Privacy policy
What personal data LAYAN collects, why, who processes it, how long we keep it, and how you can see, correct or delete it.
Last updated: 26 September 2026
This policy explains what personal data we collect when you use the LAYAN store, why we collect it, who we share it with, and the choices you have. The LAYAN store is operated by [Legal entity name] ("LAYAN", "we", "us"), which is responsible for your data.
At a glance
- We collect only what we need to take, deliver and look after your orders.
- We don't sell your data, and we don't use advertising or cross-site tracking cookies.
- Your bag and wishlist are saved on your device.
- You can see and update your details, or delete your account, from your account pages at any time.
What we collect
Information you give us
- Account: your name, email address and password. Your password is stored only as a secure one-way hash, so no one at LAYAN can see it.
- Contact and delivery: your phone number and delivery addresses (city, area, street, building, floor, landmark and any delivery notes).
- Orders: the pieces, sizes and quantities you order, prices, the currency you choose, any coupon, and your order history.
- Returns: the pieces you return, your reasons and any notes you add.
- Conversations: when we call or message you to confirm an order, or when you contact us, we note the outcome (for example "confirmed" or "no answer") and anything needed to help you.
Information created as you shop
- Delivery records: delivery attempts, which pieces you accepted or refused, and the cash collected.
- Account history: how many deliveries were refused, and notes our team adds to serve you better.
- Email records: the service emails we send you and whether they were delivered, so we stop emailing addresses that bounce.
Information collected automatically
- Technical data: your IP address, browser and device type, and the pages requested. We use it to run the store, keep it secure (for example, limiting repeated sign-in attempts) and fix problems.
- Error reports: if a page fails, a report with technical details about the error and your browser is sent to our error-monitoring service so we can fix it.
- Visit statistics: we count visits in aggregate (for example, which pages are viewed most) with a privacy-friendly analytics tool that doesn't use cookies or collect personal data.
We don't collect card or bank details: we only accept cash on delivery.
Why we use it
We use your data only for these purposes, each with a legal basis:
- To create and run your account (to perform our agreement with you).
- To confirm, prepare and deliver your orders and collect payment (to perform our agreement with you).
- To handle returns, exchanges and refunds (to perform our agreement with you).
- To send service emails, such as email verification, password reset and updates on your orders and returns (to perform our agreement with you).
- To keep the store and our customers safe, prevent fraud and abuse, and manage repeated delivery refusals (our legitimate interests).
- To understand how the store is used and fix errors (our legitimate interests).
- To keep accounting and tax records (our legal obligations).
We don't send marketing messages unless you've agreed to receive them, and you can withdraw that consent at any time.
Cookies and local storage
We use only what the store needs to work:
- Sign-in cookie: a secure cookie that keeps you signed in. It can't be read by scripts on the page and expires after 30 days without use, or when you sign out.
- Your bag and wishlist: saved in your browser's local storage on your device. They aren't linked to your account, and we only see what's in your bag when the store checks prices and stock or when you check out.
- Checkout: a temporary value in your browser's session storage prevents the same order from being placed twice.
We don't use advertising, social media or third-party tracking cookies. You can clear cookies and site data in your browser settings; this signs you out and empties your bag and wishlist on that device.
Who we share it with
We share only what each party needs, and only for the purposes above:
- Our delivery team: they are LAYAN staff, not a courier company, and see your name, phone, address, pieces and amount to collect only for orders assigned to them.
- Service providers who process data on our behalf, under our instructions: Render (hosting for our servers and database), Cloudflare (network security, content delivery and file storage), Resend (sending emails), Sentry (error monitoring), and our privacy-friendly analytics provider.
- Authorities, when the law requires it, or to protect our rights and our customers' safety.
- A buyer or successor, if the LAYAN business is sold or reorganized, under this same policy.
We never sell or rent your personal data.
International transfers
Some of our service providers process data in other countries, such as the United States or the European Union. We choose providers that protect data with appropriate safeguards.
How long we keep it
- Account and profile data: for as long as your account is open.
- If you delete your account: we delete your sign-in details and sessions, remove your name, email, phone number and saved addresses, and anonymize your past orders. We keep the anonymized order, payment and return records for accounting and legal reasons; they no longer identify you.
- Orders placed by phone without an account: for as long as needed to deliver and support the order and to meet our legal obligations.
- Sessions: they end after 30 days without use, or when you sign out.
- Technical logs and error reports: for a limited period, then deleted.
Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy of it, and withdraw any consent you've given. You may also complain to your local data protection authority.
- Update your name, phone and addresses at any time in your account.
- Delete your account from your account page. This can't be undone.
- For anything else, email us at [Contact email]. We may ask you to confirm your identity, and we'll reply within 30 days.
How we protect it
The store runs over an encrypted connection (HTTPS). Passwords are hashed, sign-in cookies are secure and hidden from scripts, and sign-in attempts are rate-limited. Our team's access is limited by role and protected with two-factor authentication, and delivery staff see customer details only for the deliveries assigned to them. No system is perfectly secure, but we work to protect your data and will act promptly if something goes wrong.
Children
The LAYAN store is intended for adults. We don't knowingly collect data from anyone under 18. If you think a child has given us their data, contact us and we'll delete it.
Changes to this policy
We may update this policy as the store evolves or the law changes. We'll change the date at the top, and tell you by email or on the store before any significant change takes effect.
Contact us
[Legal entity name], [Registered address]. Email: [Contact email]. You can also reach us through the Contact us page.