Privacy Policy

1. Scope

This policy explains how Rowad Alebdaa Company (trading as Hijabiin / حجابي إن), the operator of the Hijabiin platform (Amman, Jordan), collects, uses and protects your personal data, whether you are a shopper, a boutique owner or a visitor. The basis of the processing is the explicit consent given when the account is created, recorded with the version of the text agreed to, and it can be withdrawn; what a law requires, such as invoices and tax records, rests on that law.

2. Data we collect

• Account data: full name, e-mail address (verified by a code), Jordanian mobile phone number if you add one (verified by a code sent by text message to that number; verification texts are never sent to numbers outside Jordan), preferred language (it follows the language of the site or app you use the account in after signing in, and account messages are sent in it), and your password in an irreversible hashed form.
• Consent record: the version of the Terms of Use and the Privacy Policy — and, for store owners, the Seller Agreement — that was accepted, the fingerprint of that text, the time of acceptance and its channel (website or app), and every choice about marketing messages. No IP address or device type is stored with it.
• Addresses: governorate, city, address details and the delivery phone number for each address you save.
• My Measurements: a label you choose (e.g. "Me" or "My mother") and the height in centimetres for each measurement profile you save.
• Orders and payments: order contents and statuses, the payment method, and, when you choose transfer, the picture of the bank-transfer receipt and the transfer reference you enter. We collect no card numbers because we do not accept card payments.
• Content you create: reviews and their photos, your wishlist, back-in-stock alerts, support messages with their attachments, your private chat messages with boutiques inside the Platform, and photos of a returned piece attached to a return request (at most three, with location data removed before they are stored).
• Boutique data (for boutique owners): store name and the documents uploaded for review, payout account details, and, for a subscribing boutique, subscription invoices and their proofs of payment.
• Technical data: IP address, browser and device type, and pages visited. In the mobile app, once notifications are allowed: the device's push-notification token with the operating system and app version, registered after sign-in and revoked at sign-out.
• Statistics on searches that find nothing: when a search on the search page or the app's search screen finds no product, the search text is kept in its normalised form with the day and aggregate counters (how many times it was searched, how many of those the spelling correction rescued, and how many different visitors searched it); no account, session, IP address or time is kept with it. To count different visitors, a fingerprint is computed from the IP address with a random salt specific to that day, and the salt and fingerprints are deleted the next day, after which nothing can be linked to anyone. A search containing five or more digits, an e-mail address or a web address is never kept at all. A search text is shown to the Platform team only if three different visitors searched it on the same day. The sole purpose is improving search and its dictionary, and this data reaches no third party.
• Made-to-order requests: the description of the piece and the modesty attributes chosen, the reference photos attached, the quote, the deposit and its transfer proof, and the request's messages with the boutique.
• The pilot waitlist and invitations: the email address, name and note of whoever asks to join before the public launch, and an invitation addressed to a given email.
• Service ratings after delivery, the hem-shortening notes written next to a piece in the bag, and referral-programme data and platform credit (your code, who used it, and your credit ledger, including what is credited when a cash-on-delivery order is refunded).
• The public support page (without an account): the name, e-mail address, subject and message you write to us, and the language of the page. We ask for no phone number.
• Wholesale quote requests: the sender's name, e-mail address and company name, what was requested and any notes, and the replies of the store or the Platform; the request is linked to the account when it is sent from a registered account.
• Signing in with Google or Apple: for whoever chooses it, we receive the provider's account identifier, the e-mail address and whether it is verified, and the name; Apple sends the name only on the first sign-in, and the e-mail may be a private relay address that forwards to the real one. The name is used only when the account is created, as its editable name. We keep no provider sign-in token, except an encrypted token from Apple kept for one purpose: asking Apple to revoke the permission when the link is removed or the account is deleted. Provider data is not used for marketing and is not shared; its basis is the consent given by choosing this sign-in.
• Passkeys (for whoever adds them): we keep the key identifier, its public key, a device name, and the creation date, last use and use counter; we keep no fingerprint, face or phone passcode, because the check happens on the device itself. A passkey is deleted when it is removed or the account is deleted, and the export file carries its device name and dates but not the key.

3. Why we use your data

• Fulfilling orders: passing delivery details to the seller (a boutique or a seller under the Hijabiin name) and to the delivery company that carries the parcel, following up payment, and handling returns and refunds.
• Running your account: sign-in, e-mail and phone verification, password recovery, and notifications about order, payment and return status.
• Personalisation: where it is switched on, suggesting products based on the styles in your wishlist; and showing a "fits me" badge on the product page by matching a height saved in My Measurements against the piece's length, without asking your height every time.
• Safety and compliance: fraud prevention, moderation of reviews and photos, recording financial and administrative actions in an audit log, and meeting legal and tax obligations.
• Communication: general notices, bag reminders and back-in-stock alerts inside the Platform or by e-mail; each category can be switched off separately in your notification preferences. Marketing messages are sent only to accounts that explicitly agreed to them at sign-up or later, and that consent can be withdrawn at any time.
• Answering you: when you write from the public support page, we use your name and e-mail only to reply to your message by e-mail, in the language you wrote in. Nothing is sent to you until a member of the team replies.

4. Who we share your data with

We do not sell your personal data. We share it only as far as necessary with:

• The seller of the product — a boutique or a seller under the Hijabiin name: your name, delivery address and phone number to prepare the parcel, and whatever you write to them in the in-platform chat. Your phone number and e-mail are not shared through the chat, and you likewise receive no external contact channel for the boutique.
• The delivery company: delivery details and the cash-on-delivery amount if you chose it, handed over with the parcel by the seller or the Platform.
• Technical providers: server hosting and file storage (Amazon Web Services, in the European Union — Sweden), the e-mail delivery service, an AI image-review service that checks photos against the modesty standard (Google Gemini, or Anthropic as an alternative that runs only if enabled in its place) — it receives the product photos that sellers under the Hijabiin name upload, and receives review photos and tailoring reference photos only from a service tier that does not use them to train its models, otherwise the Platform team reviews them itself; it receives no name, e-mail or other account data, and the Platform team's decision always prevails over its verdict — suggested support-reply drafts (Google Gemini) which, if enabled, receive the ticket text with names, e-mail addresses, phone numbers and addresses removed, and no reply is sent until a support agent has reviewed and sent it, and the push-notification service (Firebase Cloud Messaging, by Google), which delivers notifications to the mobile app and receives the device token and a short preview of the notification text.
• The statutory auditor, where the Companies Law requires one: receives the register of official invoices and credit notes, including customers' names as printed on them, for audit and tax compliance only.
• The text-message service (Twilio, outside the Kingdom), once enabled: receives the phone number and the verification text alone when a number is verified or changed, and no name, e-mail or other account data.
• The national e-invoicing system (JoFotara) of the Income and Sales Tax Department: receives every tax invoice and credit note with the buyer's name printed on it, as the law requires.
• Advertisers and ambassadors: an external advertiser's contact details and an ambassador's name and internal note are kept to run the relationship and its invoices while it lasts, and are shown to nobody.
• Authorities: where a legal obligation exists or a competent authority requests it under Jordanian law.
• Transfers outside Jordan: the Platform's data is kept in the European Union (Sweden), with an encrypted backup at Cloudflare in its EU data region that only the Platform can decrypt and that is kept for recovery alone even after the original is deleted, whose level of protection is no lower than Jordan's Personal Data Protection Law. Limited data reaches providers in the United States or on Google servers outside Jordan — image review, push notifications, and suggested support replies if enabled — with the consent given at sign-up after this notice, and only as much as the purpose needs, with no name or e-mail in image review.

5. Cookies and local storage

We use the minimum needed to run the Platform and no third-party advertising trackers:

• Sign-in session cookie: a secure cookie the site's pages cannot read, which keeps you signed in for 30 days; it is removed on sign-out or when the session expires. Alongside it a small cookie carrying no identity tells the page a session exists so it can be restored (kept 30 days, removed on sign-out).
• Language cookie: remembers the language you chose (Arabic or English), and is removed when the browser closes.
• Short-lived verification cookies: when you confirm your identity before a sensitive action (5 minutes) and when you sign in with Google or Apple (10 minutes); they then expire on their own.
• Browser local storage, on this device only and never sent to the Platform: your light/dark theme preference, your last 8 searches, and the last 12 products you opened (for the “recently viewed” row), and the identifiers of the stores you blocked, with your account identifier, so that their items are hidden as soon as the site opens; they are deleted at sign-out. Clearing the site's data in the browser removes them; the searches can also be cleared from the search box.
• The bag before signing in: the pieces chosen, with their sizes and quantities, kept in this browser's local storage, or in the mobile app's storage on the phone, and sent to the Platform only when you sign in, to be added to your account's bag, then deleted from the browser or the phone; it is deleted automatically after 30 days, and clearing the site's data in the browser, or the app's data on the phone, removes it too. In the browser, a small cookie carrying nothing about the pieces and no identity tells the bag page that the bag is not empty, so the page can show it sooner; it is removed when the bag empties or after 30 days.
• Browser session storage: the e-mail address typed on the sign-in page, carried to the account-creation and password-recovery pages so it is not typed twice; it is removed once used or when the tab is closed. Also a marker holding the account identifier that says no notice of a material change to the Terms or this policy is pending, so the server is not asked on every page; it is removed when the tab is closed.
• In the mobile app: the session key, the notification token and the identifiers of the stores you blocked are kept in the device's secure system storage and deleted at sign-out. Kept on the device only, and never sent to the Platform: the chosen language, your last 8 searches, the last 12 products you opened, a copy of the public catalog pages shown offline for at most 24 hours, and a referral code arriving through a shared link, shown at checkout as an editable, removable suggestion in the discount-code field rather than an auto-applied code, and deleted as soon as it is used or after 30 days, whichever comes first. Orders, addresses, conversations and the profile are not stored on the device, except in the temporary files described next, and are cleared from the app's memory when the session ends.
• Temporary files in the mobile app: anything the app creates for sharing or uploading (an invoice PDF, the data export, and the photos and documents picked for upload) is kept temporarily in the app's cache and deleted at sign-out and on the next launch. Private images, such as support-ticket attachments, are never written to the device's disk; only the public images shown in the store are cached on disk. Opening a ticket attachment happens in the system browser, whose cache follows that browser's settings.
• The optional lock in the store app: an optional lock checks the user with a fingerprint, face or the phone's passcode. The check is done on the phone itself by the operating system, so neither the app nor the Platform receives any biometric data; the only thing kept on the phone is a flag saying whether the lock is on, in the device's secure storage, and it is deleted when you sign out.
• Search history and recently opened products in the mobile app: erased from the phone when you sign out or when the session ends.
• Mobile app permissions: the app asks for the camera to photograph a returned piece when requesting a return, and for the photo library to attach a transfer receipt, review photos, photos of a returned piece or support attachments. Neither is used for anything else, and either can be refused or withdrawn in the device settings, affecting only what needs it.

6. How long we keep data

• Account data: for as long as the account exists.
• Consent record: kept permanently, and after an account is deleted it stays linked to the anonymised account, because the Platform must be able to prove the consent it processed data on.
• Seller identity documents and payout account: the images and number of the identity document or licence, and the payout-account details, are kept while the store exists and then for five years after it is closed, following anti-money-laundering record-keeping practice, after which they are deleted automatically. Payouts and invoices stay with the permanent financial books.
• Orders, financial records and the audit log: kept permanently as financial books that may not be altered or deleted, in line with accounting and tax obligations; they include the official invoices and credit notes, with the name, phone number and address printed on them.
• Abuse-protection events: order, payment and verification-text requests per account, and a network fingerprint encrypted with a key from which the address cannot be recovered, are recorded briefly to spot unusual repetition; no raw IP address and no device identifier is kept. These events are deleted after 48 hours, and immediately when an account is deleted; the review note they may have produced stays, without further identifying data.
• In-platform conversations: kept in the Platform's records; the Platform team may read them upon a complaint or suspected breach. When you delete your account the texts of the messages you sent are erased and your identity is detached from them, while the other party's messages remain.
• Verification codes, expired sessions and temporary export files: deleted automatically after they expire — an export file seven days after it is made available.
• Photos of a returned piece: kept for as long as the return request, with the order's records; any uploaded but never attached to a return request is deleted automatically after a day.
• Statistics on searches that find nothing: any text fewer than three different visitors searched on its day is deleted the next day, and the rest after ninety days.
• Messages from the public support page: kept in the support desk's records with the name and e-mail you gave, like any other support request, so the team can reply and follow up a complaint.
• Wholesale quote requests: a request that has been settled — accepted, declined or closed — is deleted with its messages twelve months after it was settled; an open request is not deleted.
• Made-to-order requests: kept with the order and payment records as financial books; on account deletion what the account holder wrote and the reference photos are erased, as in section 7.
• The pilot waitlist: a request to join is deleted ninety days after the invitation is sent or the request declined. Messages from the public support page and wholesale quote requests sent without an account: the sender's identity and text are erased twelve months after they are resolved; the status and dates remain.
• In-account notifications: read ones are deleted after twelve months, unread ones stay. Automatically suggested reply drafts for support tickets: deleted ninety days after the ticket is resolved. Raw notifications received from the payment gateway, once one is enabled: deleted after one hundred and eighty days.
• Web server logs: each request records the IP address and the page path without its parameters and without identity data; the logs are deleted after fourteen days.
• Google or Apple link: kept while the link exists and deleted at once, with the encrypted Apple token, when it is removed or the account is deleted; temporary sign-in requests are deleted an hour after they expire.

7. Your rights

• Access and correction: view and edit your account data from your account page and settings.
• Export your data: from account settings you can request a copy of your data; the request is processed by the Platform team and a file containing your data is then made available for download from inside your account only: your account, addresses and measurement profiles, your orders and what they contained, payments and transfer references, coupons redeemed, refunds, returns, reviews, support messages, conversations, wishlist, cart, alerts, sessions and devices, and the invoices and credit notes issued for your orders, your tailoring requests with their quotes and payments, your referral code with what it brought and its credit ledger, your boutique service ratings, your registered passkeys by name and date, your previous export and deletion requests, and the wholesale quote requests sent from the account. Photos and attachments you uploaded are listed by count, without their contents. The file stays available to download for seven days and is then deleted automatically; a new copy can be requested at any time. The internal notes the support team writes on the account's tickets are not part of the file; they are available to the account holder on request through the support centre once the team has reviewed them, except for anything that would reveal another person's data or security measures.
• Delete your account: from account settings you can request deletion. Because order records are permanent books, deletion is carried out by anonymisation: your identifying data is replaced with anonymised values that cannot be linked to you, the account is closed permanently, any previous export files, the notification tokens registered for your devices and your saved measurement profiles are removed, and one confirmation is sent to the address the account had. The description of your tailoring requests and the cancellation or dispute reasons you wrote are erased too, and their reference photos deleted, so a deletion waits while a tailoring request is still open; your review photos are deleted, your review comment is erased and the stars remain; the text of support tickets and their messages that you wrote is replaced with a deletion notice and their attachments are deleted, while the status and dates remain; the text of messages the chat filter refused is erased; your referral code is deactivated; the descriptions you wrote on return requests and your hem-shortening notes are erased; and in wholesale quote requests the sender's name and e-mail are replaced and what was requested and the notes are erased, while the company name and the replies of the store and the Platform remain. Deletion also reaches what the account's email sent before the account existed: the waitlist request is deleted, the email is removed from an invitation addressed to it, and the identity and text of its public-support messages and wholesale requests are erased. Transfer references are erased from your payments; the books keep only a keyed fingerprint of each, held solely to match a disputed transfer against a bank statement. Every transfer receipt uploaded, including one later replaced by a newer upload, stays with the permanent financial records, as proof of payment. Photos of a returned piece likewise stay with the return request, as part of its record. So do the official invoices and credit notes already issued: they are tax documents that cannot be altered, so they keep the name, phone number and address printed on them.
• Sellers — store owners and members of their teams — have the same two rights, used the same way. A store owner's export also contains, among other things, the store's details, the identity documents submitted (their type, number, status and file count, without the files), the payout account, the subscription and its invoices, payouts, and the store's orders with their amounts and statuses but without the buyers' identities. A store owner's deletion request is a closure request that can be submitted only once the store is settled; a refusal lists what remains — no orders being prepared or shipped, no open return, no delivered parcel or paid tailoring request not yet settled, no open tailoring request, no payout still to be either transferred or forfeited, no amount owed to the Platform that has been neither recovered nor written off; the store is then closed permanently, its products are archived and the owner is anonymised as described above, while the identity documents and payout account are kept for the period stated in section 6. Deleting the account of a store team member ends that membership and leaves the store untouched. A store owner whose account is suspended or closed, and who cannot sign in for that reason, may ask for this through the support desk: the Platform team verifies their identity and files the request on their behalf, and once a data copy is ready a link is sent to their registered e-mail address only, valid the usual seven days.
• Switch off non-essential notifications: from the notification preferences in your account, category by category.
• Being told of a breach: if a breach of the security or integrity of your data is likely to cause you serious harm, you receive a notice within 24 hours of its discovery — by e-mail, inside your account, and in the mobile app if its notifications are on — saying what happened, which data was affected, what was done and what you can do, whatever your notification preferences; and we report it to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship within 72 hours.
• Personalisation and automated decisions: suggestions and the "fits me" badge are worked out only from your wishlist and the height saved in My Measurements, and no decision with any effect on you is based on them; deleting the height from My Measurements or emptying the wishlist stops them. No decision about you is made by automated means alone: a human decision by the Platform team always overrides the automated image review, and you can ask for it to be reviewed through the support centre.
• Objection and complaints: through the support centre inside your account, or from the public support page if you have no account; you also have the right to complain to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship.
• A linked Google or Apple account: it can be unlinked from account settings at any time unless it is the last way to sign in, and the data export includes linked accounts (provider, e-mail and link dates). When the link is removed or the account deleted, Apple is asked to revoke the permission; the request can fail if the connection drops, and the permission can also be revoked from the Apple account settings.

8. How we protect your data

• Encrypted connections (HTTPS) and passwords stored hashed with approved algorithms.
• Access to data is permission-bound: a boutique sees only its own orders, and every administrative action is recorded in an audit log with who performed it and when.
• Uploaded files (payment proofs, review photos, support attachments, photos of a returned piece, a tailoring request's reference photos, data export files) are stored in a private space and served only through signed links that expire within 15 minutes: to the people entitled to them, and — once a review photo is approved — to visitors of the product page. A tailoring request's reference photo is never shown to the boutique until it has been reviewed automatically (and sometimes by hand) and confirmed to meet proper Islamic hijab; until then only you can see it. A data export file is downloaded only from inside its owner's account.
• Photos that others see (product photos, shop logos and covers, review photos) are saved again without the information a phone embeds in them — such as the place where the photo was taken.
• The bank account numbers sellers give to receive payouts, and the national identity numbers they submit, are stored encrypted at field level.
• Payment proofs, identity documents and support attachments, whether photos or PDF files, have the hidden data they carry removed before they are stored — among it the place of capture, the device model and the file author's name; a file that cannot be read is stored as received.

9. Children

The Platform is intended for adults aged 18 and over. We do not knowingly collect data from anyone younger, and we delete the account if we learn of it.

10. Changes to this policy

We may update this policy from time to time; the updated text is published here with the “Last updated” date, and users are notified of material changes inside their account by a notice that summarises the change and links to the updated text; it stays until it is closed, and the time it was closed is saved to the account as a record that the notice was delivered.

11. Contact

For any question about your privacy or to exercise any of your rights, contact us through the support centre inside your account, or — without an account — from the public support page.