Privacy notice
Last updated: 30 August 2026
Who we are
Moon Curls is a trading name of Moon Curls, licensed by the Dubai Department of Economy and Tourism under trade licence 1649428, at P.O. Box 448935, Dubai, United Arab Emirates.
We are the controller of the personal data described here. Reach us at info@moon-curls.com.
This notice is given under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and Federal Decree-Law No. 14 of 2023 on trading through modern technology.
What we collect, and why
| What | Why | Basis |
|---|---|---|
| Name | To address you and label your parcel | Performance of your order |
| Email address | Order confirmation, dispatch notice, invoice | Performance of your order |
| Phone number | Couriers require it to deliver — in the Gulf and Africa a missing number is the commonest cause of failed delivery | Performance of your order |
| Delivery address | To send you what you bought | Performance of your order |
| What you ordered | To fulfil it, and to meet our tax record-keeping duties | Legal obligation |
| Country | To calculate delivery and any duties we pay on your behalf | Performance of your order |
We also record a salted, one-way hash of your IP address and your browser's user-agent. We never store your actual IP address. The hash cannot be reversed and exists only to detect automated abuse.
Marketing
We will only email you marketing if you have ticked the box asking us to. Federal Decree-Law 14/2023 requires your clear agreement before we use your details to promote anything, and we record the exact wording you agreed to and when.
Every marketing email carries a one-click unsubscribe. Unsubscribing never affects an order.
What we do not do
- We do not sell or rent your details, and we do not share them with anyone for their own marketing — with one exception you control. If you turn Advertising on in your cookie preferences, Google may use your visit for its advertising products. It is off unless you turn it on.
- We set no analytics or advertising cookie unless you have told us we may. Until you answer, and if you say no, nothing beyond what is strictly necessary to run the shop is stored on your device.
- We do not make automated decisions about you that have a legal or similarly significant effect. Two narrower things happen and are worth naming: our payment provider checks each payment for fraud, which includes recognising the device it came from, and if you let us count visits, Google can tell one visit from another. Neither produces a profile we hold or act on.
- We never see or store your card details. Payment is handled entirely by our payment provider.
Cookies, and how to change your mind
What we can store on your device is set out in full in our cookie policy — every cookie, who sets it, how long it lasts and what it does — in four groups you can answer separately: what is needed to run the shop, remembering your choices, counting visits, and advertising.
Only the first is set without asking. You can change any of the others whenever you like, from the Cookie preferences link at the foot of every page. Turning one off removes what it had already stored, straight away — telling a third party to stop is only half of it.
If your browser sends a Global Privacy Control signal we honour it: nothing optional is switched on and we do not put the question to you, because you have already answered it.
We ask again after six months, and sooner if what we store changes. We keep a record of your answer, and how long for is in How long we keep it below.
How we count visits
We count how busy each page is on our own server. It sets nothing on your device, so there is nothing for you to agree to — but it does work out a key from the network your request came from, so that two page views a minute apart are not counted as two people.
That key is deliberately useless: your address is cut down to a range shared by hundreds of households before it is used, it is never stored, and the key itself changes every day, so nothing we hold can join one day to the next. We keep only totals — how many views, how many people, which pages, which countries, and the name of the site that sent you.
The lawful basis is our legitimate interest in knowing how busy our own shop is. You have the right to object, and there is a switch for it in Cookie preferences at the foot of every page.
Who processes data for us
| Who | What they do | Where |
|---|---|---|
| Supabase | Database hosting | London, United Kingdom |
| Vercel | Website hosting | United States and global edge |
| Stripe | Payment processing | Ireland and the United States |
| Resend | Sending order emails and invoices | United States |
| Cloudflare | Checking that forms are filled in by a person | United States and global edge |
| Sentry | Recording server errors so we can fix them | United States |
| Our delivery partners | Delivery | Per destination |
| Google Analytics | Counting visits, if you agree to it | United States |
Each acts only on our instructions under a written contract. When you place an order, Stripe receives your name, email address and billing address in order to take the payment, and the courier receives the delivery address and telephone number needed to bring you the parcel. Until you order, neither holds anything of yours. Where data leaves the UAE we rely on the receiving country's adequacy status, or on standard contractual clauses where no adequacy decision exists, as the PDPL requires.
Stripe also collects information about the device and browser used to pay, and how they behave, to tell a real customer from a stolen card. We do not see that information, and we do not use Stripe for analytics or advertising. Its own privacy policy says what it does with it.
How long we keep it
- Order records, invoices and payment records: five years from the end of the relevant tax period, because UAE tax law requires it. During an audit or dispute this may extend by up to four further years.
- Reservations that never became an order: 24 months.
- Marketing consent records: six years after the consent ends — this is the evidence that you agreed.
- Mailing list: until you unsubscribe, then 24 months.
- Abuse-prevention hashes: 12 months.
- Visit counts: the daily key that tells one visitor from another for 48 hours, and the totals it produces for 25 months. The totals are about pages, not people.
- Cookie consent records: three years — what you agreed to about cookies, when, and a one-way hash of your address. This is the evidence of your answer, and the law puts the burden of proving it on us.
Your rights
You may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, object to a use, or send it to someone else. You may withdraw marketing consent at any time.
Ask at info@moon-curls.com and we will respond within one month. If you are unhappy with our response you may complain to the UAE Data Office.
Note that we cannot delete records we are legally required to keep, such as invoices for a completed sale. We will tell you if that applies.
Children
Our brushes are for children; this shop is for the adults buying them. You must be 18 or over to order. We do not knowingly collect data from children. If you believe a child has given us their details, tell us and we will remove them.
Security
Data is encrypted in transit and at rest. Access is limited to people who need it, protected by multi-factor authentication, and every access to customer data is logged.
If a breach occurs that presents a risk to you, we will notify you and the UAE Data Office as the PDPL requires.