Privacy policy
Last updated: 8 October 2026
This policy explains what information 7ala Cosmetics collects through this website, why we collect it, who else sees it and what you can ask us to do with it. It covers this website and the orders and messages that reach us from it.
Who we are
7ala Cosmetics is a beauty brand selling makeup, skincare and fragrance, and taking orders through this website and WhatsApp. We decide how the information described here is used, which makes us the controller of it. You can reach us any time at +961 71 577 137 on WhatsApp; our postal address is available on request through the same chat.
What we collect
- What you give us. When you send an order: your name, your phone number, the delivery address, the products you chose, any coupon code you used and any note you add. When you message us: your phone number, your WhatsApp profile name and whatever you write.
- Your email, only if you add it. The order form has an optional email box. If you fill it in, we email you your order confirmation and keep the address with your order and customer record. We only send you news about new products, restocks and offers if you tick the box for it at checkout or create an account; for that we also keep when you joined, the wording you agreed to and a private unsubscribe code. Leaving the email box empty changes nothing about your order.
- Your account, if you create one. Your name, your email, your password (kept only in a scrambled form that cannot be turned back into the password), when you signed in last, and which orders you placed while signed in, so your first-order gift is used once. Creating an account also puts your email on our list for emails about your orders and new products; the sign-up form says so, and you can unsubscribe from any email.
- What is collected automatically. Like every website, the servers that host this one and our order system process technical information — your IP address, browser type, the pages requested and the time — so the pages can be delivered and protected from abuse. To stop one connection from flooding us with orders or guessing coupon codes, the order system counts recent orders and coupon checks against a scrambled (hashed) form of the IP address.
- Our best seller. When you add a product to your cart, the shop adds one to that product's count, so the most added product can be shown at the top. The count is only a number per product; nothing about you is kept with it. So that one connection counts once a day per product, repeat counts are checked against a hashed form of the IP address for a day.
- Views and likes. When you open a product or put it in your wishlist, the shop adds one to that product's views or likes for the day, so we can see which products people like. Like the best-seller count, it is only a number per product and day; nothing about you is kept with it, and the check that one connection counts once a day uses a hashed form of the IP address for a day.
- Our own team's sign-in. To stop password guessing on the staff area, failed sign-in attempts are counted against a hashed form of the IP address. The count lasts 15 minutes.
- What we do not collect. No analytics or advertising tools, no tracking across sites, no profiling, and no automated decisions are made about you.
Why we use it, and on what grounds
- To take, prepare and deliver your order — because it is necessary to carry out the order you asked for.
- To answer your questions — because we have a legitimate interest in replying to the people who write to us.
- To keep the shop running and secure — because we have a legitimate interest in protecting the site from abuse.
- To keep the records the law asks of us — where a legal or tax obligation applies to a sale.
- To email you your order confirmation — if you added your email, because it is part of carrying out your order.
- To run your account and give you your first-order gift — because you asked for an account.
- To email you about new products and offers — only if you ticked the box at checkout or created an account (the sign-up form says so), because you asked us to (your consent).
On WhatsApp we only message you about your own order. By email we send your order confirmation, and we only write about new products and offers if you asked for them. Every one of those emails has an unsubscribe link that takes you off the list straight away, and you can also just tell us to stop. Unsubscribing never affects your orders.
Who else sees it
Only the services we need to run the shop: the provider that hosts this website, the provider that runs our order system, the service that delivers our emails, WhatsApp for our conversations, and, when an order has to be sent to you, the courier or delivery service that needs your address. We do not sell your information, and we do not share it for anyone else's advertising.
WhatsApp is operated by WhatsApp Ireland Ltd / Meta, our order system runs on servers operated by Higgsfield on Cloudflare's network, and our emails are sent through Resend, Inc. in the United States. That means some of your information is handled on servers outside your country, under those companies' own safeguards and privacy terms.
How long we keep it
- Orders in our shop inbox: until the order is complete and no longer needed for our records, then deleted.
- Your email: with your orders and customer record for as long as we keep those. On the news list until you unsubscribe or ask us to remove it; after you unsubscribe we keep only a note that you did, so we never send you news again by mistake.
- Your account: until you ask us to delete it. Sign-in sessions end after 30 days or when you sign out, and password-reset links after one hour.
- WhatsApp conversations: kept as long as we need them to serve you, then deleted from our phone.
- Order and sign-in counters: an hour at most. The checks that one connection counts once (best seller, views, likes): a day.
- Technical server logs: kept by our hosting providers for a short period for security.
How we protect it
Your order travels to us over an encrypted connection (HTTPS). Account and staff passwords are checked by our server and never stored as text — only as a salted, slow hash — with a limit on sign-in attempts; staff sessions expire after twelve hours. Only our own team can open the orders, and only the people who need to handle your order ever see it.
Your rights
You can ask us to give you a copy of what we hold about you, to correct it, to delete it, to limit how we use it, or to object to a particular use. You can also ask for your details in a portable form, and withdraw any consent you gave. Message us at +961 71 577 137 on WhatsApp and we will answer within 30 days. If you believe we have mishandled your information, you can also complain to the data protection authority in your country.
Children
Our shop is not aimed at children under 16 and we do not knowingly collect information from them. If you believe a child has sent us their details, message us and we will delete them.
Cookies and other websites
See our cookie policy for what is stored in your browser. Links from this site (for example to WhatsApp) lead to services with their own privacy policies, which we do not control.
Changes to this policy
If we change how we handle your information, we will update this page and the date at the top. Significant changes will be described here rather than made quietly.