Privacy Policy

1. Introduction

Welcome to Elegance Store (the "Website", "Platform", or "Store"), accessible at elegancestore-production.up.railway.app. This Privacy Policy ("Policy") explains how Elegance Store, operated by Luxury Brands (עוסק מורשה), Business ID 200854792 ("Elegance", "we", "us", or "our") collects, uses, stores, shares, and protects personal information obtained from visitors and customers ("you", "your", or "User").

This Policy is drafted in compliance with the Privacy Protection Law, 5741-1981 (חוק הגנת הפרטיות, תשמ"א-1981), the Privacy Protection Regulations (Information Security), 5777-2017 (תקנות הגנת הפרטיות (אבטחת מידע), תשע"ז-2017), the anti-spam provisions under Section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982 (סעיף 30א לחוק התקשורת (בזק ושידורים), תשמ"ב-1982), the Privacy Protection Regulations (Transfer of Data to Databases Outside the State Borders), 5761-2001 (תקנות הגנת הפרטיות (העברת מידע אל מאגרי מידע שמחוץ לגבולות המדינה), תשס"א-2001), and, where applicable to Users located in the European Economic Area ("EEA"), the General Data Protection Regulation (EU) 2016/679 ("GDPR").

The State of Israel has been recognized by the European Commission as providing an adequate level of data protection (Commission Decision 2011/61/EU), enabling lawful transfers of personal data between the EEA and Israel without additional safeguards. Notwithstanding this adequacy decision, we apply GDPR-equivalent protections to all Users where applicable.

By accessing or using the Website, creating an account, placing an order, or otherwise interacting with our services, you acknowledge that you have read and understood this Policy and consent to the practices described herein. If you do not agree with any provision of this Policy, please refrain from using our services.

2. Data Controller Information

The data controller responsible for the processing of your personal data is:

For any questions, concerns, or requests regarding the processing of your personal data, you may contact our designated privacy officer at the above email address.

3. What Information We Collect

We collect and process various categories of personal data depending on how you interact with our Platform. Below is a detailed overview organized by source.

3.1 Information You Provide Directly

• Account Registration: When you create an account, we collect your full name, email address, and password. Your password is cryptographically hashed by our authentication provider (Firebase Authentication, operated by Google LLC) and is never stored in plaintext.
• Profile Data: You may optionally provide a phone number and save one or more shipping addresses (comprising full name, phone number, street address, city, state/province, postal code, and country).
• Checkout and Order Data: When placing an order, we collect your name, email address, phone number, full shipping address, selected payment method (e.g., bank transfer, Bit, or cash), and any down payment amount specified. Order records include order number, items purchased, prices, payment history, and order status tracking information.
• Contact Form Inquiries: When you submit a message through our contact form, we collect your name, email address, the subject of your inquiry, and the content of your message.
• Newsletter Subscription: If you subscribe to our newsletter via the form in the website footer, we collect your email address only.
• Wishlist: If you are a registered user, your wishlist selections (product identifiers) are saved to your user profile.

3.2 Information Collected Automatically

• Shopping Cart Data (Local Storage): Your shopping cart contents are stored locally in your browser using the HTML5 localStorage mechanism under the key elegance_cart. This data remains entirely on your device and is not transmitted to our servers unless and until you proceed to checkout.
• Session Storage: Upon successful completion of an order, temporary order confirmation data is stored in your browser's sessionStorage (under a key formatted as order_{orderNumber}). This data is automatically cleared when you close the browser tab and is used solely to display the order confirmation page.
• Analytics Data: We use Google Firebase Analytics, which may collect certain behavioral and usage data automatically, including but not limited to: pages visited, session duration, device type, operating system, browser type, approximate geographic location (based on IP address), and interaction events. Firebase Analytics may use technologies that function similarly to cookies (including first-party cookies set by the Google Analytics domain) to distinguish users and sessions. We treat such tracking identifiers as equivalent to cookies for the purposes of this Policy.
• Firebase Authentication Logs: Our authentication provider, Firebase Authentication, may log certain technical information including your IP address, login timestamps, device identifiers, and authentication events. This data is processed by Google LLC in accordance with its privacy policies.

3.3 Information Received from Third Parties

• Google OAuth (Social Login): If you choose to sign in using your Google account, we receive your name, email address, and profile picture from Google through the OAuth 2.0 protocol. You authorize this data sharing through the Google consent screen presented during the sign-in process.

4. Legal Basis for Processing

4.1 Under Israeli Law

The Privacy Protection Law, 5741-1981 permits the processing of personal data where, among other grounds, the data subject has given consent, or where processing is necessary for the performance of a contract to which the data subject is a party, or where processing is necessary for a legitimate purpose of the data controller, provided that such processing does not infringe the privacy of the data subject in a manner disproportionate to the circumstances.

Our processing activities are based on the following grounds under Israeli law:

• Consent (Section 1 of the Privacy Protection Law): Where you have provided affirmative consent, such as subscribing to our newsletter, creating an account, or authorizing Google OAuth data sharing.
• Contractual Necessity: Processing necessary to fulfill our contractual obligations to you, including order processing, shipping, and payment management.
• Legitimate Interest: Processing necessary for our legitimate business interests, such as fraud prevention, security, service improvement, and analytics, provided that such interests do not override your fundamental rights and freedoms.
• Legal Obligation: Processing required to comply with applicable Israeli laws and regulations, including tax record-keeping requirements and regulatory reporting.

4.2 Under the GDPR (for EEA Users)

For Users located in the European Economic Area, we rely on the following legal bases under Article 6(1) GDPR:

• Consent (Article 6(1)(a)): For newsletter subscriptions, non-essential analytics, and social login via Google OAuth.
• Performance of a Contract (Article 6(1)(b)): For processing personal data necessary to fulfill your orders, manage your account, and provide our services.
• Legitimate Interests (Article 6(1)(f)): For analytics, fraud prevention, security improvements, and Platform optimization, where our legitimate interests are not overridden by your rights.
• Legal Obligation (Article 6(1)(c)): Where processing is required to comply with applicable laws.

5. How We Use Your Information

We process your personal data for the following purposes:

5.1 Order Fulfillment and Service Delivery

• Processing and fulfilling your orders, including coordinating with international suppliers
• Managing payment records and down payment tracking
• Providing order status updates and shipment tracking
• Communicating with you regarding your orders (confirmations, shipping notifications, delivery updates)
• Handling returns, exchanges, and customer service inquiries

5.2 Account Management

• Creating and maintaining your user account
• Authenticating your identity upon login (including via Google OAuth)
• Storing your saved addresses and preferences for a seamless shopping experience
• Managing your wishlist

5.3 Communication

• Responding to inquiries submitted through our contact form
• Sending transactional communications related to your orders and account
• Sending marketing communications (newsletters) where you have opted in, in accordance with Section 30A of the Communications Law

5.4 Analytics and Platform Improvement

• Analyzing aggregated usage patterns through Firebase Analytics to improve our Platform
• Understanding customer preferences and shopping behavior
• Optimizing Website performance, layout, and user experience

5.5 Artificial Intelligence Processing

We use Google Gemini AI (a generative artificial intelligence service provided by Google LLC) for the following limited, internal purposes:

• Generating and enhancing product descriptions based on product name, brand, and category information
• Producing aggregated sales analytics and business insights from order data for internal administrative use

When used for sales analytics, the data transmitted to Google Gemini AI may include order-level data such as order dates, order numbers, customer names, sale prices, payment amounts, and order statuses. This processing is performed exclusively within the administrative back-end and is not customer-facing. No personal data beyond what is described above is shared with Google Gemini AI, and the data is processed in accordance with Google's API Terms of Service and data processing commitments.

5.6 Security and Fraud Prevention

• Protecting the Platform against unauthorized access, abuse, and fraud
• Monitoring for suspicious activity and security threats
• Enforcing our Terms and Conditions

6. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information to third parties. We share personal data only in the limited circumstances described below.

6.1 Service Providers (Data Processors)

We engage the following third-party service providers who process personal data on our behalf, acting as data processors:

All of the above services are provided by Google LLC and are governed by the Google Cloud Data Processing Addendum and Firebase Data Processing Terms, which include Standard Contractual Clauses and binding commitments regarding data security and confidentiality.

6.2 Payment Processing

Our current payment methods (bank transfer, Bit, and cash) are processed manually and do not involve automated third-party payment processors. We do not collect or store credit card numbers, bank account numbers, or other sensitive financial instrument details through the Website. Payment records maintained in our system include only the payment method selected, the amount, and the transaction status.

6.3 Legal and Regulatory Disclosure

We may disclose personal data where required by law, regulation, or legal process, including:

• In response to a valid court order, subpoena, or government request
• To comply with Israeli tax, anti-money laundering, or consumer protection laws
• To protect the rights, property, or safety of Elegance Store, our Users, or others
• In connection with a merger, acquisition, or sale of business assets (subject to continued protection of personal data under terms no less protective than this Policy)

7. Cross-Border Data Transfers

Your personal data is stored on and processed through Google Cloud infrastructure, which may include servers located in the United States, the European Union, and other jurisdictions where Google operates data centers.

7.1 Legal Framework for Transfers

Cross-border transfers of your personal data are authorized under the following legal frameworks:

• Israeli Law: The Privacy Protection Regulations (Transfer of Data to Databases Outside the State Borders), 5761-2001 (תקנות הגנת הפרטיות (העברת מידע אל מאגרי מידע שמחוץ לגבולות המדינה), תשס"א-2001) permit transfers of personal data to countries that ensure an adequate level of privacy protection, or where the data subject has consented to the transfer. The European Union is recognized as providing adequate protection. For transfers to the United States, we rely on the contractual protections set forth in Google's Data Processing Addendum, which includes Standard Contractual Clauses (SCCs) approved by the European Commission.
• GDPR (for EEA Users): Israel benefits from an adequacy decision by the European Commission (Decision 2011/61/EU), meaning that transfers of personal data from the EEA to Israel are deemed to provide an adequate level of protection. For onward transfers from Israel to Google Cloud servers outside the EEA (e.g., in the United States), we rely on Google's implementation of Standard Contractual Clauses and supplementary measures as required under the Schrems II ruling (Case C-311/18).

7.2 Safeguards

Regardless of data location, we ensure that your personal data benefits from:

• Encryption in transit (TLS/SSL) and at rest
• Access controls restricting data access to authorized personnel
• Contractual obligations on sub-processors to maintain security and confidentiality
• Regular security assessments and compliance reviews

8. Data Retention

We retain personal data for as long as reasonably necessary to fulfill the purposes for which it was collected, as described in this Policy, and in accordance with applicable legal requirements.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized. Where anonymized data is retained for statistical or analytical purposes, it will no longer be capable of identifying you.

9. Your Rights Under Israeli Law

Under the Privacy Protection Law, 5741-1981 (Sections 13-15), every person is entitled to the following rights with respect to data held about them in a database:

• Right of Access (Section 13): You have the right to review any personal data about you held in our databases. Upon your request, we will inform you what personal data about you is stored in our databases and the purposes for which it is used.
• Right of Correction (Section 14): If you find that the personal data held about you is inaccurate, incomplete, unclear, or not up to date, you may request its correction or deletion. We will comply with such requests within a reasonable time. If we refuse a correction request, we will notify you of our refusal and the reasons therefor.
• Right to Deletion: You may request that we delete your personal data from our databases, subject to our legal obligations to retain certain data (e.g., for tax purposes). Account deletion requests can be made by contacting us at ameerdow@icloud.com.
• Right to Object (Section 13A): You may object to the use of your personal data for the purpose of direct marketing. Upon receiving such objection, we will cease using your data for that purpose.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing that occurred prior to the withdrawal.

To exercise any of the above rights, please submit a written request to ameerdow@icloud.com. We may require reasonable verification of your identity before processing your request. We will respond within 30 days of receiving your request, as required by law.

10. Your Rights Under the GDPR (EEA Users)

If you are located in the European Economic Area, you are entitled to the following additional rights under the GDPR, in addition to the rights described in Section 9 above:

• Right of Access (Article 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to obtain a copy of that data together with specified information about the processing.
• Right to Rectification (Article 16): You have the right to obtain rectification of inaccurate personal data and to have incomplete personal data completed.
• Right to Erasure ("Right to Be Forgotten") (Article 17): You have the right to request the deletion of your personal data where, among other grounds, the data is no longer necessary for the purposes for which it was collected, you withdraw your consent, or the data has been unlawfully processed.
• Right to Restriction of Processing (Article 18): You have the right to obtain restriction of processing in certain circumstances, such as when you contest the accuracy of the data or when processing is unlawful but you oppose erasure.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller without hindrance, where the processing is based on consent or a contract and is carried out by automated means.
• Right to Object (Article 21): You have the right to object to processing based on legitimate interests, including profiling. You also have the absolute right to object to processing for direct marketing purposes at any time.
• Right Regarding Automated Decision-Making (Article 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not currently engage in solely automated decision-making that affects your legal rights.

To exercise any GDPR rights, please contact us at ameerdow@icloud.com. We will respond within one (1) month of receipt of your request, subject to extensions where permitted under Article 12(3) GDPR. If you are unsatisfied with our response, you have the right to lodge a complaint with a supervisory authority in the EEA Member State of your habitual residence, place of work, or place of the alleged infringement.

11. Information Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with the Privacy Protection Regulations (Information Security), 5777-2017 (תקנות הגנת הפרטיות (אבטחת מידע), תשע"ז-2017).

Our security measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS (Transport Layer Security) protocols.
• Encryption at Rest: Data stored in Google Cloud Firestore and Firebase is encrypted at rest using AES-256 encryption, as provided by Google Cloud's infrastructure.
• Password Security: User passwords are cryptographically hashed using industry-standard algorithms by Firebase Authentication. We never store, access, or have visibility into your plaintext passwords.
• Access Controls: Access to personal data within our systems is restricted to authorized personnel on a need-to-know basis. Administrative access is protected by role-based authentication.
• Firebase Security Rules: Database access is governed by Firebase Security Rules that enforce authentication requirements and restrict data access at the document level.
• Infrastructure Security: Our backend infrastructure is hosted on Google Cloud Platform, which maintains comprehensive security certifications including ISO 27001, SOC 2 Type II, and SOC 3.

While we strive to protect your personal data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, and you acknowledge that you transmit data to us at your own risk. In the event of a data security breach that is likely to result in a risk to your rights and freedoms, we will notify the Privacy Protection Authority (הרשות להגנת הפרטיות) and, where required, affected Users, in accordance with applicable law.

12. Children's Privacy

Our services are intended for individuals who are at least 18 years of age. We do not knowingly collect, solicit, or process personal data from anyone under the age of 18. If you are under 18, please do not attempt to register for an account, place an order, or send any personal data to us.

If we become aware that we have collected personal data from a child under the age of 18 without verification of parental consent, we will take reasonable steps to delete that information promptly. If you believe that we may have inadvertently collected personal data from a minor, please contact us at ameerdow@icloud.com.

13. Marketing Communications and Anti-Spam

13.1 Newsletter and Promotional Communications

We offer a newsletter subscription service through the subscription form in the footer of our Website. Subscribing to our newsletter is entirely voluntary. By providing your email address and clicking "Subscribe", you provide your affirmative opt-in consent to receive marketing communications from Elegance Store, including promotional offers, new arrival notifications, and style inspiration content.

13.2 Compliance with Israeli Anti-Spam Law

Our marketing communications practices comply with Section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982 (סעיף 30א לחוק התקשורת (בזק ושידורים), תשמ"ב-1982), which prohibits the sending of unsolicited commercial messages ("spam") without the prior explicit consent of the recipient. Accordingly:

• We will only send marketing communications to individuals who have provided their prior, express consent ("opt-in").
• Every marketing communication will include a clear and easily accessible mechanism to unsubscribe ("opt-out").
• Unsubscribe requests will be honored within three (3) business days, and no further marketing communications will be sent following the opt-out.
• Every marketing message will clearly identify Elegance Store as the sender and include our contact information.

13.3 Transactional Communications

Transactional communications — such as order confirmations, shipping notifications, payment receipts, and account security alerts — are not considered marketing communications under the anti-spam provisions and will be sent without requiring separate opt-in consent, as they are essential to the performance of our contractual obligations.

13.4 Your Right to Opt Out

You may unsubscribe from marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us at ameerdow@icloud.com with the subject line "Unsubscribe"

14. Cookies and Similar Technologies

Our application does not set cookies directly through its own code. However, the third-party services we use — particularly Firebase Authentication and Firebase Analytics (both operated by Google LLC) — may set cookies or use similar tracking technologies (such as browser local storage, indexed databases, or device fingerprinting techniques) for the following purposes:

• Essential/Functional: Firebase Authentication may store session tokens and authentication state to maintain your logged-in session.
• Analytics: Firebase Analytics may use first-party cookies or similar identifiers to track usage patterns, distinguish unique users, and measure session engagement.

For more information about how Google uses cookies and similar technologies, please review the Google Cookie Policy and the Firebase Privacy Information.

You may manage or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website, including your ability to log in and maintain your shopping session.

15. Database Registration

In accordance with the Privacy Protection Law, 5741-1981, databases containing personal information that meet the statutory criteria — including databases with more than 10,000 records or databases containing sensitive information — must be registered with the Registrar of Databases (רשם מאגרי המידע) at the Israeli Privacy Protection Authority.

Elegance Store monitors the size and sensitivity of its customer database on an ongoing basis. Where the statutory thresholds described above are met, Luxury Brands will register the relevant database with the Registrar of Databases for the purposes of customer management, order processing, and marketing (where consent is provided).

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this page
• Post a prominent notice on our Website informing Users of the changes
• Where the changes affect processing based on consent, seek renewed consent where required by applicable law
• Where required by GDPR (for material changes affecting EEA Users), provide direct notification via email to registered Users

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Your continued use of the Website after any changes to this Policy constitutes your acceptance of the updated terms, except where active consent is required by law.

17. Contact and Complaints

17.1 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

17.2 Filing a Complaint with the Privacy Protection Authority

If you believe that your privacy rights have been violated, you have the right to file a complaint with the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות):

17.3 Complaints by EEA Users

If you are located in the European Economic Area and wish to lodge a complaint under the GDPR, you may do so with the supervisory authority in the EU/EEA Member State of your habitual residence, your place of work, or the place of the alleged infringement. A list of supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

18. Supplementary Legal Notes

The following notes are included for the benefit of Elegance Store's management and legal counsel. They do not form part of the public-facing commitments of this Privacy Policy but record certain advisory considerations raised during the drafting process.

18.1 Database Registration Obligation

Section 8 of the Privacy Protection Law, 5741-1981 requires registration of databases with the Registrar of Databases (רשם מאגרי המידע) where the database contains personal data on more than 10,000 individuals, or where the database contains "sensitive information" as defined in the Law (including information on a person's health, financial status, political opinions, intimate affairs, etc.). It is the recommendation of counsel that Elegance Store proactively register its customer database even if the 10,000-record threshold has not yet been reached, given that hashed passwords (processed by Firebase Authentication) and payment records may be considered adjacent to financial data. Early voluntary registration demonstrates good-faith compliance and mitigates regulatory risk.

18.2 Google Gemini AI Disclosure

The transmission of customer names and order data to Google Gemini AI for sales analytics constitutes a form of data processing that involves a third-party processor. Although this processing occurs only within the administrative back-end, it has been disclosed in Sections 5.5 and 6.1 of this Policy in accordance with the principle of transparency. Counsel recommends that Elegance Store evaluate whether Gemini AI data processing can be further anonymized or aggregated to minimize the transmission of identifiable customer data.

18.3 Firebase Analytics and Cookie-Like Tracking

Although Elegance Store does not explicitly set cookies through its own application code, Firebase Analytics utilizes tracking identifiers that function as cookies. For the purposes of Israeli and European data protection compliance, these should be treated equivalently. Counsel recommends implementing a cookie consent banner that allows Users to opt in to analytics tracking before Firebase Analytics is initialized, particularly to satisfy the ePrivacy Directive requirements applicable to EEA Users.

18.4 Data Retention Recommendations

The current implementation stores user data indefinitely in Cloud Firestore. Counsel recommends implementing automated data retention and purging mechanisms consistent with the retention periods specified in Section 8 of this Policy. Specifically: (a) contact form submissions should be automatically purged after 2 years; (b) accounts inactive for more than 36 months should receive a reactivation notice, and if no response is received, should be archived and anonymized; and (c) analytics data should be configured to comply with the 26-month default retention period in Firebase Analytics settings.

18.5 Cross-Border Transfer Safeguards

While Israel's GDPR adequacy status permits data transfers from the EEA to Israel, onward transfers to Google Cloud servers in the United States require additional safeguards. Google's Data Processing Addendum includes Standard Contractual Clauses (SCCs). Counsel confirms that, as of the date of this Policy, reliance on these SCCs combined with Google's supplementary technical and organizational measures (encryption, access controls, government access transparency reports) satisfies the requirements of the Schrems II ruling and applicable Israeli cross-border transfer regulations. This assessment should be reviewed annually or upon any material change in the legal framework governing international data transfers.