Privacy Policy

This page explains what information Khotoot's website actually collects and stores today, and how it's used. It describes the real behavior of this system — not a generic template.

When you place an order, we collect the name, email address, phone number, and delivery address you provide at checkout, along with the items, quantities, and prices in your order.

We keep a record of your order's status over time (for example, confirmed, shipped, delivered, or cancelled) and its payment status for Cash on Delivery.

If transactional email delivery is enabled, we keep a record that an order-related email was sent (and, if available, whether it was delivered) — not the customer-facing content of every email.

Our systems keep basic technical and security records of staff actions taken on orders, for accountability and fraud prevention.

If you create an account, we store your name, email address, optional phone number, email-verification state, saved delivery addresses, and the orders connected to that account.

We use verification, password-reset, and password-changed emails only to operate and protect your account. Sensitive verification and reset links are processed through the store's transactional-email system.

Saved addresses can be edited or deleted without changing the immutable delivery details stored with earlier orders. Account and order records may be retained for operational, security, and business-record purposes; no fixed retention period is promised here.

Before checkout, your cart is stored locally in your browser (localStorage) — not in our database. Clearing your browser's site data removes your local cart. Nothing about your cart is sent to us until you complete checkout.

We use the information above to create and fulfill your order, communicate with you about it, protect against fraudulent or abusive orders, and operate the store — including keeping the business records we're required to keep.

Khotoot does not use the transactional order-email system described above to send marketing or newsletter emails. It exists only to notify you about your own order.

The link to your order page acts as a bearer link — anyone with the link can view that order's status. Treat it like you would any private link, and avoid sharing it publicly.

We rely on third-party providers to run the store — for example, the hosting and database infrastructure that stores order data, and, only when transactional email is enabled, an email-delivery provider (Resend) used to send order-related emails.

We don't sell your information, and we don't share it with advertisers.

Staff who manage the store sign in through a separate authenticated admin area. That login/session data is used only to operate the store and is unrelated to guest checkout.

We don't claim to guarantee perfect security, formal compliance certification, or a specific data-retention period beyond what's described here — this page reflects the system as it actually exists today, and will be updated if that changes.

For any question about your data, contact khotoot.store@gmail.com.