Last updated: 3 August 2026
1. Introduction
This Privacy Policy explains how Hadafy Store (“Hadafy”, “we”, “us” or “our”) collects, uses, stores and shares personal information when you use the Hadafy website, Hadafy Store mobile applications for iOS and Android, customer accounts, ordering services, delivery services and related customer support channels.
By using our services, you acknowledge that your personal information will be handled as described in this Privacy Policy. Where consent is required, such as for marketing notifications, we will ask for it separately.
You may browse products without signing in. Certain features, including synchronized carts, wishlists, saved addresses, orders, invoices, delivery tracking, notifications and account deletion, require an authenticated customer account.
2. Information we collect
Depending on how you use Hadafy, we may collect the following information:
- Account information: your name, email address, verified telephone number, customer identifier and authentication information.
- Delivery information: recipient name, country, province or area, city, block, street, building, postal code, apartment or floor, delivery notes and saved address labels.
- Order information: products, quantities, prices, discounts, coupons, order status, invoices, returns, delivery status and previous purchases.
- Payment information: selected payment method, payment status, transaction references and information required to confirm or reconcile a payment. Card details may be collected directly by the selected payment provider and are not stored by Hadafy unless expressly stated during checkout.
- Store and account activity: cart contents, wishlist items, back-in-stock requests, preorder activity, selected variations and customer preferences. For authenticated customers, we may also record one daily activity signal per platform, including the customer identifier, Kuwait calendar date, channel, platform, application version, build number and first and last signal times.
- Communication preferences: language, display currency, utility notification settings, marketing consent and individual back-in-stock subscriptions.
- Device and notification information: app installation identifier, operating system, app version, Firebase Cloud Messaging token, Apple push token, ActivityKit token and notification delivery status.
- Support information: messages and order details you choose to send when contacting Hadafy Support.
- Technical information: IP address, browser or device type, request timestamps, security logs, error information and information needed to prevent fraud or misuse.
3. Device location
The Hadafy Store mobile application does not request, collect or track the precise or approximate GPS location of your device.
Delivery addresses are selected or entered manually by the customer. An address provided for delivery is personal information, but it is not collected from the device’s location services.
4. How we use your information
We use personal information to:
- Create, authenticate and manage your Hadafy account.
- Process orders, payments, refunds, invoices, deliveries and returns.
- Save and synchronize your cart, wishlist, addresses and preferences.
- Provide order status, delivery tracking and customer support.
- Send security codes and verify sensitive account actions.
- Send requested back-in-stock notifications.
- Send important utility notifications about orders, payments and deliveries.
- Send marketing notifications only when you have explicitly enabled them.
- Maintain service security, prevent fraud and investigate technical problems.
- Comply with legal, accounting, tax and regulatory obligations.
- Improve the reliability, usability and performance of our services.
5. Notifications and communication preferences
Utility notifications may include order confirmations, payment updates, delivery updates, security messages and other important account information. Utility notifications are enabled at the Hadafy account level by default, but system notification permission is controlled separately by your device.
Marketing push notifications are disabled by default. We send them only after you provide explicit consent to the current marketing consent version. You can disable marketing notifications at any time in the application’s Notification settings without affecting your account, orders, rewards or utility notifications.
Back-in-stock notifications are separate, product-specific requests. You can turn the notification bell on or off for an eligible out-of-stock product or selected variation. Removing an item from your wishlist also cancels its back-in-stock request.
You may also disable all push notifications through your iOS or Android system settings. When notification permission is removed, Hadafy may remove or deactivate the associated device registration.
6. Push notification providers
Hadafy uses Firebase Cloud Messaging, provided by Google, to deliver notifications to Android devices and to route notifications to Apple Push Notification service for iOS devices. Apple Push Notification service and ActivityKit may be used for iOS notifications and delivery Live Activities.
These services may process device identifiers, push tokens, message delivery information and technical metadata required to deliver notifications. Hadafy does not use push notification tokens for cross-app advertising tracking.
7. Cookies and website storage
The Hadafy website may use cookies and browser storage to maintain sessions, remember preferences, preserve cart contents, protect forms, prevent fraud and understand service performance.
You can configure your browser to reject or delete cookies. Some functions, including account sessions, checkout and cart persistence, may not work correctly when required cookies or browser storage are disabled.
Where optional analytics or marketing cookies are used, they should be handled according to the choices available through the website or browser.
8. Analytics and tracking
To measure active membership and adoption of our services, when an authenticated customer uses the Hadafy website or mobile application, we may record no more than one daily activity entry per platform. We use these records to calculate aggregated statistics such as daily, weekly and monthly active users and application-version adoption.
This activity record does not contain the pages or screens viewed, clicks, searches, session duration, device location, advertising identifiers or cross-app tracking information.
The Hadafy Store mobile application does not request Apple App Tracking Transparency permission and does not use personal information to track you across applications or websites owned by other companies for advertising purposes.
If website analytics services are enabled, they may process information such as page visits, browser type, device type, approximate network location and IP address according to their applicable privacy terms and the choices available to you.
9. How we share information
We do not sell your personal information.
We may share only the information required to provide our services with:
- Payment providers that process the payment method selected during checkout.
- Delivery personnel and delivery service providers that need your name, telephone number, address and delivery instructions to deliver an order.
- Google Firebase and Apple for push notification delivery and iOS Live Activities.
- Hosting, infrastructure and security providers that operate or protect our systems.
- Customer support providers where necessary to respond to your request.
- Professional advisers, regulators or authorities where disclosure is legally required or necessary to protect our rights, customers or services.
Service providers may use personal information only to perform the services assigned to them and subject to their contractual and legal obligations.
10. International processing
Some service providers, including payment, hosting, security, Firebase and Apple notification services, may process information outside Kuwait or outside the country where you use Hadafy.
Where information is processed internationally, we take reasonable steps to ensure it receives appropriate protection consistent with this Privacy Policy and applicable requirements.
11. Data retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required by law.
- Account information is generally retained while the account remains active.
- Order, invoice, payment and transaction records may be retained after account deletion where required for accounting, tax, fraud prevention, warranty, dispute or other legal obligations.
- Device and push tokens are retained while the device registration remains active and are removed or deactivated when appropriate.
- Marketing consent records may be retained to demonstrate when consent was granted or withdrawn.
- Authenticated daily activity records are retained for up to 24 months and are deleted as part of the account-deletion process.
- Security logs may be retained for a limited period needed to detect abuse, investigate incidents and protect our services.
When information is no longer required, we will delete, anonymize or securely isolate it, subject to technical and legal requirements.
12. Account deletion
You can request permanent deletion of your Hadafy account from the Hadafy Store application by opening Account → Account Settings → Delete account.
You may also start the account deletion process through:
https://hadafy.com.kw/en/account-deletion
To protect your account, Hadafy requires reauthentication using a verification code sent to your confirmed telephone number before accepting the deletion request.
After the request is accepted:
- Your account enters a pending deletion state.
- Your active sessions and authentication tokens are revoked.
- Your registered notification devices and future customer notification events are disabled.
- You are signed out from your devices.
- Deletion is scheduled for completion within 30 days, and the scheduled date is shown after confirmation.
If the request was made by mistake, you may contact Hadafy Support before the scheduled deletion date to request cancellation. After deletion has been completed, the previous account cannot be reactivated.
Certain transaction records may remain where retention is required by law or necessary for accounting, fraud prevention, disputes, refunds or warranty obligations. Such retained information will not be used for unrelated marketing purposes.
13. Your choices and rights
Subject to applicable law and any necessary identity verification, you may:
- Access and review personal information available through your account.
- Correct your personal information and saved delivery addresses.
- Request information about the personal data we hold.
- Withdraw marketing consent at any time.
- Manage push notification permission through device settings.
- Enable or disable individual back-in-stock notifications.
- Request permanent deletion of your account.
- Contact us regarding correction, access, deletion or other privacy concerns.
Withdrawing optional consent does not affect processing already performed lawfully and does not prevent us from sending essential transactional or security communications where necessary.
14. Security
We use reasonable technical and organizational safeguards intended to protect personal information against unauthorized access, alteration, disclosure, loss or misuse. These measures may include encrypted network communication, access controls, authentication, token revocation, monitoring and restricted administrative access.
No internet service or storage system can be guaranteed to be completely secure. You are responsible for protecting your account credentials and for notifying us if you suspect unauthorized access.
15. Children
Hadafy Store is not directed to children who are not legally permitted to create an account or purchase products independently. Customers who have not reached the applicable legal age should use the service only with the involvement and authorization of a parent or legal guardian.
If you believe that a child has provided personal information without appropriate authorization, please contact us.
16. Third-party websites and services
Our website or applications may contain links to third-party websites, payment services, map services, messaging applications or other external services. Their handling of personal information is governed by their own privacy policies, and Hadafy is not responsible for their independent practices.
17. Changes to this Privacy Policy
We may update this Privacy Policy when our services, providers, legal obligations or data-handling practices change. The updated version will be published with a revised “Last updated” date.
Where a change materially affects your rights or requires new consent, we may provide an additional notice or request consent through the website, application or another appropriate communication channel.
18. Contact us
If you have questions, concerns or requests regarding this Privacy Policy or your personal information, contact Hadafy using:
Email: admin@hadafy.com.kw