the delivery name, address and phone needed for delivery.
WhatsApp and Instagram — we only link to them; data is shared there only if you choose to contact us, under their own policies.
Authorities — where required by law.

6. Processing outside Saudi Arabia

Not all data is kept in Saudi Arabia. Our database is hosted in the European Union (Frankfurt), and some of the providers above may process data in other countries. We transfer data only as needed for the purposes described here. If you have questions about a specific provider, contact us.

7. How long we keep it and how we destroy it

VAT invoices, supporting tax records, commercial books and related documents: 10 years from the end of the relevant record period, or longer where a legal hold applies.
Abandoned bags: saved bag items are deleted automatically 60 days after the last change to the bag. Browser-only bags expire on this device after the same period.
Account, profile and other data: kept only as long as necessary for the purpose it was collected for, then destroyed, unless the law requires us to keep it longer.

Destruction means deleting data so it can no longer be used to identify you.

8. Your rights

Subject to the Personal Data Protection Law, you have the right to:

Be informed about how your data is collected and used (this policy).
Access your personal data and obtain a copy in a readable format.
Ask us to correct, complete or update your data. You can also edit your profile in your account.
Ask us to destroy data we no longer need, except where the law requires us to keep it (for example tax records).
Withdraw consent at any time where we rely on consent; this does not affect earlier lawful processing.

To exercise a right, email info@aram-designs.com from the email linked to your account. You can still sign in to your account to view your orders and profile. We may need to verify your identity before acting.

9. Security

We use access controls, encrypted connections and restricted staff permissions to protect personal data. No online service can be completely secure; if a breach affects you, we will act as the law requires.

10. Questions and complaints

Contact us first at info@aram-designs.com. You also have the right to file a complaint with the Saudi Data & AI Authority (SDAIA), the competent authority for personal data protection.

11. Changes to this policy

If we change this policy in a meaningful way, we will update the version shown above and ask you to review it again before your next purchase.