Privacy Policy

This page explains what information Khotoot's website actually collects and stores today, and how it's used. It describes the real behavior of this system — not a generic template.

When you place an order, we collect the name, email address, phone number, and delivery address you provide at checkout, along with the items, quantities, and prices in your order.

We keep a record of your order's status over time (for example, confirmed, shipped, delivered, or cancelled), its selected payment method, and payment status.

If transactional email delivery is enabled, we keep a record that an order-related email was sent (and, if available, whether it was delivered) — not the customer-facing content of every email.

If you explicitly subscribe to Khotoot Letter, we store your email address, the signup location, the time of consent, and the current synchronization status needed to manage that subscription.

Our systems keep basic technical and security records of staff actions taken on orders, for accountability and fraud prevention.

If you create an account, we store your name, email address, optional phone number, email-verification state, saved delivery addresses, and the orders connected to that account.

We use verification, password-reset, and password-changed emails only to operate and protect your account. Sensitive verification and reset links are processed through the store's transactional-email system.

Saved addresses can be edited or deleted without changing the immutable delivery details stored with earlier orders. Account and order records may be retained for operational, security, and business-record purposes; no fixed retention period is promised here.

Before checkout, your cart is stored locally in your browser (localStorage) — not in our database. Clearing your browser's site data removes your local cart. Nothing about your cart is sent to us until you complete checkout.

We use the information above to create and fulfill your order, communicate with you about it, protect against fraudulent or abusive orders, and operate the store — including keeping the business records we're required to keep.

The transactional order-email system is not used for newsletters. Khotoot Letter is a separate monthly mailing, and we add you to it only when you submit its signup form. Product-specific Notify Me requests are also kept separate from this mailing list.

Every Khotoot Letter includes a way to unsubscribe. Resend then excludes that address from future broadcasts for the selected topic.

The link to your order page acts as a bearer link — anyone with the link can view that order's status. Treat it like you would any private link, and avoid sharing it publicly.

We rely on third-party providers to run the store — for example, the hosting and database infrastructure that stores order data, and Resend for transactional email delivery and Khotoot Letter contact preferences and broadcasts.

We don't sell your information, and we don't share it with advertisers.

Staff who manage the store sign in through a separate authenticated admin area. That login/session data is used only to operate the store and is unrelated to guest checkout.

We don't claim to guarantee perfect security, formal compliance certification, or a specific data-retention period beyond what's described here — this page reflects the system as it actually exists today, and will be updated if that changes.

For any question about your data, contact khotoot.store@gmail.com.