Privacy policy

What we collect

When you sign in with Google: your Google account ID, email address, name and profile picture link, which Google shares with us when you choose to sign in. We do not receive your Google password and we do not ask Google for anything else (no contacts, no Drive, no Gmail). "Google user data" below says exactly what we do with them.

When you place an order: the name, phone number and (optionally) email you enter; whether you want delivery or pickup; for delivery, the address you type and the point you place on the map; any notes; any reference pictures you attach (for example, of clothes to copy onto the doll); and the dolls you designed, with their prices.

Pictures you attach are made smaller in your browser before they are sent, which also removes the information a phone camera stores inside a photo, such as where it was taken. They are stored with your order and can be seen only by you (when signed in) and the shop's makers.

When you join the waiting list (offered while the shop is fully booked): the name, phone number and (optionally) email and note you enter, your language, and the dolls in your cart. If you are signed in, your entry is linked to your account.

Designing a doll needs no account and sends nothing personal: the design is kept in your own browser until you order or join the waiting list.

Google user data (Sign in with Google)

Signing in with Google is optional: designing a doll, seeing its price, ordering and joining the waiting list all work without it. If you choose to sign in, Google shares with Beloved Crochet only your basic profile: your name, your email address, your profile picture (a link to it) and your Google account ID, a number that tells your account apart from others. These are the "openid", "email" and "profile" permissions Google asks you to allow. We ask Google for nothing else — not your contacts, Drive, Gmail, calendar or any other Google data — and we never see your Google password.

We use this data only to: sign you in and keep you signed in; show your name and picture in the account menu; link the orders you place while signed in to your account, so that you can follow them under My orders, and likewise a waiting-list entry you make while signed in; fill in your name and email at checkout and on the waiting list where those boxes are still empty (you can change them); show the shop's makers the email address of the account an order or a waiting-list entry came from; count, for the makers' own figures, how many orders came from signed-in and returning buyers; and recognise the shop's makers by their email address, to let them into the maker dashboard where they manage orders.

We do not sell Google user data, use it for advertising or to build a profile of you, or use it to train artificial intelligence models, and we do not share it with anyone except as this policy describes: it is stored on Google Cloud, which hosts the website, and we disclose it only where the law requires. Beloved Crochet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where it is kept, and for how long: your account record (Google account ID, email address, name and picture link) is stored in the shop's database on Google Cloud servers in Doha, Qatar, and is refreshed from Google each time you sign in. It is kept for as long as you have an account with us. Your sign-in itself lasts until you sign out, or 30 days after you last use the website, and is never copied into a backup. The database's hourly backups, in Google Cloud Storage, are deleted automatically after 30 days. Google Cloud keeps the database and the backups encrypted on disk.

Deleting your account: send us a message on Instagram (@belove_crochet) asking us to delete your account, with the email address of your Google account. Within 30 days we delete your account record and end all of its sign-ins, so that you are signed out everywhere; it then leaves the backups as they expire, within a further 30 days. Your orders are not deleted with your account, because we need them to make, deliver and account for them: they keep the name, phone number and address you typed at checkout, are no longer linked to any Google account, and so no longer appear under My orders. Ask us if you want them deleted too (we may have to keep the record the law requires). Removing Beloved Crochet's access at myaccount.google.com/permissions stops Google sharing your details with us again, but does not delete what we already hold: for that, ask us.

Why we use it

Only to make and deliver your order: to contact you about it, to deliver it to the right place, and to show you your orders and their progress when you sign in. Signing in with Google also lets the shop's makers into the maker dashboard.

If you join the waiting list: only so that the shop's makers can call or message you, about the dolls you wanted, when the shop takes orders again. Joining is not an order, and nothing is charged.

We do not sell your information, we do not use it for advertising, and we do not use analytics or tracking cookies.

Who else sees it

The shop's makers, who see orders in order to make and deliver them, and the waiting list in order to call the people on it. Nobody else is shown the waiting list.

Cloudflare: every request to the website passes through Cloudflare, which protects the site from attacks and delivers it quickly. Like any network provider it sees your IP address, your browser's details and the pages you ask for, and keeps them in its own short-term logs, under its own privacy policy (cloudflare.com/privacypolicy). It may set a strictly necessary security cookie of its own when it checks for automated traffic. No analytics or tracking script, Cloudflare's or anyone else's, runs in your browser.

Google: the "Sign in with Google" button is loaded from Google wherever it is offered (the account menu, checkout, My orders and the maker dashboard), so Google sees your IP address and browser when it loads, even if you do not sign in; signing in is under Google's own privacy policy (policies.google.com/privacy). Once you are signed in, your profile picture is shown from Google's servers. The website and its database run on Google Cloud servers in Doha, Qatar (region me-central1), with hourly backups stored in Google Cloud Storage.

OpenStreetMap: the map at checkout loads its tiles from OpenStreetMap's servers. Its address service, Nominatim, receives the text you search for, and the point where you put the pin on the map, to fill in the street and area for you. Their policy is at osmfoundation.org/wiki/Privacy_Policy.

Google Maps: to plan a delivery, a maker may open the pin you placed in Google Maps, which sends its location to Google.

WhatsApp: a maker may call or message you on WhatsApp about your order or your place on the waiting list; that conversation is under WhatsApp's own terms and privacy policy.

A delivery courier, who is given the name, phone number and address needed to deliver your order.

Anyone the law requires us to share it with.

Cookies and your browser

We use two cookies, both strictly necessary: a session cookie that keeps you signed in, and a security token that protects your account from forged requests. Neither tracks you.

Your browser also remembers, on your device only, your doll design, your cart, and your language and light/dark choice. While "Remember my details on this device" is ticked at checkout or on the waiting list, it also keeps the contact details and delivery address you entered there, so you do not have to type them again; untick it on a shared phone or computer. Signing out removes those details from the device, and so does clearing your browser's site data.

How long we keep it

Orders, and any pictures attached to them, are kept for as long as we need them for the order, for after-sales questions and for our accounts and legal obligations; deleting an order deletes its pictures. Your sign-in record is kept while you have an account. Backups are deleted automatically after 30 days.

A waiting-list entry is kept until one of the shop's makers removes it, usually once she has been in touch with you, and removing it deletes it. You can ask to be taken off the list at any time. Joining again with the same phone number updates your entry rather than adding a second one.

Your choices and rights

You can ask us for a copy of the information we hold about you, to correct it, or to delete it, which includes taking you off the waiting list (we may need to keep an order record the law requires us to keep). You can also remove Beloved Crochet's access to your Google account at any time at myaccount.google.com/permissions.

We handle personal data in line with Egypt's Personal Data Protection Law (Law No. 151 of 2020).

Children

Our dolls are for children, but the website is for adults buying them. We do not knowingly collect information from children; an order should be placed by a parent or other adult.

Security

The website is served only over HTTPS. Access to orders and to the waiting list is limited to signed-in makers, and passwords are never stored: sign-in is handled by Google.

Changes and contact

If we change this policy, we will update this page and the date at the top.

Questions or requests: send us a message on Instagram at @belove_crochet (instagram.com/belove_crochet).