Privacy policy

What we collect

When you order. Your name, phone number, delivery address, and email address if you give one. The order itself — what you bought, what you paid, and every status change it goes through.

When you create an account. Your email address or phone number and a password, handled by Firebase Authentication. We never see your password. If you sign in with Google we receive your name, email and profile picture from Google and nothing else.

When you save addresses or a wishlist. Those, attached to your account so they follow you between devices.

When you contact us or leave a review. What you wrote, and the name and email you wrote it under. Reviews are held for moderation before they appear publicly, and only your display name is shown — never your email.

When you subscribe to the newsletter. Your email address and nothing else.

Automatically. Your cart is kept in your browser's local storage so it survives a refresh; it is copied to our servers only if you sign in. We keep a short-lived session cookie once you sign in so you stay signed in. We do not run Google Analytics, Facebook Pixel, or any third-party advertising or tracking script.

Why we collect it

To take payment, pack a parcel, get it to your door, and answer you when something goes wrong. Order records are also what we need to honour a return and to keep proper books.

Marketing email only ever goes to people who asked for it. Ordering does not sign you up.

Who else sees it

Our courier gets your name, address and phone number printed on the label. They cannot deliver without them.

Google Firebase stores our database and handles sign-in.

Cloudinary hosts our product images. It does not receive customer data.

Resend sends our transactional and newsletter email, so it processes your email address and the contents of those messages.

Vercel hosts the site and keeps standard server logs.

That is the complete list. We do not sell, rent or trade your details to anyone, and we have never been asked to.

How long we keep it

Order records stay for seven years, because tax records have to. Contact messages are kept for two years. Newsletter subscriptions last until you unsubscribe. If you close your account we delete your profile, addresses and wishlist — but the orders you already placed stay, with your name and address on them, for the same seven years.

Your choices

See what we hold. Your account area shows your profile, saved addresses, order history and reviews. Ask us and we will send you everything else.

Correct it. Edit your profile and addresses yourself, or tell us and we will fix it.

Delete it. Email us and we will delete your account and everything attached to it, except the order records we are required to keep.

Stop the email. Every marketing email has an unsubscribe link. Order confirmations and delivery updates are not marketing and will keep coming while an order is live.

Security

The site is served over HTTPS. Passwords are handled by Firebase and never stored by us. Database access is governed by security rules that deny by default, and everything privileged — prices, stock, orders — is written by our server rather than by your browser. Admin access is controlled by a signed authentication claim, not by a flag anyone can edit.

No system is perfect. If you find something wrong, tell us at hello@aqfragrances.pk and we will take it seriously.

Children

This shop is not intended for under-18s and we do not knowingly collect their details. If you believe we have, tell us and we will delete them.

Changes

If this policy changes in a way that matters, the date at the top changes and we will say so in the newsletter. We will not quietly rewrite it.

Contact

hello@aqfragrances.pk or +923001234567. The contact page reaches the same inbox.