Privacy Policy

Who this applies to

This policy covers Nayyab Collections — this website, orders placed through it or over WhatsApp, and the AI design studio. We are an independently owned business based in Bahawalpur, Pakistan. If anything here is unclear, ask us; we would rather explain it than have you guess.

What we collect

Only what a particular step actually needs. Browsing the site needs nothing from you at all.

• When you create an account — your name, email address, and phone number if you choose to give one.
• When you place an order — your name, email, WhatsApp number, delivery address, and any notes or measurements you send us, along with the items and prices.
• When you tap “Inquire on WhatsApp” — which piece and where you tapped it from, recorded at that moment so we can follow the enquiry up. This is saved even if you then decide not to send the message.
• When you use the design studio — the descriptions and options you choose, any reference image you upload, and the images generated for you.
• When you buy design credits — the pack, amount and reference of the purchase, and whether it was paid.
• Basic technical information every website receives, such as your browser type and the pages you request.
• How the site is used, measured by Google Analytics — which pages were viewed, roughly where in the world the visit came from, whether the device was a phone or a desktop, what was searched for on our own search page, and which link brought you here. This is counted in aggregate and is not tied to your name or your account.

What we deliberately do not collect

Some of this is worth stating plainly, because many sites do the opposite.

• Your card number, expiry or security code. These are entered on our payment provider's own page and never reach this website.
• Your password in readable form. It is stored only as a one-way hash with a unique salt, so it cannot be read back — not even by us.
• Your IP address in readable form. Where we need it to prevent abuse of the design studio, it is converted into a one-way fingerprint first.
• Anything for advertising. There is no advertising cookie, no ad-retargeting pixel, and no profile of you sold or handed to advertisers. We do measure how the site is used — see “Cookies and what your browser stores” below.

Why we use it

Each piece of information has a job to do:

• To make and deliver your order, and to confirm the design, price, measurements and timeline with you first.
• To keep your order history in one place when you have an account.
• To answer your questions on WhatsApp or by email.
• To generate the images you ask for in the design studio, and to keep them with your enquiry so our team can see what was agreed.
• To take payment, confirm it, and send you a receipt.
• To stop the design studio being abused — every generated image costs us money.
• To see which collections and pages people actually use, so we spend our effort on the ones that matter and fix the ones that do not work.

Cookies and what your browser stores

We use a small number of first-party cookies. Most are functional — they keep you signed in and your cart intact. Two are for measurement, set by Google Analytics, and those you can refuse.

If you are in the UK, the European Economic Area or Switzerland, we ask before those two are set: nothing is requested from Google and no analytics cookie exists until you choose. Decline is a single click, exactly like accept, and declining changes nothing else about the site. You can change your mind at any time using “Cookie choice” at the bottom of any page — and if you withdraw consent, we delete the analytics cookies already on your device.

There are no advertising or cross-site retargeting cookies. None of these are used to follow you around other websites or to build an advertising profile.

• nayyab_session — keeps you signed in. It is signed, so it cannot be edited or forged.
• nayyab_ai_guest — an anonymous id so the design studio can apply fair-use limits before you sign in.
• nayyab_ai_gate — remembers that you have entered the studio access code.
• nayyab_admin — used only by our own staff to sign in to the admin dashboard.
• nayyab_consent — remembers whether you accepted or declined the measurement cookies, so we do not ask again on every page. It holds one word and nothing else. Because its only job is to record a privacy choice, it is set either way and cannot be refused; it lasts six months, after which we ask again rather than assume your answer still stands.
• _ga and _ga_38KNN62N0J — set by Google Analytics. They hold a randomly generated id so we can tell a returning visit from a new one, and count how many people used a page. They do not contain your name, email or anything you typed. The first lasts up to two years; the second tracks the current visit.
• Your browser also keeps things on your own device, which never become cookies: your shopping cart, your chosen display currency, a random id that lets us recognise repeat enquiries about the same piece, the WhatsApp number you last used so you do not retype it, and — until you close the tab — the details of the order you just placed, so the confirmation page can show them.

Who we share it with

We do not sell or rent your information, and we do not share it for advertising. We use a small number of providers to run the business, and share only what each one needs:

• Safepay — our card payment provider, licensed by the State Bank of Pakistan. They handle your card details; we receive only confirmation that a payment succeeded and the reference it belongs to.
• Cloudinary — where our records and images are stored. Anything sensitive is encrypted by us before it is sent there.
• KIE.ai — the service that actually generates the design images. Your description of the outfit is sent to them, and any reference photograph you upload is sent to their file store so the image can be made from it.
• wsrv.nl — an image service that resizes our photographs so pages load quickly. Your browser fetches those images from them directly, so they see your IP address and which page you were on. They are never given your name, email or anything you type.
• Google Analytics — receives the usage measurements described above so we can see how the site is performing. We use it for measurement only, not for advertising or ad personalisation, and we do not send Google your name, email, address or order details.
• Our email provider — used to send order confirmations and receipts from our own mailbox.
• Vercel — who host this website.
• Courier and delivery companies — given the name, address and phone number needed to deliver your parcel, and customs paperwork where a shipment crosses a border.
• If you message us on WhatsApp, that conversation is also subject to WhatsApp's own privacy terms.

Where your information goes

We are based in Pakistan, and the providers above operate internationally, so your information may be stored or processed outside your own country. We use only providers we consider reasonable for the job, and share the minimum each one needs.

How we protect it

Concretely, rather than vaguely:

• Records containing personal details are encrypted with AES-256-GCM before they leave our server, so the stored file is unreadable without our key.
• Passwords are hashed with scrypt and a unique salt per account, and are never stored or logged in readable form.
• Sign-in sessions are cryptographically signed, so a session cookie cannot be altered to impersonate someone else.
• The admin dashboard is separately protected and cannot be reached with a customer account.
• No security is absolute. If something ever went wrong that affected you, we would tell you rather than stay quiet.

How long we keep it

Order and account records are kept while your account is open, and for as long as we need them for our business records — a made-to-order piece can be asked about long after it was delivered.

Enquiry records are capped, so the oldest are dropped automatically as new ones arrive.

Design studio images and briefs are kept with the enquiry they belong to, so our team can refer back to what was agreed.

If you ask us to delete your information we will, except where we are required to keep a record of a completed sale.

Your choices

You can ask us to show you what we hold about you, correct anything wrong, or delete it. There is no self-service button for this yet — message or email us and a person will deal with it. We will not make it difficult, and we will not ask why.

You can also opt out of the usage measurement described above. The simplest way is “Cookie choice” at the bottom of any page, which lets you decline — or withdraw an earlier acceptance, in which case the analytics cookies already on your device are deleted. Blocking cookies for this site in your browser, private/incognito browsing, or Google's own Analytics Opt-out Browser Add-on all work too. Nothing else on the site depends on those two cookies, so refusing them will not break your cart, your sign-in or your order.

• Email: orders@nayyab.shop
• WhatsApp: +92 305 2134171

Children

This site is intended for adults. We make children's clothing, but the account, the order and the payment are expected to be handled by an adult. We do not knowingly collect information directly from a child.

Changes to this policy

If we begin collecting something new, or add a service provider, we will update this page and change the effective date at the top. Where a change materially affects how your information is used, we will say so rather than quietly editing the text.