Privacy policy

Qadeem Crafts sells hand-made pieces from Pakistan through this website. This page explains what we collect, why, who we share it with, and what you can ask us to do with it. It was last updated on 17 September 2026.

What we collect

When you place an order: your name, email address, phone number, delivery address, the courier you chose, how you paid, and anything you write in the note. We need all of it to deliver the piece and to keep the shop's accounts.

When you create an account: your name, your email address and a one-way hash of your password, never the password itself. If you sign in with Google, Google gives us your name and email address instead. An account holds your order history and the pieces you have saved.

When you use the contact form: your name, email address, phone number if you give one, and your message. It is emailed to us, not stored on the website.

When you browse, and only if analytics is allowed: the pages and pieces you look at, your approximate location from your IP address, and your type of device and browser. See Analytics, below.

Payments

We never see or store your card number. Card payments from abroad are taken by Stripe, and card and wallet payments in Pakistan by Bank Alfalah, each on its own secure payment page. They tell us whether a payment succeeded and its reference, and nothing else about your card.

Who we share it with

We do not sell personal information, and we do not share it for advertising.

We share only what each party needs to do its part: your delivery details with the courier carrying your parcel, your payment with Stripe or Bank Alfalah, your email address with our email provider so your order confirmation reaches you, and what we store with the companies that host this website and its database. We will also disclose information where the law requires it.

Analytics

We use Google Analytics to see which pages and pieces people look at and where the shop loses them, so we can improve it. It sets cookies to recognise a returning visitor, and it reports to us in totals. It does not tell us who you are.

If you are in the European Economic Area, the United Kingdom or Switzerland, analytics is off until you accept it. Everywhere else it is on unless you turn it off. Either way you can change your mind at any time with Cookie settings at the foot of every page, and turning it off also deletes the analytics cookies already in your browser.

When an order is placed, or its payment is confirmed, our server tells Google Analytics the order number, the pieces in it and the total. That report is linked to the analytics identifier already in your browser and is sent only if that identifier exists, so if you declined analytics or block it, nothing about your order is sent. Your name, email address, phone number, address and note are never sent to Google.

Google keeps this data for 14 months. You can also block Google Analytics on every website with Google's browser add-on, at tools.google.com/dlpage/gaoptout.

Cookies and browser storage

_ga and _ga_ followed by an id: Google Analytics. They recognise a returning visitor and group visits into sessions, for up to two years. Set only when analytics is allowed.

qc-consent: whether you accepted or rejected analytics, so you are not asked on every page. Kept for 180 days.

qc-consent-region: whether the law where you are browsing requires us to ask before using analytics. Kept for one day.

qc-currency: the currency prices are shown in. Kept for 180 days.

authjs cookies: keep you signed in and protect the sign-in form from forgery. Set only when you sign in.

qc-auth-event: set for two minutes after you sign in with Google, so analytics can count that sign-in once. Deleted as soon as it has been read.

Your cart and your light or dark theme are kept in your browser's local storage rather than in cookies. The cart holds only which pieces you added.

The map at the foot of each page is Google Maps, and the video testimonials play from YouTube in its privacy-enhanced mode. The map loads when you scroll to it and a video when you press play, and Google's own privacy policy applies to both.

How long we keep it

Orders are kept for as long as tax and accounting law requires. An account is kept until you ask us to delete it. Messages from the contact form live in our email, and we delete them when the conversation is over.

Your choices and rights

You can ask for a copy of the personal information we hold about you, and ask us to correct or delete it. Some order records have to be kept for the accounts after an account is deleted, and we will tell you if that applies. Write to us through the contact page and we will reply within 30 days.

If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.

Security

Every page on this site is served over an encrypted connection. Passwords are stored as one-way hashes, card details never reach us, and order records are open only to the people who pack and ship them.

Children

The shop is not meant for children under 16, and we do not knowingly collect their information.

Changes to this policy

When this policy changes, the date in its first paragraph changes with it.