Gizlilik

When you buy: your name, email address, telephone number and shipping address. You type them into Stripe's payment form, and Stripe passes them to us with the order.

If you open an account: your email address and a password — the password is held by our database provider in scrambled form, and we never see it. If you sign in with Google instead, Google tells us your name and email address. An account also keeps your orders and the pieces you save. When you sign in, the internet address and browser the sign-in came from are recorded, to keep the account secure.

If you send an enquiry: the name, email address and message you type into the form. A custom rug brief adds the tradition, colour and measurements you choose; the contact form adds a subject and, if you give one, an order number. A trade application adds your practice's name and type, and its website and registration number if you give them.

If you use Ask Us, the assistant in the contact panel: what you type is sent to Anthropic, the company that runs the model, so the assistant can write a reply and look up our current catalogue. The site itself does not store your Ask Us messages — there is no conversation history on our servers. The conversation is kept only in this browser tab: it is still there if you close the panel and open it again, and it is cleared when you close the tab. Anthropic handles what it receives under its own terms and privacy policy.

If you join the register by post: your email address, and nothing else — no name, no source page.

When you browse, we count page views ourselves, and it is worth saying exactly how. Each view records the page, which piece it was about, the website you arrived from — its name only, never the full address you came from — the country your connection comes from, and a random number that identifies the visit, which your browser forgets when you close the tab. Adding a piece to your cart and the steps of checkout are counted the same way. Your IP address is not stored with any of it. It tells us which pages people read and where they stop. It cannot tell us who you are.

We advertise on Google and on Meta (Facebook and Instagram), and we use their tools to learn which advertisements lead to a sale.

Google Analytics and Google Ads run on the shop's pages — never on the payment, order-confirmation, order-tracking or account pages. Google Analytics records the pages you visit, how you arrived, the kind of device and browser you use and how you use a page — scrolling, links that leave the site, downloads, video and the forms you interact with — and sets Google's own cookies (_ga, and a second _ga cookie named after our Analytics property) to recognise a returning browser. Google Ads sets _gcl_au, and _gcl_aw when you arrive from one of our Google advertisements, to connect a visit to the advertisement. It also adds this browser to audiences we can show our advertisements to later, on Google's services and on sites that carry Google advertising — whether or not you came from an advertisement. How Google uses the information it receives from sites like this one is explained at https://policies.google.com/technologies/partner-sites

Meta's pixel loads only if you arrived from a link on Facebook or Instagram that carries the fbclid parameter — Meta adds it to its advertisements and to many other links opened from its apps — and only for seven days after the most recent such visit. For everybody else it never loads. While it runs it records the pages you visit, the pieces you look at or add to your cart and the buttons you press, and sets Meta's cookies, _fbp and _fbc.

When you start a checkout, choose how to pay, or complete a purchase, our server tells Google — and Meta, if its pixel has loaded for you in the last seven days — that it happened: the amount and the currency, our reference for the checkout or the order, and the identifier the platform's own cookie set in your browser (Google's _ga; Meta's _fbp and _fbc). Meta is also told which pieces, by the number each piece carries in our product catalogue. The _gcl_aw cookie is not sent to Google by us: it is recorded with the payment at Stripe. Our server never sends them your name, email address, telephone number or address, in any form, scrambled or not.

You can refuse all of this and the shop works exactly the same. The Google and Meta cookies here are set on this site's own address, so blocking only third-party cookies does not stop them: block cookies for this site, or use a browser or an extension that blocks tracking scripts — without those cookies our server has nothing to send either. You can also turn off personalised advertising in Google's My Ad Center (https://myadcenter.google.com) and in the ad preferences of your Facebook or Instagram settings, or use the industry opt-out at https://optout.aboutads.info

Ours: roa_country and roa_units — which country's price to show and whether sizes are shown in centimetres or feet, both set from the country your connection comes from — and roa_locale, the language you read, set from the page you are reading; each is kept for a year, and none holds your address. roa_resume returns you to your own unfinished checkout and lasts about an hour. roa_meta notes, for seven days, that you arrived from a Facebook or Instagram link. If you sign in, roa-customer-auth keeps you signed in until you sign out — your browser keeps it for up to 400 days — and roa-customer-auth-code-verifier carries a Google sign-in, an email confirmation or a password reset through to its end and is removed when it completes.

In the European Union, the United Kingdom, Switzerland, Norway, Canada and Türkiye we ask before any advertising cookie is set. Your answer is kept in a cookie named roa_consent for 180 days. Until you allow it, no Meta or Google advertising script loads on this site; if you decline, none loads for 180 days. (The payment page loads Google's address lookup for the delivery form, which advertises nothing.) The first-party page measurement described above sets no cookie and runs either way.

Theirs: Google's (_ga, the _ga cookie named after our Analytics property, _gcl_au, and _gcl_aw after a Google advertisement) and Meta's (_fbp, and _fbc after a Facebook or Instagram link), as described above. Their scripts also keep notes in your browser's storage for this site: Google's _gcl_ls, which holds the advertisement click, and Meta's lastExternalReferrer, lastExternalReferrerTime and multiFbc. Where Stripe's own script runs on our pages — the payment form — Stripe sets its own cookies and collects device and browsing signals to prevent fraud, under Stripe's own privacy policy.

Your cart (roa_cart) and the pieces you save (roa_saved) are kept in your own browser, as a list of pieces and nothing else. If you sign in, your saved pieces are kept with your account. Your browser also keeps, on this device only: whether you have already seen the newsletter invitation (roa_bulletin_seen) and, so the invitation waits for a later visit, a random number for your first visit (roa_bulletin_first_session) and one for the current tab (roa_session); and, for the current tab, where you were in the rug list (roa_register), so the Back button returns you there, the random visit number used for page counts (roa_visit), and your Ask Us conversation (roa_ask).

Stripe processes the payment and is where your card details go — they never reach us. If you choose to pay through a service Stripe offers at checkout, such as a pay-later provider or a wallet, that company receives what it needs to process the payment, under its own privacy policy. On our own payment page, Stripe's address form may suggest addresses as you type, using Google's address service.

Your shipping address goes to İstanbul, where your rug is packed, and to the courier who carries it to you.

Cloudflare Turnstile runs the anti-bot check on the checkout forms in the cart and its drawer, on the account sign-in, sign-up and password-reset forms, and on the enquiry forms.

Several companies hold or carry the shop itself rather than using your details for their own purposes: Supabase stores the database, runs sign-in and serves the shop's photographs and videos; Vercel runs the site and measures how fast its pages load, without knowing who you are and never on the payment, order-confirmation, order-tracking or account pages; Resend delivers our email — which means the messages carrying your address to İstanbul, and your receipt to you, pass through it; and Sentry receives our error reports. Before a report leaves, the contents, cookies and headers of the request are removed, and anything shaped like an email address or a telephone number is masked.

Anthropic, if you use Ask Us, as described above; and Google and Meta, as described under Advertising and measurement.

The database is held in the United States. If you would rather that were somewhere else, there is nothing we can offer you but the plain fact of it.

Nobody else. We do not sell or rent your details, and we share them with no company beyond the ones named on this page.

The emails we send about an order carry a link that opens it — including the delivery address — for whoever holds the link. It is kept out of every advertising tag and every page-view record. Please do not forward it.

IP addresses recorded for rate limiting and fraud prevention are deleted after 90 days.

Order records — your name, address and the details of the sale — are kept for at least 180 days after delivery, because that is the window in which a card chargeback can still be raised and we may need to prove the rug arrived.

After that window you can ask us to erase your personal details. We do: your name, email, telephone and address are removed, and your account with them. The amount, currency and date of the sale stay, because they are financial records the business is required to keep.

Copies of the emails we send you are deleted 90 days after they are sent.

Page-view records are kept for 90 days and then deleted.

An account is kept for as long as you use it, and deleted when you ask.

Enquiries and trade applications are deleted when you ask.

If you joined the register by post, your email address is kept for as long as you want to be on it — there is no expiry, because a list that quietly dropped people would be unsubscribing them without being asked. If you unsubscribe, the address is deleted 30 days later; the delay is there so a mistaken click can be undone. If you ask us to erase it, it goes at once and completely.

Write to support@theanatolianrugs.com from the email address you used at checkout or for your account, and say what the request is about. We reply to that address only — an erasure carried out on somebody else's say-so is itself a disclosure, so we will not act on a request that reaches us any other way without confirming it first.

The business responsible for your details is the seller named in our Terms of sale.

Two copies are not reached by this and it is fairer to say so than to promise otherwise. The shipping documents for your order — the customs declaration and the proof of delivery — are kept as legal and financial records; they are stored privately and used for nothing else. Stripe keeps its own record of the payment, including the advertising identifiers it carried, which we cannot delete on your behalf.