Privacy Policy

[TBC — registered legal entity name], trading as Eyevora and licensed in Dubai, United Arab Emirates under trade licence [TBC — trade licence number], is the controller of the personal data described here. That means we decide what is collected and why, and we are answerable for it.

For anything to do with your data, write to privacy@eyevora.com. That inbox is monitored specifically for privacy requests.

This policy is written to meet UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL).

We collect only what the store needs to function.

You give us

• Account details — name, email address, password (stored only as a cryptographic hash, never in readable form), and phone number if you add one.
• Order details — delivery address, recipient name, phone number, what you bought, and the amount paid.
• Prescription information, where you order prescription lenses: your prescription values and pupillary distance. This is health-related data and is treated as sensitive under the PDPL — see section 4.
• Messages you send through the contact form, by email or on WhatsApp, including anything you choose to put in them.

We collect automatically

• Technical data — IP address, browser and device type, and the pages you visit, used to keep the site working and secure.
• Analytics — how the site is used in aggregate, so we can find what is broken or confusing. See the Cookie Policy.

We never collect

• Your card number. Card details are entered directly into Stripe’s payment fields and never reach our servers. We see only the card type, the last four digits and whether the payment succeeded.
• Your try-on photo. See section 4.

The PDPL requires a lawful basis for each purpose. Ours are set out below. Where the basis is consent you may withdraw it at any time, and doing so does not affect anything done before you did.

We do not make decisions about you by automated means alone that produce a legal or similarly significant effect. Tabby and Tamara carry out their own automated credit assessment when you choose them; that decision is theirs, and their privacy notices explain it.

We say this precisely because the honest version is stronger than the vague one: there is no upload to opt out of, and nothing for us to delete on request, because nothing about your face reaches us.

Prescription data is different. If you order prescription lenses we must receive and keep your prescription in order to make them and to prove what was made. This is health-related data, treated as sensitive under the PDPL:

• we ask for your explicit consent before you provide it;
• it is used only to produce your lenses and to handle any later query about them;
• access is restricted to the people who need it to fill the order and to our glazing partner;
• it is never used for marketing, profiling or analytics, and never sold or shared with an advertiser.

We do not sell your personal data, and we never will. We share it only with the providers who make the store work, each bound to use it solely on our instructions. In full, they are:

We also share your name, address and phone number with the courier delivering your order — one of Aramex, Fetchr, Shipa, Emirates Post — because a parcel cannot be delivered otherwise.

Beyond this, we disclose data only where the law requires it, where a court or regulator properly demands it, or where it is necessary to establish or defend a legal claim. If the business is sold or restructured, data may transfer to the buyer, who remains bound by this policy.

Some of your personal data is processed outside the United Arab Emirates. We think you should know exactly how, rather than have it buried in a sentence about “global infrastructure”.

• Our database and files run on servers we operate ourselves in the European Union. Your account, orders and addresses live there.
• Our website and image delivery are served through Netlify and Cloudflare, which use a global edge network — pages are served from wherever is nearest to you.
• Payments, email and error monitoring involve providers based in the United States, listed in section 5.

Under Articles 22 and 23 of the PDPL, personal data may be transferred abroad where the destination offers an adequate level of protection or where appropriate contractual safeguards are in place. We rely on contractual safeguards with each provider above, and we choose providers who commit to recognised data protection standards.

• Order and tax records — 7 years from the end of the tax period, because UAE tax law requires it. This is the one category we cannot delete on request.
• Account details — for as long as your account is open, then deleted when you close it, apart from the order records above.
• Prescription data — kept while we may still need to answer a question about lenses we made, then deleted.
• Support messages — two years from the last message in the conversation.
• Marketing consent — until you withdraw it, plus a minimal record that you did so, which is how we avoid contacting you again.
• Analytics — as set out in the Cookie Policy.

• Everything travels over encrypted connections (HTTPS/TLS).
• Passwords are stored as salted hashes. Nobody at Eyevora can read your password, and we will never ask you for it.
• Card details are handled entirely by Stripe, a PCI DSS Level 1 provider, and never touch our systems.
• Our database is not exposed directly to the internet; access is brokered through an authenticated tunnel, and administrative access is restricted to named people.
• Product images are served from private storage rather than public buckets.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the UAE Data Office as the PDPL requires.

Under the PDPL you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Correct anything inaccurate or incomplete.
• Erase your data, subject to records we must keep by law.
• Restrict or object to certain processing, including profiling.
• Portability — receive your data in a structured, machine- readable format, or have it sent to another controller.
• Withdraw consent at any time where consent was the basis.

To exercise any of these, email privacy@eyevora.com. We respond within 30 days. We may ask you to confirm your identity first — not as an obstacle, but because handing someone’s data to the wrong person is the worst outcome available to us.

Exercising these rights is free, and we will not treat you differently for it.

We send marketing email only if you have opted in. Every message carries a one-click unsubscribe link, and you can also email us to opt out. Unsubscribing from marketing does not stop transactional messages — order confirmations, dispatch notices and refund notifications — because those are part of supplying what you bought.

This site is not intended for children, and we do not knowingly collect data from anyone under 18. A parent or guardian may order eyewear for a child, in which case the account and its data belong to the adult. If you believe a child has given us personal data, tell us and we will delete it.

We update this policy when what we do with data changes. The date at the top of the page shows when it last changed, and material changes are notified to account holders by email before they take effect.

If you are unhappy with how we have handled your data, tell us first at privacy@eyevora.com — we would rather fix it than have you escalate. You also have the right to complain to the UAE Data Office, the federal authority responsible for personal data protection, at any time and without going through us first.