Privacy Policy

1. Who is responsible for your data

Hadir Store (hadirstore.com), the Arabic-language store of the Goods by Loft family, is the controller of the personal data described in this policy, except payment data, for which Paddle acts as an independent controller. For anything privacy related, contact [email protected].

2. What we collect and why

• Order data: when you buy, we receive your email address and details of what you bought from Paddle. We do not receive your card details. We use this to deliver your files and keep proof of delivery. Legal basis: performance of a contract.
• Payment data: collected and processed directly by Paddle.com, our merchant of record and payment processor. We never see or store your full payment details. Paddle's processing is described in the Paddle Privacy Policy.
• Contact messages: if you email us or use the contact form, we keep your name, email and message to answer you and follow up. Legal basis: legitimate interest in responding to enquiries.
• Session data: for each visit we record IP address, browser, device, country and traffic source, and link them to your order if you buy, to measure advertising and prevent fraud. Legal basis: legitimate interest.
• Technical data: our hosting provider (Cloudflare) processes IP addresses and request logs to serve the site securely and prevent abuse. Legal basis: legitimate interest in running a secure website.
• Download logs: we log which file was downloaded, when, and from which IP address, in order to apply our refund policy (checking whether the files were downloaded) and to prevent abuse of download links.

We do not sell your personal data to anyone.

3. Advertising pixels and campaign measurement

We use advertising pixels from Snapchat, TikTok and Meta, and we may also use their server-side conversions APIs. These platforms may receive: your email address hashed with SHA-256, the postcode, city, region and country from your billing address in hashed form, a random visitor identifier of ours in hashed form, your IP address, browser information, ad click identifiers, and the product name and order value, so that we can measure and improve our advertising.

Your email address and your billing address never leave your browser in the clear on their way to these platforms: they are hashed inside your browser before they are sent, and we keep no unhashed copy for this purpose.

These tools set cookies on your device. You can block them with your browser settings or an ad-blocker, and you can also turn off ad personalisation in your account settings inside each of those apps.

4. Analytics

We use Umami to measure visits and which pages are most visited. It works without cookies and without identifying individual visitors.

5. Cookies

Our pages set two first-party cookies:

• hd_attr, for 28 days: stores how you reached us — campaign parameters, ad click identifiers and the first page you landed on — so we know which ad brought you.
• hd_uid, for 400 days: a random number that carries no information about you, used to connect your visits to one another and to measure advertising results. It is only ever sent to the advertising platforms in hashed form.

You may also find cookies from the advertising pixels described above, and from Paddle when you open the checkout, where they are necessary to process payment securely and prevent fraud. You can delete or block any of these from your browser settings at any time.

6. Who we share data with

• Paddle: payment processing, tax, receipts and payment-related customer service.
• Cloudflare: website hosting, storage of product files, and security.
• Resend: sending email, including download links and replies to your messages.
• Telegram: internal new-order notifications to the store team, including your email address, country, product and amount.
• Snap Inc., TikTok and Meta: advertising measurement as described in section 3.

Each provider processes data under its own contractual safeguards. Where data is transferred outside your country of residence, these providers rely on recognised transfer mechanisms such as Standard Contractual Clauses.

7. How long we keep data

Order records (email address, product, date) are kept for as long as needed for delivery, refunds and accounting obligations, then deleted. Contact messages are kept for up to 24 months after the conversation ends. Technical logs are retained briefly under our hosting provider's standard retention.

8. Your rights

Under the Saudi Personal Data Protection Law (PDPL) and, where it applies, the General Data Protection Regulation (GDPR), you have the right to access your personal data, correct it, delete it and object to its processing, and to withdraw your consent where processing is based on consent. To exercise any of these rights, email [email protected] and we will reply within 30 days. You also have the right to lodge a complaint with the competent data protection authority in your country. For rights relating to payment data, you can contact Paddle directly via their privacy page.

9. Security

The whole site is served over HTTPS. Product files are stored in private cloud storage and delivered through time-limited, signed download links. Payments are handled entirely on Paddle's PCI-compliant infrastructure.

10. Children

The store is not directed at children under 16, and we do not knowingly collect their personal data.

11. Changes to this policy

If we change this policy we will update the effective date above, and material changes will be explained on this page.