Privacy Policy

1. Who We Are

Velvet Paws Pet Supplies is the data controller responsible for your personal data.

If you have questions, complaints, or want to exercise any of the rights described in this Policy, please contact us using the details above.

2. The Personal Data We Collect

We collect the following categories of personal data:

Information you give us directly

• Identity and contact data: name, phone number, email address, and postal address
• Order and account data: items purchased, cart and order history, billing and delivery details, customer account identifiers, and authentication records
• Payment data: payment method, confirmation, status, and redacted provider references; we do not store full payment-card numbers or security codes (see Section 7)
• Subscription data: selected products, quantities, cadence, base item prices, billing mode, renewal schedule, address snapshots, cycles, and related orders
• Pet information: your pet's name, breed, age, or dietary preferences if you choose to share them with us
• Communication data: the content of emails, WhatsApp messages, or other messages you send us
• Marketing data: the phone number, country, optional email address, consent time, signup source, and channel details you provide when joining a marketing list

Technical information

• IP address and request information used for security, abuse prevention, and rate limiting
• Browser, device, operating-system, request-timing, and diagnostic information made available to our application or hosting infrastructure
• Essential cookie and browser-storage identifiers described in Section 8
• Optional analytics data, only if you choose analytics cookies: a pseudonymous analytics identifier; the public page path with query strings and fragments removed; referrer hostname; campaign source, medium, and campaign name; and page-view and page-leave timing information. This may include an approximate country and city inferred from your IP address. We do not request GPS or device-location access, and use IP-derived location reporting only at country/city level. PostHog is configured not to retain raw client IP data.
• Optional analytics does not receive account data, cart contents, order details, address, payment, or form-field data.

Information from service providers

• Medusa and our payment providers may provide confirmation, status, and redacted details about a transaction or recurring payment agreement
• Fulfillment and delivery providers may provide order, shipment, delivery, and tracking updates

3. How We Use Your Personal Data

We use your personal data for these purposes:

4. Marketing Communications

When you join our newsletter or another marketing list, you give us your express consent to send promotional messages through the channel offered at signup.

You can withdraw your consent at any time:

• Follow the unsubscribe or opt-out instructions included in a message, where available
• Use our unsubscribe page to remove your marketing subscription
• Email hello@velvetpaws.com with your withdrawal request

Withdrawal applies going forward and does not affect the lawfulness of processing completed before withdrawal. You will continue to receive transactional messages needed to manage your account, orders, payments, and subscriptions.

5. Who We Share Your Data With

We share personal data only to the extent necessary with the following categories of recipients:

Service providers acting on our instructions

• Medusa and Medusa Cloud: the commerce software, application hosting, and data infrastructure used to operate this Site and manage customer, cart, order, and subscription records
• PostHog EU Cloud: an analytics processor that, only where you choose analytics cookies, processes the limited optional analytics data described in Sections 2 and 8 using its EU data region
• SkipCash and Tap: hosted payment processors used to create, verify, reconcile, and, where applicable, refund card payments; cash-on-delivery orders do not involve a card payment processor
• Quivo and delivery partners: fulfillment and delivery providers that receive the order, item, contact, delivery-address, shipping, tracking, and any applicable cash-on-delivery information needed to fulfill an order
• Email delivery providers, where configured:services such as Resend that receive the recipient address and rendered message needed to send transactional email, including sign-in codes and order updates

Each processor is required to handle personal data only for the agreed service and to use appropriate security measures.

Other recipients

We may disclose information to government, regulatory, or law-enforcement authorities where required by law or in response to a lawful request.

We do not sell your personal data to third parties.

6. International Transfers

Some of our hosting, payment, fulfillment, communications, and technology service providers may process personal data outside Qatar. When we transfer personal data to them, we use appropriate contractual and organisational safeguards intended to protect it to the standard required under applicable law.

If you choose optional analytics cookies, we use PostHog EU Cloud for the limited analytics data described in this Policy. Its use is configured for PostHog's EU data region and remains subject to the safeguards described above.

By using this Site, you acknowledge that your personal data may be transferred to and processed in countries outside Qatar.

7. Payment Data

Card details are entered on secure hosted pages operated by SkipCash or Tap. We do not store full payment-card numbers, security codes, first-six card digits, or raw reusable payment tokens on our systems. Tap checkout is configured not to save a card.

We retain the provider name; Medusa cart, payment-session, and order identifiers; opaque provider payment identifiers; amount and currency; normalized payment status and error codes; approved hosted-payment URLs; reconciliation timestamps; and, where the provider supplies them, card type, brand, and last four digits. We do not retain card expiry dates. An authenticated account may display the payment mode and redacted brand or last four digits. Raw provider identifiers are not included in customer pages, transactional emails, public APIs, or application logs.

Cash-on-delivery orders do not collect card data. We retain the selected payment method, order and payment status, and the cash amount and currency needed for delivery and reconciliation.

For subscriptions, we retain the selected product and quantity, locked recurring total and subscription-basket shipping, cadence, original billing and delivery address snapshots, schedule, cycle identities, related orders, and a redacted activity history. Native orders and payments retain each cycle's payment state. SkipCash and Tap are used only for the initial checkout; cash on delivery is collected with each renewal order.

8. Cookies and Browser Storage

This Site uses essential cookies and browser storage needed to provide its current functionality. We use a first-party preference cookie to remember your analytics choice. PostHog analytics cookies and related browser storage are used only if you accept:

• A country or region preference cookie, normally kept for up to one year, selects the supported storefront region
• Local browser storage retains the current cart identifier and selected payment provider so checkout can continue
• If you sign in, local browser storage retains the customer authentication token needed to keep you signed in
• If the optional launch gate is enabled, an HTTP-only session cookie, normally kept for up to 30 days, remembers that the gate was unlocked
• An analytics-preference cookie, normally kept for up to 180 days, remembers whether you accepted or refused optional analytics
• If you accept, PostHog analytics cookies and related browser storage help us understand how visitors reach and use public Site pages. They are limited to the optional analytics data described in Section 2

Optional analytics cookies are not advertising cookies or marketing pixels. We do not activate optional analytics collection unless you choose it. You can accept or refuse using the cookie notice. To withdraw consent or reset your choice, clear cookies and local storage through your browser settings. Doing so may reset your region, empty or disconnect your cart, sign you out, or require you to unlock the launch gate again.

9. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes set out in this Policy, or as required by law:

• Order and transaction records: retained for seven years after the order date to comply with Qatari accounting and tax obligations
• Marketing subscribers: retained while you remain subscribed, plus a short period after withdrawal for suppression-list purposes
• Customer account and subscription data:retained while your account or subscription is active and for a reasonable period afterwards, subject to legal retention duties
• Customer support correspondence: retained for three years for service quality and dispute handling
• Optional analytics data: retained in our PostHog EU project for up to one year. Withdrawing consent stops future collection. The analytics-preference cookie normally expires after 180 days unless you clear it sooner.
• Security and operational records: retained only as long as reasonably necessary to prevent abuse, reconcile transactions, and investigate incidents

After the relevant retention period, we securely delete or anonymise personal data unless a legal obligation requires us to keep it longer.

10. Your Rights

Under the Qatar Data Protection Law, you have the following rights in relation to your personal data:

• Right of access: to know what personal data we hold about you
• Right to correction: to have inaccurate data corrected
• Right to deletion: to ask us to delete your personal data, subject to our retention obligations
• Right to withdraw consent: for processing we carry out based on your consent, including marketing and optional analytics cookies
• Right to object: to processing based on our legitimate interest
• Right to data portability: to receive your data in a structured, commonly used format
• Right to lodge a complaint: with the relevant Qatari supervisory authority

To exercise a right, email hello@velvetpaws.com with your request and enough information for us to verify your identity. We will respond within 30 days.

11. How We Protect Your Data

We use appropriate technical and organisational measures to protect personal data, including:

• HTTPS / TLS encryption for data transmitted by this Site
• Hosted card entry so full card details do not pass through or remain on our application
• Restricted, server-side access to payment-provider credentials and personal data
• Passwordless sign-in codes stored only as hashes, with expiry and attempt limits
• Redacted payment and subscription audit records that exclude full card data, credentials, and raw provider payloads
• Regular security reviews of our systems and integrations

No system is completely secure. If we become aware of a breach that materially affects your personal data, we will notify you and the relevant authorities as required by the Qatar Data Protection Law.

12. Children's Privacy

This Site is not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child without parental consent, email hello@velvetpaws.com and we will delete it.

13. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date at the top will reflect any changes. For material changes, we will notify you by email or a prominent notice on this Site. Continued use of this Site after changes are posted constitutes acceptance of the updated Policy.

14. Contact

For any privacy-related questions, requests, or concerns:

You also have the right to lodge a complaint with the Qatari supervisory authority for data protection if you believe your rights have been infringed.