Privacy Policy

01Information We Collect

• Account information: name, email address and phone number when you create a customer account. We sign you in with a one-time code sent to your email (or phone) — customer accounts have no password, so we do not collect or store one.
• Order & shipping information: delivery name, address and phone number, the items ordered, order status history, any coupon code used, and — for bank-transfer orders — the payment screenshot you upload so our team can verify the transfer. For gift cards, we also keep the recipient details and message you enter.
• AI Search photos: if you use our photo-based "AI Search" feature, the image you upload is analysed to find visually similar pieces, and a copy of the photo and the result is kept so our team can review and improve search accuracy. Please don't upload photos of people. See the Cloudflare Turnstile & AI Search section below.
• Communications: messages you send us via WhatsApp, our Support page, or email, and our replies to them.
• Browsing & device data: pages viewed, products browsed, your IP address, basic device/browser information, and page-load performance measurements that help us keep the site fast.
• Saved pieces: pieces you save to your wishlist are kept in your browser. Saving a piece also records a random, anonymous browser identifier so we can show how many shoppers have saved it — it is not linked to your name.
• Reviews & returns: reviews you write (including any photos you attach) and, if you request a return, the reason, details and photo you provide and the refund method you choose.
• Payment information: we do not receive or store your card number, expiry date or security code — these are entered on our payment provider's own secure page. We keep only the payment status and reference needed to match the payment to your order.
• Cookies & local storage: small amounts of data stored in your browser to keep your sign-in session, cart, saved pieces and preferences (language, currency, delivery country, recently viewed pieces) working between visits. See Cookies & Local Storage below.

02How We Use Your Information

We use the information above to:

• Process, ship, and provide support for your orders and gift card purchases;
• Verify bank transfer payments and prevent fraud or abuse;
• Respond to enquiries sent via WhatsApp, Support, or email;
• Operate account features such as order history, wishlist, and recently viewed pieces;
• Protect our login and checkout pages from automated abuse (see Turnstile, below); and
• Improve our AI Search results and catalogue accuracy.
• Send transactional emails and WhatsApp messages about your orders, returns, gift cards and sign-in codes;
• Calculate delivery fees, arrange couriers and deliver your parcels;
• Display and moderate the reviews you submit; and
• Keep the records we need for accounting, tax and other legal obligations, and to establish or defend legal claims.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We only send you marketing messages if you have asked for them.

03Third-Party Services We Use

Al Shawl House is built on a small number of trusted infrastructure providers, each of which processes data strictly on our behalf to run the site:

• Supabase — stores account, order, and gift card data, and handles sign-in security.
• Vercel — serves our website application and provides privacy-friendly performance measurement (Speed Insights) that doesn't use advertising cookies.
• Cloudflare — runs our back-end services and image storage (Workers & R2), and provides the Turnstile bot-protection widget described below.
• Resend — sends our transactional emails (sign-in codes, order and return updates, gift card emails) on our behalf.
• Delivery couriers — receive your name, delivery address and phone number so they can deliver your parcel.
• Thawani Pay — processes card payments when you choose to pay by card. Your card number, expiry, and security code are entered directly on Thawani's own secure payment page and are never received, transmitted, or stored by Al Shawl House.
• Anthropic (Claude) — powers our AI Search feature by analysing photos you choose to upload, purely to find similar pieces in our catalogue.
• WhatsApp Business — used for order-related communication and gift card redemption when you choose to contact us that way.

04Cloudflare Turnstile & AI Search

Our sign-in, sign-up, and admin login pages use Cloudflare Turnstile, a privacy-friendly alternative to traditional CAPTCHAs, to tell real visitors apart from automated bots. When you interact with these pages, Turnstile may collect technical signals such as your IP address, browser and device characteristics, and interaction patterns, and share a pass/fail result with us — it does not ask you to solve puzzles or identify images. Turnstile is provided and operated by Cloudflare, Inc.; you can read more in Cloudflare's Privacy Policy.

Separately, photos you upload to our AI Search feature are sent to Anthropic's Claude API to identify matching fabrics, patterns and colours in our catalogue. We keep a copy of the photo and the result so our team can review search quality; we do not use them for advertising and do not share them except with the service provider that analyses them.

05Cookies & Local Storage

We use only the cookies and browser storage the site needs to work: your sign-in session, your language preference, your cart, saved pieces, currency, delivery country and recently viewed pieces. Cloudflare Turnstile may set its own technical cookies to tell real visitors from bots. We do not use advertising or cross-site tracking cookies.

You can clear or block cookies and site data in your browser settings, but parts of the site (such as staying signed in or keeping a cart) may then not work.

06Sharing & International Transfers

We share personal data only with the service providers listed above, as needed to run the site and fulfil your order; with authorities or other parties when the law requires it or to protect our rights, customers or the site; and with a successor if our business is ever sold or reorganised.

Some of our providers store or process data outside Oman (for example in the EU or the United States). By using the site you understand your data may be processed in those locations, and we choose providers that apply appropriate safeguards.

07Data Retention

We keep account information for as long as your account is active, and order, payment and return records for as long as needed to meet our legal, tax, accounting and reporting obligations and to handle any claim. Payment screenshots, sign-in codes and AI Search photos are kept only as long as needed for their purpose. You may ask us to delete your account at any time — see "Your Rights" below; some records (such as completed orders) may need to be kept where the law requires it.

08Your Rights & Choices

You can review and update most of your account information from your account dashboard. You may also ask us to give you a copy of your personal data, correct it, delete it, restrict or object to certain uses, or withdraw any consent you have given — please reach out via our Support page and we will respond as soon as possible.

09Children's Privacy

Our website and services are not directed at children, and we do not knowingly collect personal information from anyone under the age required to enter into a purchase agreement under Omani law. If you believe a child has provided us with personal information, please contact us so we can remove it.

10Data Security

We take reasonable technical and organisational measures to protect your information, including one-time-code sign-in with no stored customer passwords, encrypted connections, role-based staff access and an activity log of account-level actions taken by our team. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you and the relevant authorities where the law requires.

11Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. The "Last updated" date at the top of this page will always reflect the most recent version.

12Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please reach out via our Support page or email us at •••@•••••••••.•••.