Privacy policy

What we collect

When you create an account we store:

• Your name and email address
• Your phone number, which is how we confirm orders
• A password, which is hashed and never readable by us

When you place an order we store:

• The delivery address you enter — city, street, building and floor
• The name and phone number for the delivery
• What you ordered, at the price you paid, kept as a snapshot so your order does not change if a product is later renamed or repriced
• Any note you add for the courier

If you sign up for our welcome offer we store:

• Your email address, and when you gave it to us
• The welcome code issued to you, and whether it has been used

We take no payment details, because every order is cash on delivery. There is no card number to store or leak.

Where it is kept

• Supabase holds accounts and orders, in a database hosted in Frankfurt, Germany.
• Cloudflare serves the site and stores product photography. Cloudflare Web Analytics counts visits without cookies and without tracking you between sites.
• Resend sends your order confirmation email and, if you sign up, your welcome code.
• Sentry records technical errors so faults can be fixed. Error reports may include the page you were on.

Who can see it

Your account, your addresses and your orders are readable only by you and by Aruera. This is enforced by the database itself rather than by the website asking politely — every table carries row-level rules keyed to your account, so a request for someone else's order returns nothing.

What we do not do

• We do not sell or share your details with anyone.
• We do not use advertising or tracking cookies. The only things stored in your browser are your login session and your bag.
• We do not email you marketing unless you ask us to.

Your bag

What you add to your bag is kept in your own browser, not on our servers. Clearing your browser data clears it.

Getting your data, or having it removed

You can see and change your details at any time in your account. To have your account deleted, get in touch and we will remove it.

Needs confirming: Two things a lawyer should settle: how long order records are kept (there is usually a tax or accounting minimum in Lebanon that overrides a deletion request), and the business name and address this policy is issued under. Have someone qualified read this before launch — it is accurate about what the software does, which is not the same as being legally complete.