Privacy Policy

1 Who We Are

Olive Branch (غصن الزيتون) is an e-commerce platform based in Al-Jouf, Saudi Arabia, specialising in premium cold-pressed extra virgin olive oil. For any privacy-related queries, contact us at ceo@olivesbranch.online.

2 Information We Collect

We collect the following categories of personal data:

• Account data: Name, email address, and hashed password when you register.
• Profile data: Phone number, delivery address, city, and birthdate if you provide them.
• Order data: Items purchased, shipping address, and payment method (cash or card type only — no card numbers stored).
• Session data: An encrypted session cookie that keeps you signed in across pages.
• Language / theme preference: Stored in your browser's localStorage only.
• Cart data: Stored locally in your browser and never sent to our servers unless you place an order.
• Merchant data: Business name, commercial registration number, and business phone if you apply as a merchant.

3 How We Use Your Information

• To create and manage your account securely.
• To process and fulfil your orders and send confirmation notifications.
• To verify your identity and prevent fraud.
• To provide customer support when you contact us.
• To send you relevant offers and promotions — only if you opt in.
• To comply with applicable Saudi regulations and legal obligations.
• To review and approve merchant applications.

4 Data Storage & Security

Your data is stored on a secure PostgreSQL database hosted by Supabase, which complies with ISO 27001 security standards. Passwords are never stored in plain text — they are hashed using bcrypt with a cost factor of 12. Sessions are stored server-side with HTTP-only, SameSite cookies to prevent XSS and CSRF attacks.

5 Sharing Your Information

We do not sell, rent, or trade your personal information. We may share data with:

• Delivery partners — to ship your orders (name and address only).
• Payment processors — if you pay by card (we never see your full card number).
• Regulatory authorities — if required by Saudi law or a court order.

6 Cookies

We use a single session cookie (httpOnly, secure in production) to keep you logged in. We do not use any third-party tracking or advertising cookies. You can disable cookies in your browser settings, but this will prevent you from signing in.

7 Your Rights

Under applicable data protection laws, you have the right to:

• Access your personal data at any time via your Account page.
• Correct inaccurate information from your Profile settings.
• Delete your account and all associated data using the "Delete Account" option in Account Settings.
• Object to processing for marketing purposes.
• Data portability — request a copy of your data by emailing us.

8 Data Retention

We retain your account data for as long as your account remains active. If you delete your account, all personal data is permanently removed from our database within 30 days. Order records may be retained for 5 years as required by Saudi accounting regulations.

9 Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us immediately.

10 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the website after changes constitutes your acceptance of the revised policy.