At Zaytoun Store, we value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our chat assistant, or make a purchase, and it names the outside services that handle your information for us.

Information We Collect

Personal Information

We collect personal information that you voluntarily provide to us when you:

Create an account on our website
Place an order for products or services
Sign up for our newsletter
Contact our customer service team
Chat with our AI assistant
Apply for a job, an internship or an academy program, or make a donation
Participate in promotions or surveys

This information may include your name, email address, phone number, delivery address, order history and the content of the messages you send us. We do not take card payments on our website, and we never receive your Whish account password: online payments are made on Whish Money's own page.

Automatically Collected Information

When you visit our website, we may automatically collect certain information about your device, including:

IP address
Browser type and version
Operating system
Pages visited and time spent on those pages
Referring website addresses
Error reports when something goes wrong on a page

We also record, in our own database, how visitors move through the store (for example viewing a product, adding it to the cart and checking out), with your browser's user agent, the referring page and your device type, linked to a random session identifier and, if you are signed in, to your account.

How We Use Your Information

We only collect data necessary to enhance your shopping experience and provide our services. We may use your information to:

Process, deliver and support your orders
Communicate with you about your orders, products, and services
Send you alerts you asked for, such as wishlist price drops or back-in-stock notices
Remind you about items left in your cart, if you are signed in
Send you marketing communications (if you've opted in)
Run our loyalty program, gift cards and account balance
Answer your questions through our chat assistant
Improve our website and product offerings
Respond to your inquiries and provide customer support
Find and fix errors, prevent fraud and enhance security

Service Providers That Process Your Information

We use the following outside services to run our website and business. Each receives only the information it needs for the purpose described.

Hosting, accounts and storage

Vercel: Hosts our website and runs the server code that handles your requests, orders and messages. Information involved: Everything you send to the website passes through it, together with technical request data such as your IP address and browser type.
Google Firebase (Authentication and Cloud Firestore): Manages sign-in to your account and is our main database. Information involved: Your account details (name, email address, phone number), addresses, orders, cart, wishlists, recently viewed products, search history, loyalty points, account balance, saved preferences and messages you send us.
Supabase: Stores files for our website. Information involved: Product images and documents we generate or receive, such as invoices and files attached to job applications.
GitHub: Runs our scheduled maintenance jobs, such as cart reminder emails and clearing out unpaid orders. Information involved: While a job runs it reads the records it works on, such as your email address, cart and order details. The job's log, which GitHub keeps for up to 90 days, can include the email address a reminder was sent to.
Sign-in providers (Google, Google Play Games, Facebook, GitHub, X (Twitter), Microsoft, Apple, Yahoo): Only if you choose to sign in with one of them instead of a password. Information involved: That provider confirms your identity to us and shares basic profile information such as your name and email address.

Payments and delivery

Whish Money: Processes online payments from your Whish account, including bank transfer via Whish. It does not take card payments. Information involved: The amount, currency and order reference. You pay on Whish's own page; we do not receive or store your Whish login details.
iCarry (our delivery partner, currently delivering through Aramex): Calculates the delivery cost at checkout and delivers your order. Information involved: Your name, phone number, email address, delivery address, your order number, the weight, size and declared value of your parcel, and the amount to collect if you pay cash on delivery.

Communications

Namecheap Private Email and Google Gmail: Send our emails, such as order confirmations, password resets, verification codes, newsletters, wishlist alerts and replies to your messages. Gmail is used as a backup when our main mail server is unavailable. Information involved: Your email address, your name and the content of the email.
Telegram: Sends private alerts to our staff when something needs their attention. Information involved: For a new order: your name, email address, phone number, delivery address, the items ordered and the total. For gift card purchases: your email address and the gift card code. For contact forms, academy sign-ups, newsletter subscriptions and job applications: the details you submitted in that form. For donations: the amount and currency.

Analytics, monitoring and site features

Google Analytics: Helps us understand how visitors use our website. It is loaded only if you accept analytics cookies. Information involved: Pages visited, how you arrived, device and browser information and approximate location. We ask Google to anonymize your IP address.
Vercel Web Analytics and Speed Insights: Count page visits and, when switched on, measure how fast pages load. Information involved: Pages visited, referring site, browser, device type and country. These tools do not use cookies.
Rollbar: Reports errors so we can fix them. Information involved: The error, the page it happened on, your browser and device, your IP address, and a short record of what happened on the page just before the error (such as pages viewed, clicks and network requests). The values you type into form fields are masked, and passwords and access tokens are removed before a report is sent. The addresses of pages and requests are recorded, so they can include what you searched for or the email address on a verification page.
Statsig: A feature-management service connected to our website. We do not currently use it to change what you see. Information involved: A random identifier for your browser and, if you are signed in, your account ID, email address and display name, with standard browser and device information. Statsig's session recording feature is not enabled on our website.
OpenFreeMap: Provide the map on our store locations page. Information involved: Your browser loads the map from their servers, which receive your IP address and browser information. Some product images are likewise loaded directly from our suppliers' websites.

Product listings on other platforms

Google Merchant Center, Meta (Facebook), OLX and our Telegram channel: Show our products in Google Shopping, on Facebook, on OLX and in our public Telegram channel. Information involved: Product information only, such as names, prices, stock levels and images. No customer information is sent to these listings.

Our AI Chat Assistant

Our website includes a chat assistant that answers questions about products, orders and our services. Please keep the following in mind when you use it:

Your messages are processed by third-party AI providers. To produce a reply, we send your messages, the page you are on and the information needed to answer (such as product details or, when you ask about your own orders, details of those orders) to one of these providers: Groq, Google AI Studio, OpenRouter, Cerebras, Cloudflare Workers AI, Hugging Face, OrcaRouter. If you are signed in, we also send your name, or your email address if no name is on file, and if you ask the assistant to prepare an order, your delivery address. Some of these providers (OpenRouter, OrcaRouter and Hugging Face) pass messages on to the companies that host the AI models they offer. Apart from what you type into the chat yourself, we do not send your password or payment details.
Please do not type sensitive information, such as passwords, card numbers, or health or identity document details, into the chat.
Conversations are kept for a limited period. We store chat conversations, together with the IP address and browser information of the device used and, if you are signed in, your account ID, so our staff can review them to help you and to improve the assistant. A conversation is deleted automatically 90 days after its last message.
These AI providers may keep the messages they receive under their own terms and privacy policies, which we do not control.
If you place an order through the assistant, it is handled like any other order and shared with our delivery and email providers as described above.

Information Sharing

We respect your privacy and do not sell or rent your personal information. Apart from the service providers listed above, we share it only in the following circumstances:

To comply with legal obligations
To protect our rights, privacy, safety, or property
In connection with a business transfer or acquisition

International Transfers

We are based in Lebanon, but most of the services listed above are located abroad, so your information is processed outside Lebanon. For example, our main database is stored in Google's European Union data centers, our file storage (Supabase) is in France, our website's servers (Vercel) run in the United States and deliver our pages through Vercel's worldwide network, and our AI, analytics and monitoring providers are mainly based in the United States. These countries may have data protection laws that differ from those in Lebanon.

Data Retention

We keep personal information for as long as it is needed for the purpose it was collected for, or as required by law. For example, we keep order records for accounting and legal purposes, and we keep your account information until you delete your account. Chat assistant conversations are deleted automatically after the retention period described above.

Data Security

We implement appropriate security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include internal reviews of our data collection, storage, and processing practices and security measures.

Your Rights

Depending on your location, you may have certain rights regarding your personal information, including:

The right to access personal information we hold about you
The right to request correction of inaccurate information
The right to request deletion of your information
The right to opt out of marketing communications
The right to data portability

To exercise these rights, please contact us using the information below.

Cookies and Similar Technologies

We use cookies and similar technologies, such as your browser's local storage, to keep you signed in, remember your cart, recently viewed products, searches and preferences, and remember your cookie choices. These are necessary for the website to work.

When you first visit, we ask whether you accept analytics cookies. Google Analytics is loaded only if you accept them. We do not currently use advertising cookies. If you accept analytics cookies, your browser also uses for up to 30 days the campaign tags in the link that brought you here, the page you landed on and the referring site, and these are saved with any order you place; an ad click identifier in that link (such as Google's gclid or Meta's fbclid) is kept and saved with the order only if you also accept marketing cookies. You can change your choice at any time with the "Cookie Preferences" link in the footer of our main website (zaytounsolutions.com), or by clearing this site's data in your browser, which shows the choice again. You can also set your browser to refuse cookies, but this may limit your ability to use certain features of our site, such as signing in.

Some of the services listed above, such as Vercel Web Analytics, Rollbar and Statsig, run without asking for this choice because they are part of how we operate and fix the website; they are described in the service providers section.

Children's Privacy

Our website is not intended for children under 16 years of age, and we do not knowingly collect personal information from children.

Data Deletion

On our website, to delete your account, go to the Settings page by clicking on the profile icon at the top right, scroll down to the “Danger Zone” section, and click “Delete Account.” You then confirm it is you: by entering your password, or, if you signed up with Google or another sign-in provider, by signing in again with that provider. Your sign-in account and your account profile are then deleted.

Some information linked to your account is not removed by this button, such as your order records (which we keep for accounting and legal purposes), wishlists, saved cart, loyalty and balance history, and chat conversations. If you would like any of this other information deleted, or you cannot sign in to delete your account yourself, email us at privacy@zaytounsolutions.com and we will respond to your request. We may need to keep some information, such as order records, where the law requires it.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: privacy@zaytounsolutions.com

Phone: +961 70 532 703