Privacy Policy

We collect only the data we need to run the store, fulfil your orders, and improve your experience:

• Account & identity — name, email address, and mobile number (in +966 format) when you create an account or place an order.
• Order & delivery — the items you buy, the shipping and billing address, and the recipient details needed to deliver your parcel.
• Payment — payment is processed by our payment provider (Tap Payments). We receive a confirmation and limited transaction details; we do not store your full card number on our servers.
• Communications — messages you send us by email, WhatsApp, or our contact form, and our replies.
• Technical & usage — IP address, browser and device type, language preference, and pages viewed, collected through cookies and similar technologies (see the Cookies section).

We do not intentionally collect sensitive personal data, and we ask that you do not send it to us.

We use personal data for clearly defined purposes:

• to process, fulfil, and deliver your orders, and to handle returns and refunds;
• to create and manage your account and authenticate you securely;
• to send transactional messages — order confirmations, shipping and delivery updates, and password resets;
• to provide customer support and respond to your enquiries;
• to operate, secure, and improve the website, and to prevent fraud and abuse;
• to meet our legal, tax, and regulatory obligations in the Kingdom of Saudi Arabia.

We send marketing messages only where permitted, and you can opt out at any time using the unsubscribe link or by contacting us.

Under the PDPL we rely on one or more of the following legal bases to process your personal data:

• Performance of a contract — to take and fulfil your order and provide the services you request.
• Legitimate interests — to secure the website, prevent fraud, and improve our services, balanced against your rights.
• Legal obligation — to comply with tax, accounting, and consumer-protection requirements.
• Consent — for optional activities such as marketing messages, which you may withdraw at any time.

Essential cookies support security, sessions, your cart, language and privacy preferences. Analytics, session replay and advertising settings are enabled by default without a first-visit confirmation banner. Only services configured for this store run, and sensitive-page restrictions still apply.

You can disable analytics and session replay separately from advertising using the Privacy settings link at the end of this policy or in the footer. Shopping remains available when optional tracking is off. We preserve existing saved opt-outs.

The essential strx_consent cookie stores your choices for 180 days. Clearing it, expiry or using another browser restores defaults on a new visit. Browser controls can also block cookies; blocking essential cookies may affect store functions.

When configured and analytics is enabled, Google Analytics measures store use and Microsoft Clarity collects interactions, device/browser and navigation information for heatmaps and session replay. Eligible customer pages include the storefront, cart, contact page, sign-in and registration pages, customer profile and address book, checkout, order history, verified order lookup and order confirmation. Signed-in customer visits can also be recorded. Visible page content may include your name, email address, telephone number, saved postal addresses and order details, as well as product names, images, specifications, prices and published reviews. Clarity masks input and dropdown values, including passwords and hidden security fields. We exclude administration and administrator sessions, password-recovery and email-verification flows, authentication callbacks, payment-return and payment-outcome pages, privacy settings, unknown routes and errors. URLs containing query strings, fragments or unsupported referrers are excluded; search-query echoes remain masked. Most form POST responses are excluded except order lookup. Custom events use fixed action names rather than typed content or customer identifiers. Separate analytics events measure checkout submission and completed purchases on eligible pages. Masking does not make the collected data anonymous.

STRIXON and Microsoft act as independent controllers for Clarity data. Microsoft may use it for purposes described in its Privacy Statement, including product improvement and advertising-related uses. We send the advertising preference separately; when it is off, Clarity documents that data is not shared with Microsoft Ads. This does not stop all other permitted Microsoft uses.

Clarity may use first-party cookies such as _clck and _clsk, and Microsoft third-party cookies where allowed by the browser and settings. In our current tests, _clck expires after one year and _clsk after one day; browser restrictions may shorten these periods. Ordinary recordings are accessible for 30 days; some retained recordings and heatmap data may remain for up to nine months. Exported or shared copies may have separate retention.

Disabling analytics prevents new replay collection on subsequent pages and stops loaded tracking in open tabs when they receive the preference change. Requests already sent cannot be recalled. It does not delete previous data or all third-party cookies. Contact us using the details below for privacy requests.

We use providers for the services listed below. Their roles and data use depend on the service; Microsoft’s independent role for Clarity is explained in the analytics section.

• Payment processing — Tap Payments, to take payment securely. Card data is handled by the processor, not stored by us.
• Shipping & delivery — Aramex (and any future delivery partner), to ship your order and provide tracking. They receive the recipient name, address, and contact number.
• Analytics — basic site-analytics providers, to measure usage in aggregate.
• Email & messaging — our email and messaging providers, to send transactional notifications.

We do not sell your personal data.

Beyond the service providers above, we disclose personal data only:

• when required by a competent authority, court order, or applicable law in the Kingdom of Saudi Arabia;
• to establish, exercise, or defend legal claims, or to prevent fraud or harm;
• in connection with a business transfer (such as a merger or acquisition), where the recipient agrees to honour this policy.

We aim to store and process personal data within the Kingdom of Saudi Arabia. Some of the service providers we rely on — for example website analytics — may process limited data on servers outside the Kingdom.

Where data is transferred outside Saudi Arabia, we do so only in accordance with the PDPL and its transfer conditions, and we require the recipient to apply an adequate level of protection for your personal data.

We keep personal data only for as long as needed for the purpose it was collected, or as required by law:

• Order & invoice records — retained for at least 6 years, as required by Saudi tax and accounting regulations (ZATCA).
• Account data — kept while your account is active; deleted or anonymised on request, subject to legal retention.
• Support messages — kept for up to 24 months to handle follow-ups.

When data is no longer needed, we securely delete or anonymise it.

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), access controls, and secure handling of payments through our PCI-compliant payment provider.

No method of transmission or storage is perfectly secure, but we work to safeguard your data and to respond promptly to any incident as required by the PDPL.

Subject to the conditions of the PDPL, you have the right to:

• Be informed — know how and why your personal data is processed;
• Access — request a copy of the personal data we hold about you;
• Correction — ask us to correct inaccurate or incomplete data;
• Deletion — ask us to delete your data where there is no legal reason to keep it;
• Object & withdraw consent — object to certain processing and withdraw any consent you gave, without affecting prior lawful processing.

To exercise any right, contact us using the details below. We may verify your identity before acting, and we will respond within the period required by law. You may also lodge a complaint with the competent Saudi data-protection authority.

Our store is intended for adults. We do not knowingly collect personal data from children without the consent of a parent or guardian. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated where appropriate. Please review this page periodically.

For any question about this policy or your personal data, or to exercise your rights, contact us:

• Email — support@strixonstore.com
• Phone / WhatsApp — +966 50 422 8580

STRIXON is operated by Strixon Store, Kingdom of Saudi Arabia — Commercial Registration No. 7032534237, VAT No. 312509518400003.