Privacy

What we collect, and only what we collect

At checkout: your name, email address, telephone number and shipping address. That is the whole list, and it comes from the payment page rather than from anything on this site.

There are no customer accounts, no passwords, and no advertising trackers.

We do count page views, and it is worth saying exactly how. Each view records the page, the website you arrived from — its name only, never the full address you came from — and a random number that identifies the visit. There is no cookie, the number is forgotten when you close the tab, and your IP address is not stored with it. It tells us which pages people read. It cannot tell us who you are.

If you send an enquiry: the name, email address and message you type into the form.

If you use the assistant in the contact panel: what you type is sent to Anthropic, which writes the reply. We do not keep the conversation. Nothing is recorded unless you choose to leave a message at the end of it, and that becomes an ordinary enquiry.

If you join the register by post: your email address, and nothing else — no name, no source page.

Who else sees it

Stripe processes the payment and is where your card details go — they never reach us.

Your shipping address goes to İstanbul, where your rug is packed and handed to the courier. That is the only place it is sent.

Cloudflare Turnstile runs the anti-bot check on the checkout and enquiry forms.

Three companies hold or carry the shop itself rather than reading your details for their own purposes: Supabase stores the database, Vercel runs the site, and Resend delivers our email — which means the messages carrying your address to İstanbul, and your receipt to you, pass through it.

The database is held in the United States. If you would rather that were somewhere else, there is nothing we can offer you but the plain fact of it.

Nobody else. We do not sell, rent or share your details, and there is no advertising network on this shop.

How long we keep it

IP addresses recorded for rate limiting and fraud prevention are deleted after 90 days.

Order records — your name, address and the details of the sale — are kept for at least 180 days after delivery, because that is the window in which a card chargeback can still be raised and we may need to prove the rug arrived.

After that window you can ask us to erase your personal details. We do: your name, email, telephone and address are removed. The amount, currency and date of the sale stay, because they are financial records the business is required to keep.

Page-view records are kept for 90 days and then deleted.

If you joined the register by post, your email address is kept for as long as you want to be on it — there is no expiry, because a list that quietly dropped people would be unsubscribing them without being asked. If you unsubscribe, the address is deleted 30 days later; the delay is there so a mistaken click can be undone. If you ask us to erase it, it goes at once and completely.

Asking us to erase your details

Write to support@theanatolianrugs.com from the email address you used at checkout, and say which order the request is about. We reply to that address only — an erasure carried out on somebody else's say-so is itself a disclosure, so we will not act on a request that reaches us any other way without confirming it first.

Two copies are not reached by this and it is fairer to say so than to promise otherwise. The shipping documents for your order — the customs declaration and the proof of delivery — are kept as legal and financial records; they are stored privately and used for nothing else. Stripe keeps its own record of the payment, which we cannot delete on your behalf.