Privacy Policy

This Privacy Policy explains how Lebseh collects, uses, and protects your personal information when you visit lebseh.com, place an order, or contact us by email.

1. Who we are

Lebseh is the brand and operator of this website. References to "we," "us," and "our" mean Lebseh as the data controller for the site. References to "you" and "your" mean the visitor or customer using it.

2. Information we collect

We collect information to fulfil orders, operate the store, and measure usage and advertising. Categories include:

• Account information, your name and email when you sign up or sign in (via email magic link or your Google account). We never see or store any password.
• Order and delivery details, your shipping address, phone number, and the items in your order. We use the phone number to confirm timing and the address before dispatch.
• Order history, what you've ordered, when, and the delivery status. Linked to your account if you have one, or to your guest session otherwise.
• Communications, emails you send to contact us and the contents of our replies.
• Usage data, pages visited, device type and random identifiers for measuring visits and shopping activity. Events may be linked to your Lebseh account when you sign in. Selected ad measurement data is sent to Meta as described below.
• Technical data, your approximate country (from your IP address, via our hosting provider), browser type, and request timestamps. Used for fraud prevention and performance monitoring.

3. How we use your information

• Process and fulfil your orders, including sharing your delivery address with our courier so they can find you.
• Send transactional emails about your order (confirmation, dispatch, delivery).
• Communicate with you about questions, issues, or returns you raise.
• Operate the site reliably, measuring traffic, fixing bugs, and watching for fraud.
• Improve the product catalogue and shopping experience over time.
• Comply with legal obligations, including tax records, audits, and valid law-enforcement requests.

4. Sharing with third parties

We share data with providers that operate the website and with Meta for ad measurement as described below:

• Cloudflare, hosting, edge delivery, and the database that stores your account and orders.
• Azure Communication Services, sending transactional emails (order confirmations, magic-link sign-in emails).
• Google, if you choose to sign in with Google, your Google profile (name, email, profile picture) is shared with us for authentication only.
• Delivery couriers, your name, address, phone number, and order contents are shared with the courier handling your order.

We may also disclose information if required by a valid legal request or to protect Lebseh's rights, property, or the safety of our users.

5. How long we keep your data

• Account data, kept while your account is active. Inactive accounts and their data are removed after three years of no activity.
• Order records, kept for the period required by applicable tax and commercial law (typically several years).
• Magic-link tokens and session tokens, short-lived; deleted automatically shortly after use or expiry.
• Usage data, pages visited, device type and random identifiers for measuring visits and shopping activity. Events may be linked to your Lebseh account when you sign in. Selected ad measurement data is sent to Meta as described below.
• Support emails, kept for as long as needed to resolve the issue, typically up to two years.

6. Cookies and similar storage

Lebseh uses cookies and browser storage for sign-in, the cart, and usage and advertising measurement:

• Session cookie, keeps you signed in. Removed when you sign out.
• Cart cookie, remembers the items in your cart between visits so you don't lose your selection.
• Visit and measurement identifiers, random identifiers that connect browser activity across visits. They do not mean the data is anonymous to every party processing it.

We use Meta ad measurement tools as explained below.

Meta ad measurement and your choices

We use Meta tools to measure Facebook and Instagram ads and connect visits to ads. Measurement is enabled by default. You can use “Turn off Meta ad measurement” at the bottom of the website without affecting shopping or order submission. We also honour Global Privacy Control signals sent by your browser.

We send Meta browser and ad identifiers, IP address and browser information, and events for viewing shop pages and products, adding items to the cart, starting checkout and placing an order, including product identifiers and order value in JOD where available. This integration does not send customer names, email addresses, phone numbers, delivery addresses, messages, customer artwork or text, or private order-page URLs. A cash-on-delivery order being placed does not mean its payment has been collected.

Measurement identifiers are stored in cookies for up to 90 days. Your Meta measurement opt-out is stored for 180 days in the same browser unless you delete its cookies. Opting out removes matching identifiers from your browser and stops new events; it does not automatically delete events already sent. Meta processes received data under its Privacy Policy.

7. Your rights and choices

You have the right to:

• Access the personal information we hold about you.
• Correct information that is wrong or out of date.
• Delete your account and the personal data tied to it. (We'll keep order records for as long as required by law, even after account deletion.)
• Unsubscribe from any non-essential emails using the link in those emails.

To exercise these rights, contact us from the address linked to your account.

8. Children

Lebseh is intended for users aged 18 and over. We don't knowingly collect information from children under 18. If you believe a child has shared information with us, contact us and we'll remove it.

9. International transfers

Lebseh runs on a global edge network, so your data may be processed in countries other than your own. Our hosting and email providers maintain industry-standard security and contractual safeguards for international transfers.

10. Security

We use HTTPS across the site, encrypt sensitive data at rest in our database, sign you in via short-lived magic links rather than passwords, and limit administrative access to a small team. No system is ever completely secure, but we monitor for unusual activity and patch quickly when issues are found.

11. Changes to this policy

We may update this Privacy Policy as the site grows. The "Last updated" date at the bottom of this page shows when the current version took effect. Material changes will be highlighted on the site for a reasonable period.

12. Contact

Questions, requests, or concerns about your data? Contact us and we'll respond as soon as we can. See also our Terms of Service for the rest of how the site works.