Privacy policy
The short version
- We only collect what the shop needs to work: your account, your orders and the things you choose to add.
- We never see or store your card number. Payments are handled by Stripe.
- We don't sell your data, show ads, or use tracking or analytics cookies.
- You can change your details or delete your account at any time from your account settings.
What we collect
When you make an account
Your name, email address and password. The password is never stored as you typed it. We store a one-way bcrypt hash of it, which can't be turned back into the password.
When you sign in with Google
Google shares three things with us: your name, your email address and your Google account ID. We use them only to create your account and sign you in. We don't get access to your Gmail, contacts, files or anything else in your Google account.
When you place an order
What you bought, the prices, your email address, and the delivery name, address and phone number you give us. Your card details go straight to Stripe and never pass through our server. Stripe tells us only whether the payment succeeded.
Things you choose to add
Saved delivery addresses, product reviews (shown with your name) and a profile photo, if you upload one.
Your cart
If you shop without logging in, your cart is linked to a random code stored in your session, so it can move into your account when you log in.
Cookies
We use one cookie, store_sid, which keeps you logged in and remembers your cart.
It lasts up to 7 days. It's needed for the site to work. We don't use advertising,
tracking or analytics cookies.
Security logs
To stop people guessing passwords, the site counts recent login and password-reset attempts by IP address for a short time (up to an hour). Our hosting provider may also keep standard server logs.
How we use it
- To run your account and sign you in
- To process orders and show you your order history
- To send emails you need: order confirmations and password reset links. No newsletters or marketing.
- To protect the site and its users from abuse
Who we share it with
Only the services the site needs to run, and only the data each one needs. None of them may use your data for their own purposes.
| Service | What it does | What it gets |
|---|---|---|
| Stripe | Takes card payments | Your email, what you're buying and the price. You enter your card on Stripe's own page. |
| Resend | Sends our emails | Your email address and the content of the email |
| Cloudinary | Stores images | Profile photos you upload |
| Railway | Hosts the website and database | Everything above is stored on their servers |
| "Continue with Google" | Only used if you choose to sign in with Google |
We don't sell, rent or trade personal data to anyone.
Data from Google
If you sign in with Google, we request only the basic scopes openid,
email and profile. From these we keep your name, email address
and Google account ID. We use them only to create and sign in to your DeniseClothing account.
We don't share them, sell them, use them for advertising, or use them to train AI models.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
You can remove DeniseClothing's access at any time in your Google account under Third-party connections. Deleting your DeniseClothing account also deletes this data.
How long we keep it
- Your account, saved addresses, reviews, profile photo and cart: until you delete your account.
- Orders: kept as sales records. If you delete your account, your orders stay but are no longer linked to it. Each order still holds the email address, delivery name and address used for it. You can ask us to remove those details (see below).
- Password reset links stop working after an hour, or as soon as one is used.
- Login sessions end after 7 days.
Your choices
- See and change your details: your name, email, password and photo are under Account settings, and your addresses under Addresses.
- Delete your account: at the bottom of Account settings. This can't be undone.
- Anything else, like a copy of what we hold about you or removing details from old orders: email kaungmyatglory@gmail.com.
Keeping it safe
The site only runs over HTTPS. Passwords are hashed with bcrypt, reset links are stored as hashes and expire, forms are protected against cross-site request forgery, and every page that shows personal data checks that it belongs to the person logged in.
Changes to this policy
If this policy changes, we'll update it here and change the date at the top.
Contact
For any question about this policy or your data, email kaungmyatglory@gmail.com.