Draft for legal review
Privacy policy
This page describes the storefront’s current data flows. The legal entity, retention periods, and formal Moroccan data-controller details must be confirmed before publication.
Information we use
The storefront may process account details, wishlist choices, order and delivery details, support messages, confirmed newsletter subscriptions, verified reviews, and optional analytics consent. Payment-card details are not requested by the current cash-on-delivery checkout.
Service providers
Convex supports application data and authentication, Cloudflare R2 hosts catalog assets, Rafex Delivery handles delivery, Resend sends transactional and confirmation emails, Twilio delivers transactional WhatsApp order confirmations and records delivery or reply status, and Google Analytics plus Meta browser and server events are enabled only after consent.
Choices and requests
When accepted, analytics may use browser tags and privacy-protected server events to measure page visits and shopping actions. Contact details used to match a confirmed order are normalized and hashed before they are sent to Meta. You can decline analytics, reopen analytics preferences from the footer. Entering a phone number at checkout and placing the order opts that number into transactional WhatsApp messages for that order only. You can also unsubscribe from newsletter email, and request access or correction by emailing hello@thriftswear.com. Identity verification may be required before a privacy request is completed.
Retention and legal basis
Exact retention schedules, controller identity, registration details, and legal bases under Morocco’s Law 09-08 require legal confirmation before this draft is marked final.