Privacy Policy
What we collect, why we collect it, how long we keep it and how to get it deleted.
Effective date: 1 July 2026 · Last reviewed: 1 July 2026
1. Who we are
This website, https://shop.aljarash.com/, is operated by Aljarash Home Co. (“we”, “us”, “our”), a sole-proprietor retail business owned by Linda Miller and located at 368 Pennsylvania Avenue, Helena, Montana 59620, USA. Linda Miller is the person responsible for data protection at Aljarash Home Co. and can be reached at Linda@shop.aljarash.com or +1 (310) 402-3295.
This policy explains how we handle personal information when you visit this website, contact us, or buy something from us.
2. Information we collect
- Information you give us. Your name, email address, telephone number, billing and delivery address, order contents, and anything you write in an email or on our contact form.
- Transaction records. Order number, items purchased, amount paid, date, and the last four digits and card type returned to us by the payment processor. We never receive or store your full card number, expiry date or security code.
- Technical information. IP address, browser type and version, device type, operating system, referring page and the pages you view. This is collected in standard server logs, which are retained for 30 days for security and troubleshooting.
- Optional analytics information. If you accept optional cookies, an aggregated, non-identifying record of which pages are visited and for how long.
- Marketing preferences. Whether you have opted in to our monthly email and when.
We do not collect special categories of data (health, biometric, political, religious or similar), and we do not attempt to profile you or make automated decisions that affect you.
3. How we use information
- To quote, process, pack, ship and invoice your order.
- To answer your questions and provide customer support before and after a purchase.
- To handle returns, refunds, warranty claims and carrier investigations.
- To keep the accounting and tax records that U.S. and Montana law require of us.
- To protect the website against fraud, abuse and technical attack.
- To send the monthly Journal email — only to people who explicitly asked for it.
- To understand, in aggregate, which pages of the site are useful, if you have accepted optional analytics cookies.
We do not use your data for behavioural advertising, we do not build advertising profiles, and we do not sell, rent or trade personal information to anyone.
4. Legal bases for processing
Where a legal-basis framework such as the EU or UK GDPR applies to a visitor, we rely on: performance of a contract (fulfilling your order), legal obligation (tax and accounting records), consent (optional cookies and marketing email, withdrawable at any time), and legitimate interests (site security, fraud prevention and answering enquiries), balanced against your rights and freedoms.
5. Cookies and analytics
We set a small number of cookies. Strictly necessary cookies keep the site functioning and remember your cookie choice; they cannot be switched off. Optional analytics cookies are set only after you press “Accept all” on our cookie banner, and are removed if you later choose “Essential only”. Full detail, including names and lifetimes, is in our Cookie Policy. You can reopen the banner at any time using the “Cookie settings” link in the footer.
We honour Global Privacy Control (GPC) and browser “Do Not Track” signals by treating them as a refusal of optional cookies.
6. Sharing with third parties
We share the minimum necessary personal data with a small number of service providers, each bound by contract to use it only on our instructions:
| Recipient | Purpose | Data shared |
|---|---|---|
| Payment processor (PCI-DSS Level 1, USA) | Taking card payments | Name, email, billing address, amount |
| USPS and UPS | Delivering your parcel | Name, delivery address, phone number |
| Website hosting provider (USA) | Serving this website | Server log data including IP address |
| Email provider | Order and support correspondence | Name, email, message content |
| Accountant | Statutory bookkeeping and tax filing | Invoice and transaction records |
We may also disclose information where we are legally compelled to do so by a valid court order, subpoena or law-enforcement request, or where necessary to establish or defend a legal claim. If the business is ever sold or transferred, customer records would pass to the new owner under the terms of this policy, and we would notify affected customers by email beforehand.
7. Payment security
All pages of this site are served over HTTPS with TLS encryption. Card details are entered directly into the payment processor's hosted, PCI-DSS compliant page and are never transmitted to or stored on our servers. We keep only a masked reference (card type and last four digits) so we can match refunds to the correct transaction.
8. How long we keep data
| Record type | Retention period |
|---|---|
| Order and invoice records | 7 years (U.S. tax and accounting requirements) |
| Customer support correspondence | 24 months from last contact |
| Marketing subscription records | Until you unsubscribe, plus 12 months of proof of consent |
| Web server logs | 30 days |
| Aggregated analytics | 14 months, non-identifying |
9. Your rights
Wherever you live, you may ask us to:
- Access the personal information we hold about you, in a readable copy.
- Correct anything inaccurate or incomplete.
- Delete your information, except records we must legally retain.
- Port your data to another provider in a machine-readable format.
- Object to or restrict processing based on legitimate interests.
- Withdraw consent for cookies or marketing at any time, with no effect on processing that already took place.
Email Linda@shop.aljarash.com with the subject line “Privacy request”. We verify your identity by matching the request to an order or email address on file, and we respond within 30 calendar days, free of charge. We will never treat you differently for exercising a privacy right.
10. California residents (CCPA/CPRA)
In the past twelve months we have collected the categories of personal information described in section 2 for the purposes described in section 3. We have not sold or shared personal information as those terms are defined by the CCPA/CPRA, and we do not sell or share the personal information of any consumer, including minors under 16. California residents may exercise the rights to know, delete, correct and opt out by contacting us at the address above; an authorised agent may act on your behalf with written permission.
11. Children
This website and our products are intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to us and we will delete it promptly.
12. Security measures
Access to customer records is limited to the three people who need it to do their job, each with individual credentials and multi-factor authentication. Devices are encrypted, passwords are managed in a password vault, backups are encrypted and stored in the United States, and administrative access is reviewed twice a year. No system is perfectly secure, but if a breach ever affected your data we would notify you and the relevant authorities without undue delay and, where required, within 72 hours.
13. Changes to this policy
If we change this policy we will update the effective date at the top of the page and, for material changes, place a notice on the home page for 30 days. Previous versions are available on request.
14. How to contact us
Aljarash Home Co. — Attn: Linda Miller, Privacy
368 Pennsylvania Avenue, Helena, Montana 59620, USA
Email: Linda@shop.aljarash.com
Phone: +1 (310) 402-3295
Hours: Monday–Friday, 9:00–17:00 Mountain Time