Privacy Policy
How we collect, use, and protect your data.
Data We Collect
When you create an account we store your name, email address and a scrypt-hashed password — never the password itself. When you place an order we process your shipping address, phone number and order details. If you subscribe to our newsletter we store your email address, and when you leave a review we store the name and comment you submit. With your consent, our self-hosted analytics also records pseudonymous usage data (pages visited, general device and browser information, and approximate region); raw IP addresses are never stored.
How We Use Your Data
We use your information to process and deliver your orders, send order confirmations and shipping updates, manage your account, and respond to your inquiries. Newsletter emails are sent only to subscribers and every message includes an unsubscribe link. With your consent, anonymized analytics help us understand how the store is used so we can improve our collections and your experience. We never sell your personal data.
Third-Party Processors
Payments are processed by Stripe; we never see or store your full card details. Product images are delivered through the jsDelivr CDN, and orders are shipped by carriers such as DHL and UPS, who receive only the delivery details they need. Review translations are provided by DeepL, approximate location is resolved via ipwho.is when your network does not supply it, and weather context comes from Open-Meteo — none of these services receives your account or order identity from us.
International Data Transfers
Our primary databases are self-hosted on our own infrastructure. Some processors listed above (for example Stripe and the jsDelivr CDN) may process limited data in other countries as an inherent part of providing their services. Wherever data crosses borders, it is limited to what the service strictly requires and is protected by contractual and technical safeguards.
Data Retention
Order records are retained for the period required by applicable tax and commercial law (up to ten years in Türkiye). Account data is kept until you delete your account, newsletter subscriptions until you unsubscribe, and product reviews until you ask us to remove them. Analytics data is pseudonymous, is never linked to your identity, and is periodically aggregated and pruned.
Your Rights
Under the GDPR and Türkiye's KVKK you have the right to access, correct, export and delete your personal data, to object to or restrict processing, and to withdraw consent at any time — including analytics consent via Cookie Settings. You can delete your account yourself from Account Settings, or contact us to exercise any of these rights; we respond within 30 days.
Security
All traffic is encrypted with TLS, passwords are stored as scrypt hashes (OWASP-recommended parameters) and never in plain text, and payment data is handled exclusively by PCI DSS-compliant Stripe. Access to our systems is restricted, session tokens expire automatically, and we continuously review our infrastructure for vulnerabilities.
Contact Us
For any privacy question or request, email our data protection contact at privacy@irematelier.com or write to Irem Atelier, Nişantaşı, Istanbul, Türkiye. We aim to answer every request within a few business days.