Privacy Policy

This policy applies to azafahusa.com and to anything you send us through it — an order, an account, a message through the contact form or a newsletter sign-up. Azafah is the controller of that data.

If something here is unclear, ask us at support@azafahusa.com. A privacy policy nobody can get an answer about is not doing its job.

Only what an order or an account actually needs:

• Your name, email address, delivery address and phone number, when you give them to us.
• Your order history, and any returns or messages attached to it.
• Account credentials — your password is stored hashed, never in plain text, and we cannot read it.
• Payment details, which go directly to Stripe. Full card numbers never reach our servers.
• Standard server logs such as IP address and browser type, which every website receives by virtue of serving a page.

For the cookies and browser storage involved, see the Cookie Policy, which lists every single one by name.

• To take payment and get your order to the right address.
• To email you about that order — confirmation, dispatch, tracking and returns.
• To run your account, including your wishlist and order history.
• To answer your messages, and to keep a record of what was agreed.
• To send marketing email, but only if you asked for it, and only until you tell us to stop.
• To send one reminder if you start checkout and do not finish, unless you turn these reminders off from the link in it.
• To prevent fraud and abuse, and to meet tax and accounting obligations.

We use a small number of service providers to run the shop. Each one gets only what it needs to do its job, and none of them may use your data for their own purposes.

StripePayment processing

Card details, billing address and order amount. Card numbers go to Stripe directly and are never stored on our servers.

VercelHosting and delivery

Standard server request data such as IP address and user agent, used to serve the site and keep it secure; and Vercel Web Analytics and Speed Insights, which count page visits and measure loading speed without cookies and without identifying you.

Shipping carriersDelivery

The recipient name, delivery address and contact details needed to hand over a parcel.

Google WorkspaceTransactional and marketing email

Your email address and the contents of messages we send you, such as order confirmations and shipping updates.

We also disclose data where the law genuinely requires it — a court order, a lawful request from an authority, or to establish or defend a legal claim.

We do not sell, rent or trade your personal information, and we do not share it with advertising networks or data brokers. The site runs no advertising pixels and no cross-site trackers. It counts visits and measures loading speed with Vercel Web Analytics and Speed Insights, which use no cookies and do not identify you, so there is no behavioural profile of you to sell in the first place.

• Account data: for as long as your account is open, and deleted when you close it.
• Order records: retained for the period tax and accounting law requires, even after an account closes.
• Contact messages: kept while the query is open and for a reasonable period afterwards, in case you write again about the same thing.
• Marketing consent: kept until you withdraw it, along with a record of the withdrawal so we honour it.

The site is served over HTTPS, passwords are stored hashed, session cookies are set httpOnly and SameSite so scripts cannot read them, and card data is handled by Stripe rather than by us. Access to customer records is limited to the people who need it to run the shop.

No system is perfectly secure, and anybody who tells you otherwise is selling something. If we ever discover a breach affecting your personal data, we will tell you and the relevant authority as the law requires.

Wherever you live, you can exercise all of the following by emailing support@azafahusa.com. We will not charge you for it and we will not make it difficult.

Get a copy

Ask for everything we hold about you, and we will send it in a readable format.

Correct it

Most details can be fixed yourself in your profile. Ask us for anything you cannot reach.

Delete it

Ask us to erase your account and personal data. Records we are legally required to keep, such as completed order and tax records, are the exception.

Stop marketing

Unsubscribe from any marketing email, or change it in your account. Order and return emails still reach you, because they are part of the purchase.

Object or restrict

Tell us to stop or limit a particular use of your data, and we will unless we have a legal reason not to.

We aim to respond within 30 days. If you are in the UK or EU you may also complain to your data protection authority; if you are in California, you have these rights under the CCPA and will not be treated differently for using them.

This shop is intended for adults and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal information, tell us and we will delete it.

When this policy changes in substance, the effective date at the top changes with it. That date is set by hand when the text is edited, so it reflects a real revision rather than the day you happen to be reading.

Effective 24 September 2026 (2026-09-24).