Your data, and what we do with it

Section 02

Who controls your data#

Pik'it (Lebanon) is the data controller for everything described here. We are based in Lebanon and we sell internationally, so where the GDPR, the UK GDPR or a comparable law applies to you, we apply it to you.

Section 03

What we collect, and why#

There are exactly three ways data reaches us from this website.

• Joining the list. Your email address, and — only if you choose to tap one — the flavour you would like us to make first, plus the referral code of whoever sent you. Legal basis: your consent, given when you submit the form. It is used to tell you when Pik’it launches and nothing else.
• Writing to us. The name, email address and message you type into the contact form. Legal basis: our legitimate interest in answering people who contact us. Used to reply, and kept so we can remember the conversation.
• Visiting. Aggregated, anonymous page-view and page-speed statistics — which pages get read, how fast they load, roughly which country and device type. No cookie, no cross-site identifier, nothing that names you. Legal basis: our legitimate interest in knowing whether the site works.

When the shop opens, buying something will also involve a name, delivery address and payment. That part is handled by Shopify on Shopify’s own checkout: we receive the order and the address we need to post the box to, and we never see or store your card number.

Section 04

What we never do#

• We do not sell, rent or trade your data. Not to anyone, at any price.
• We do not run advertising or social pixels on this site — no Meta pixel, no TikTok pixel, no Google Ads tag. If that ever changes, this page changes first and you will be asked before any tracker loads.
• We do not profile you, and nothing here makes an automated decision that has any legal or similarly significant effect on you.
• We do not knowingly collect anything from children (see below).

Section 05

Who else handles it#

We use a small number of companies to run the site and the list. Each one only receives what it needs, and each is bound to process it on our instructions.

• Shopify — stores the list itself as a customer record, and runs the shop and checkout when it opens.
• Resend — sends the welcome email you get after joining. It sees your email address and the contents of that message.
• FormSubmit — carries contact-form messages, and a copy of list signups, into our inbox. It sees whatever you typed.
• Vercel — hosts the site and provides the anonymous visit and speed statistics described above. Like any web host it processes IP addresses in order to serve the page to you.
• Google — our mailbox. Messages you send us land there and stay there until deleted.

Some of these companies are outside Lebanon and outside the EEA. Where that transfer needs a legal mechanism, it rests on the European Commission’s Standard Contractual Clauses, which each of these providers offers as part of its data processing terms.

Section 06

How long we keep it#

• List signups — until you unsubscribe or ask us to delete you, and then it goes. We are not building an archive.
• Contact messages — up to 24 months, so we can pick up a conversation where it left off, then deleted.
• Orders, once the shop opens — as long as tax and accounting law requires us to keep the record, which is longer than we would otherwise choose and is not something we can waive.
• Visit statistics — aggregated from the start; there is no individual record to keep or delete.

Section 07

Your rights#

Wherever you are, we will honour all of these. You do not have to explain why, and asking costs you nothing.

• Ask what we hold about you, and get a copy of it.
• Have anything wrong corrected.
• Have it deleted.
• Ask us to stop or restrict a particular use of it.
• Take it elsewhere in a portable format.
• Withdraw consent at any time — every email we send has a one-click unsubscribe, and a reply saying “unsubscribe” works just as well.
• Complain to your data protection authority if we get it wrong. We would much rather you told us first.

One email to hello@pikit.store starts any of these. We answer within 30 days, and normally within a few.

Section 08

Cookies#

This site sets one cookie, it is not a tracking cookie, and there is no consent banner because there is nothing to consent to. The detail is on the Cookie Policy.

Section 09

Security#

The site is served over HTTPS only. Access tokens live in server-side environment variables and never reach your browser. We hold no passwords of yours at all — deliberately, because the safest password is one we never had. No system is perfect; if you believe you have found a weakness in ours, write to hello@pikit.store and we will take it seriously and thank you for it.

Section 10

Children#

Pik’it is not directed at children, and we do not knowingly collect anything from anyone under 16. If you are a parent or guardian and believe your child has given us their details, email us and we will delete the record.

Section 11

Changes to this policy#

When we change it we update the date at the top of this page. If a change materially affects how we use data you have already given us, we will tell the list by email rather than quietly editing the page.