Privacy & Cookie Policy

1. Data we collect

• Account & sign-in: your email address. If you sign in with Google, we receive your basic Google profile (name and email) — we never receive your Google password. We use passwordless sign-in, so we do not store passwords.
• Orders & reservations: the models you reserve or buy, your chosen currency (AED or PKR), order status and history.
• Payment proof: the screenshots or documents you upload to confirm a bank transfer. These may contain your name and bank details, and are stored privately — visible only to you and our staff.
• Delivery & contact details: the shipping and contact information you give us (for example over WhatsApp) so we can deliver and track your order, plus the courier and tracking number.
• Technical data: IP address, device and browser information, and timestamps recorded automatically in our hosting logs, plus the cookie described in section 4.

2. How we use your data & our legal bases

Under the GDPR we rely on the following legal bases:

• To run the shop, take reservations, and fulfil and deliver your orders — performance of a contract.
• To create and secure your account and sign you in — performance of a contract.
• To verify payments and prevent fraud, and to keep the service secure and working — our legitimate interests.
• To keep tax, accounting, and transaction records — compliance with a legal obligation.
• To send optional updates or offers, and to set analytics cookies — only with your consent, which you can withdraw at any time.

3. Who we share it with

We do not sell your personal data. We share it only with the service providers that help us run the shop, and only as needed:

• Supabase — our database, authentication, and file storage (hosts your account, orders, and payment-proof uploads).
• Vercel — website hosting and content delivery (serves the site and keeps access logs).
• Google — only if you choose to sign in with Google.
• Couriers — the delivery company handling your order, so it can reach you.

We may also disclose data where required by law, or to protect our rights, safety, or property.

4. Cookies

A cookie is a small file stored on your device. We keep our use of them minimal:

• Strictly necessary: a session cookie that keeps you signed in and secures your account. The site cannot work without it, so it does not require consent and is always on.
• Optional analytics:if you accept, we may set analytics cookies to understand how the shop is used and improve it. These are never set unless you choose “Accept all”. We currently run no advertising or third-party tracking cookies.

You can change your choice at any time using the Cookie preferences link in the footer, or by clearing cookies in your browser.

5. International transfers

Our providers may process your data outside your country — for example, our database is hosted in India and our website is served from global edge locations. Where data leaves the EEA or UK, we rely on appropriate safeguards (such as the providers' standard contractual clauses) to protect it.

6. How long we keep it

We keep your account data for as long as your account is active. Order, payment, and transaction records are kept for as long as needed to fulfil your order and to meet tax and legal requirements. Payment-proof uploads are kept only as long as needed for our records and then deleted. You can ask us to delete your account and associated data (see section 8), subject to records we must retain by law.

7. How we protect it

Access to your data is restricted by row-level security so customers can see only their own records; payment-proof files are stored in private storage; and all traffic to the site is encrypted in transit (HTTPS). No system is perfectly secure, but we take reasonable measures to protect your data.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• ask us to delete your data;
• restrict or object to how we use it;
• receive your data in a portable format;
• withdraw consent at any time (without affecting past processing); and
• complain to your local data-protection authority.

To exercise any of these, email us at admin@dismo79.com. We'll respond within the time required by law.

9. Children

The shop is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will remove it.

10. Changes to this policy

We may update this policy from time to time. When we do, we'll change the “Last updated” date above, and for significant changes we'll take reasonable steps to let you know.

11. Contact us

Questions about your privacy or this policy? Email admin@dismo79.com.