Privacy Policy

Last updated: 20 February 2026

1. Who We Are

Jade & Sakura is a brand operated by Jade and Sakura Online Seller, a sole proprietorship registered at 1204 Belselah Residence, Barsha 1, Dubai, UAE. When you visit our website or place an order with us, we are the data controller responsible for your personal information.

If you have any questions about this policy or how we handle your data, you can contact us at info@jadeandsakura.com.

2. Scope of This Policy

This policy applies to personal data we collect through our website and in connection with orders placed online. It does not apply to any offline activities. We only ship within the United Arab Emirates.

3. Legal Framework

We are committed to protecting your personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL). By using our website or purchasing from us, you acknowledge the practices described in this policy.

4. Information We Collect

Information you provide to us: When you create an account, place an order, or contact us, we may collect your name, email address, phone number, delivery address, and order details. We do not store your payment card information — this is handled securely by our payment processor, Ziina.

Information collected automatically: When you browse our website, we automatically collect certain technical information including your IP address, browser type, device type, the pages you visit, and how you interact with the site. This is collected through PostHog, our analytics platform, and includes page view tracking and heatmap data showing how visitors interact with our pages.

5. Cookies and Browser Storage

We use the following cookies on our website:

Strictly necessary cookies — These are required for the website to function and cannot be switched off. They include a session cookie placed by Better Auth to keep you logged in to your account, and a cart cookie placed by our store platform to remember the items in your shopping cart. No personal data is shared with third parties through these cookies.

Analytics cookies — These are placed by PostHog to help us understand how visitors use our website, including which pages are visited and how users interact with page elements. These cookies are only set with your consent. You can withdraw your consent at any time by contacting us or using the cookie preference option on our site.

6. How We Use Your Information

We use your personal data to:

• Process and fulfil your orders, and send you order confirmations and delivery updates
• Manage your account and authenticate your sessions securely
• Coordinate delivery of your order through our logistics partner, Quiqup
• Respond to your customer service enquiries
• Send you marketing communications, including promotions and new product updates, via Customer.io — but only where you have given us your explicit consent, and you can unsubscribe at any time via the link in any email we send you
• Analyse website usage and how visitors interact with our pages using PostHog analytics
• Prevent fraud and maintain the security of our platform
• Comply with our legal obligations under UAE law, including VAT record-keeping requirements

7. Sharing Your Information

We do not sell or rent your personal data. We share your information only with the following third parties, and only to the extent necessary to operate our business:

Ziina — our payment processor, who handles card transactions securely on our behalf. Ziina has its own privacy policy and is responsible for data collected during payment.

Quiqup — our delivery partner, who receives your name, phone number, and delivery address in order to fulfil your order.

PostHog (EU Cloud) — our analytics provider, who processes website usage data on our behalf. PostHog's servers are located in the European Union. Data transfers are governed by PostHog's data processing agreement and comply with applicable data protection standards.

We may also disclose your personal data to UAE government authorities or law enforcement agencies if required to do so by law.

8. International Data Transfers

Our website platform (Medusa) is self-hosted within our own infrastructure, and your core account and order data does not leave our systems. The following international transfers do occur:

PostHog processes analytics and heatmap data on servers located in the European Union. We have a Data Processing Agreement in place with PostHog, and they do not use third-party cookies.

Customer.io is based in the United States. Where you have consented to marketing communications, your name and email address are transferred to Customer.io's servers in the US. This transfer is governed by our Data Processing Agreement with Customer.io, which incorporates Standard Contractual Clauses as a lawful transfer mechanism.

No other international transfers of your personal data take place.

9. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy. Specifically:

• Order records and associated personal data are retained for a minimum of five years to comply with UAE VAT and commercial record-keeping obligations.
• Account data is retained until you request deletion of your account.
• Analytics data collected through PostHog is retained in accordance with PostHog's default retention settings, which you can review at posthog.com.
• Marketing consent records are retained for as long as you remain subscribed, plus a reasonable period thereafter for compliance purposes.

10. Your Rights

Under the UAE Personal Data Protection Law, you have the right to:

• Access the personal data we hold about you
• Request correction of any inaccurate or incomplete data
• Request deletion of your personal data, subject to our legal retention obligations
• Withdraw consent for marketing communications at any time
• Withdraw consent for analytics cookies at any time

To exercise any of these rights, please contact us at info@jadeandsakura.com. We will respond to your request within 30 days.

11. Data Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. These include the use of HTTPS encryption on all pages, secure cookie settings (HttpOnly, Secure, and SameSite flags), and restricted access to personal data within our systems.

No method of transmission over the internet is completely secure, but we are committed to protecting your data to the best of our ability.

12. Children's Privacy

Our website is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact us at info@jadeandsakura.com and we will delete it promptly.

13. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you by email where we hold your contact details. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or your personal data, please contact us:

Jade and Sakura Online Seller 1204 Belselah Residence, Barsha 1, Dubai, UAE info@jadeandsakura.com