Privacy Policy.

This Privacy Policy explains what information eshtery.com (the “Service”) collects, why we collect it, how we use it, who we share it with, how long we keep it, and the rights you have. California residents have additional rights under the CCPA/CPRA, summarized in Section 9 below.

1. Who we are

eshtery.com is operated by Mahmoud Awad, an individual based in California, United States (“eshtery,” “we,” “us,” or “our”). For privacy questions or to submit a rights request, contact m@eshtery.com.

2. What we collect

We collect only the information necessary to operate the Service. The categories below mirror the CCPA categories of personal information.

• Identifiers. Name, email address, country of residence, and (if you sign in via Google or Facebook) the profile fields those providers share with us. For brand applications: the applicant's name, brand name, website, email, and country.
• Internet or other electronic network activity. IP address (stored only as a SHA-256 hash, never as raw IP), browser type and user-agent string, referring page, click events on outbound brand links, and the URL you arrived from.
• Geolocation (general). Country-level location derived from your IP address at request time. We do not collect precise geolocation.
• Commercial information. Saved briefs (the prose description of what you're looking for, optional budget range, ships-to country, optional event date), wishlist entries, digest opt-in status, and product preferences.
• Inferences. We compute semantic embeddings of your saved briefs (mathematical vector representations) to match them against new products. Embeddings are not human-readable and cannot be used to reconstruct your brief text.

If you buy through eshtery

Buying adds information we do not otherwise hold. We collect it because an order cannot be delivered without it.

• Identifiers and contact details. The name, email address, phone number and full postal shipping address you enter at checkout. The phone number is used to arrange delivery, including by WhatsApp where the designer contacts you that way.
• Commercial information. What you put in your bag, what you ordered, what it cost, the currency you chose, discount codes you used, and the history of that order — shipped, delivered, returned, refunded. If you enter your email at checkout and do not complete the purchase, we keep that record too, and the designer may send you one reminder if she has enabled them.
• Payment. Payments are processed by Stripe. Card numbers never reach eshtery's servers and we never store them. We keep a payment reference so an order can be matched to a payment, and the amount.

If you sell through eshtery

• Business and contact details. Your brand name, country, currency, the address you ship from, your notification email, and who is a member of your brand's account.
• Payout details, which are Sensitive Personal Information. The account information needed to pay you. It is encrypted at rest, is visible only to you and to the eshtery staff running a payout, and is used for that purpose alone.
• Instagram, if you connect it. With your permission, we read your Instagram Business account's username, account type, post count, and the posts themselves — captions, images and links — so they can be turned into product drafts. The access token is encrypted. We never post, message, or read anything private, and you can disconnect at any time, which revokes our access.
• Content you give to our AI features. Where you ask for an AI-written title or description, the post caption and images are sent to our AI provider to produce a draft you then approve or reject. Nothing is published without your approval.

Beyond designers' payout details described above, we do not knowingly collect Sensitive Personal Information under CCPA § 1798.140(ae): no Social Security numbers, no driver's license or passport numbers, no precise geolocation, no race, religion, philosophical belief, union membership, genetic, biometric, or health data, and no contents of mail, email, or text messages.

3. Where we get it

• Directly from you. When you create an account, apply on behalf of a brand, save a brief, subscribe to the Dispatch, or use the Ask feature.
• Automatically from your device. Standard HTTP request headers (IP, user-agent, referer), cookies set by the Service (see Section 6), and click events on outbound brand links.
• From third-party identity providers. If you sign in with Google or Facebook, we receive the basic profile fields you authorize (typically name, email, profile image URL).

4. Why we use it

Each category of personal information is used for one or more of the following business or commercial purposes:

• Operate and authenticate the Service. Account creation, sign-in, session management, security (rate limiting, abuse prevention).
• Editorial personalization. Generating the weekly Dispatch, matching saved briefs against new products in our catalog, surfacing items relevant to your stated preferences.
• Communications. Transactional notifications (welcome email, brief-match alerts, brand-application confirmation), the weekly Dispatch (only if you opt in), and responses to your support questions.
• Click attribution and analytics. Logging outbound clicks on brand links so we can report aggregate traffic-volume statistics to brand partners and operate any future affiliate-revenue program in accordance with our disclosures.
• Improving the Service. Diagnosing bugs, measuring feature adoption, and refining editorial signals.
• Legal compliance and protection. Responding to lawful requests, enforcing the Terms, protecting against fraud or abuse.

5. Who we share it with

We do not sell personal information for money, and we never have.

We do share personal information for cross-context behavioral advertising in one specific circumstance: where a designer has enabled an advertising pixel on her own eshtery storefront. When she has, visiting that storefront tells Meta, TikTok or Google Analytics that you were there. eshtery does not run advertising of its own, and no pixel loads on a storefront whose designer has not set one up.

You can turn this off for your browser at any time on Your Privacy Choices. We also honor the Global Privacy Control signal as an opt-out request on its own, with no action needed from you, and that signal overrides anything set on that page.

Apart from that, we share the minimum necessary information with the following categories of recipient:

• Service providers operating under contract. Vercel (hosting and edge logging), Supabase (database, server functions), Clerk (authentication and identity), Resend (email delivery), Anthropic (AI inference for the Ask feature), Voyage AI (semantic embeddings), Cloudflare (DNS and DDoS protection for some endpoints), Bing and Google (search indexing and webmaster verification only — no personal data).
• Brand partners. Aggregated, de-identified click-volume statistics (e.g., “your brand received N clicks last month, M of them from signed-in shoppers”). We do not share your name, email, or any individually identifying information with brands without your explicit consent. When you click an outbound link, your browser will transmit standard HTTP information (IP, user-agent, the URL with UTM parameters) directly to the brand's server — this is your browser's behavior, not data we share on your behalf.
• Legal authorities. When required to comply with applicable law, subpoena, court order, or to protect against fraud, security threats, or violations of the Terms.
• Successor in interest. If eshtery is acquired, merged with another business, or transfers substantially all of its assets, personal information may transfer to the successor under the same protections as this Policy. We will notify account holders by email before any such transfer takes effect.

6. Cookies and similar technologies

We use a small number of cookies, all first-party, all functional (no advertising cookies, no third-party tracking pixels, no remarketing tags):

• eshtery_cid — a 30-day HTTP-only cookie that holds a random UUID used to attribute outbound clicks to a consistent visitor session. Cannot be read by JavaScript.
• __clerk_db_jwt and __session — set by our authentication provider (Clerk) when you sign in. Used to maintain your signed-in state across pages. See Clerk's privacy notice at clerk.com/privacy.

You can clear cookies at any time via your browser settings; doing so will sign you out and reset your click-attribution session.

7. How long we keep it

• Account data. For as long as your account is active. You may request deletion at any time (Section 9).
• Click logs. Twelve months in identifiable form (hashed IP, user-agent, cookie ID), then aggregated.
• Brand applications. For as long as is necessary to evaluate the application, plus a reasonable record-keeping period not exceeding 24 months after the final disposition.
• Email delivery records. Stored by our email provider (Resend) per their retention policy.

8. Security

We protect personal information with industry-standard safeguards: TLS encryption in transit, encryption at rest in our database, SHA-256 hashing of IP addresses before storage, Postgres Row-Level Security (RLS) policies on user-scoped data, and service-role separation. No system is perfectly secure; we cannot guarantee absolute protection.

9. Your California privacy rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights. We honor these rights for all users regardless of residency.

• Right to know. You may request a list of the categories and specific pieces of personal information we have collected about you in the prior 12 months, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties with whom we have shared it.
• Right to delete. You may request that we delete personal information we have collected from you, subject to limited exceptions (e.g., information needed to complete a transaction, detect fraud, or comply with legal obligations).
• Right to correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. eshtery does not sell personal information for money. We do share it for cross-context behavioral advertising where a designer has enabled an advertising pixel on her storefront (Section 5). Exercise this right at Your Privacy Choices, or simply browse with Global Privacy Control enabled — we honor that signal automatically as an opt-out request.
• Right to limit use of sensitive personal information. For shoppers, we do not collect sensitive personal information as defined by CCPA § 1798.140(ae). For designers selling through eshtery, we collect payout account details, which that section treats as sensitive. We use them for one purpose only — paying you — and never for inferring characteristics about you, so no limitation request is necessary. They are encrypted at rest and shown only to the account owner and to the eshtery staff running a payout.
• Right to non-discrimination. We will not deny you service, charge you a different price, or provide a different level of service because you exercised any of these rights.

How to submit a request. Use the request form, which needs no account. We email you a link to confirm the request is really yours — otherwise anyone could type your address and have your information sent to them or deleted. That link works once and expires after 72 hours.

If you cannot use the form, including if you no longer have access to the address you used with us, email privacy@eshtery.com and we will find another way to verify who you are.

We respond within 45 days (extendable by 45 additional days if reasonably necessary, with notice to you). There is no charge, and asking will never change the service you receive.

Authorized agents. You may designate an authorized agent to make a request on your behalf. The agent must provide signed permission demonstrating authority, and we may require you to verify your identity directly.

Shine the Light (California Civil Code § 1798.83). eshtery does not disclose personal information to third parties for those parties’ own direct-marketing purposes, with one exception: where a designer has enabled an advertising pixel, the advertising platform may use what it receives for its own purposes under its own terms. As permitted by § 1798.83(c)(2), we comply by offering you a way to opt out of that disclosure at no cost, at Your Privacy Choices, rather than by maintaining a disclosure list.

10. Children's privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have collected information from a child under 16, email m@eshtery.com and we will delete it.

11. International users

eshtery is operated from California, United States. Our service providers are primarily located in the United States and the European Union. By using the Service from outside the U.S., you consent to the transfer of your information to the U.S. and other countries where we and our service providers operate. These countries may have data-protection laws different from those of your jurisdiction.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect the most recent change. For material changes, we will notify signed-in account holders by email and post a prominent notice on the Service before the change takes effect.

13. Contact

For privacy questions, rights requests, or complaints, contact:

m@eshtery.com

Mahmoud Awad · California, United States

This document is provided for informational purposes only and is not legal advice. eshtery's operator is not a lawyer. If you need legal advice tailored to your situation, consult a qualified California attorney.