Draft for review

Privacy Policy

What personal information Sketch & Stitch holds, why, who else handles it, and your choices.

This is a draft awaiting the owner's approval and legal review. It is not in force and is not shown on the live site.

It still needs 19 facts or decisions from the owner, marked in the text like [to confirm: this], and review by someone qualified in Egyptian consumer-protection and data-protection law before it is published.

What the owner needs to supply

registered legal name of the business
registered business address
a dedicated privacy contact, and the data protection officer if one is required (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 8 requires a legal entity to appoint and register one)
once image storage is switched on: the provider (Cloudinary is prepared) and that uploaded pictures are kept there for making and supporting your order
what the hosting provider logs about visits (for example IP addresses), and for how long
whether marketing messages will be sent in future, through which channels, and how consent will be collected (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Arts. 17-18 require prior consent, an easy opt-out and consent records)
the legal basis for each use under the Personal Data Protection Law, to be written by a lawyer (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 2 requires explicit consent unless the law allows otherwise; Art. 6 also allows processing needed for a contract, a legal obligation or legitimate rights)
the licence or permit from the Personal Data Protection Center, and when it is needed (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 4; its executive regulations were reported issued on 1 November 2025 (Decision No. 816/2025) with one year to comply, which would be about 1 November 2026 - confirm the deadline urgently)
the hosting and database providers (for example Vercel and a hosted PostgreSQL service), and the countries where their servers are
the image storage provider, once switched on
the courier or couriers used for delivery, which receive your name, phone number and address
the legal basis and safeguards for transfers outside Egypt, and any licence or permit required (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Arts. 14-16 allow transfers only where protection is not less than Egypt’s and with the Center’s licence or permit, subject to listed exceptions; where Clerk and the hosting provider process data has not been researched)
the retention period for order and accounting records
the period after which inactive accounts are removed, if any
how identity is checked, and the time within which the business will respond (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 32 sets six working days)
the statement of those rights and of how to complain to the Personal Data Protection Center, to be written by a lawyer (research (unofficial translation, for the lawyer to confirm): Art. 2 lists the rights to be told, to access, to withdraw consent, to correct, update or delete, to restrict and to object; Art. 33 sends complaints to the Center; Art. 7 requires breaches to be reported to the Center within 72 hours)
the business’s position on accounts and orders by people under 18 (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 12 requires a guardian’s consent for children’s data)
the date this version takes effect
an Arabic version of this policy (research (unofficial translation, for the lawyer to confirm): privacy notices under Law 151/2020 are expected in Arabic, and Law 181/2018 Art. 5 requires documents in Arabic)

Who is responsible for your information

Your information is handled by [to confirm: registered legal name of the business] (“Sketch & Stitch”), [to confirm: registered business address]. For anything about your information, contact us through Contact on WhatsApp (opens WhatsApp) or email sketchstitch190@gmail.com. [to confirm: a dedicated privacy contact, and the data protection officer if one is required (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 8 requires a legal entity to appoint and register one)].

What we hold

Account details: your name and email address, the profile picture you set (if any), and the identifier of your sign-in account, as given to us by Clerk when you sign up or sign in. We do not hold your password or your two-step verification details.

Your designs: the garment, colour and size you chose, the text you set and where every element sits, kept so a design can be saved to your account, reopened and made.

Pictures you upload: while our image storage is being set up, pictures you add stay in your own browser on your device and are not sent to us, so a design with pictures cannot yet be saved to your account. [to confirm: once image storage is switched on: the provider (Cloudinary is prepared) and that uploaded pictures are kept there for making and supporting your order].

Your bag: the garments, sizes, quantities and designs in it.

Orders: what you ordered, the design printed on it (a copy kept with the order), the prices, the name, phone number and delivery address you give, your email address, any note you add, and when you accepted the returns policy and confirmed your artwork rights.

Payment: whether a payment succeeded, the amount, and the payment provider’s reference for it; for an InstaPay or Vodafone Cash transfer, the number or InstaPay address you tell us you sent it from and any transfer reference you give. We do not receive or store your card number, expiry date or security code.

Messages: if you contact us on WhatsApp, we see your phone number, your WhatsApp name and what you send us, so we can answer you. WhatsApp handles those messages under its own terms and privacy policy.

Security records: when our staff use the shop’s administration area, we record who did what, with a scrambled (hashed) form of the IP address rather than the address itself. [to confirm: what the hosting provider logs about visits (for example IP addresses), and for how long].

On your own device

If you design without signing in, your design is kept in your browser’s storage on your device so it survives a refresh. Pictures you add are kept in your browser’s storage too, and removed automatically 30 days after you last open the design, unless a design still kept on the device uses them. Clearing your browser’s site data removes them at once. This stays on your device; we cannot see it.

Why we use it

To create and secure your account; to save your designs; to price, make, deliver and support your orders; to take and reconcile payment; to answer you when you contact us; to keep the shop and its administration secure; and to meet our legal and accounting duties.

We do not send marketing messages. [to confirm: whether marketing messages will be sent in future, through which channels, and how consent will be collected (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Arts. 17-18 require prior consent, an easy opt-out and consent records)].

[to confirm: the legal basis for each use under the Personal Data Protection Law, to be written by a lawyer (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 2 requires explicit consent unless the law allows otherwise; Art. 6 also allows processing needed for a contract, a legal obligation or legitimate rights)].

[to confirm: the licence or permit from the Personal Data Protection Center, and when it is needed (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 4; its executive regulations were reported issued on 1 November 2025 (Decision No. 816/2025) with one year to comply, which would be about 1 November 2026 - confirm the deadline urgently)].

Who else handles it

We use other companies to run the service. Each receives only what it needs for its job:

Clerk - sign-in and account security. Holds your sign-in details and account email.

Paymob - taking card payments, once connected. Receives your payment details directly on its own pages.

InstaPay (through your bank) and Vodafone Cash - only if you pay by transfer. They carry the transfer under their own terms; we see the payment arrive in our account with the sender details they show us.

WhatsApp (Meta) - only if you choose to message us there.

[to confirm: the hosting and database providers (for example Vercel and a hosted PostgreSQL service), and the countries where their servers are].

[to confirm: the image storage provider, once switched on].

[to confirm: the courier or couriers used for delivery, which receive your name, phone number and address].

No email service is switched on. No analytics, advertising or tracking service is switched on. If one is added, this policy will be updated first, and your consent asked where the law requires it.

We do not sell your information.

Transfers outside Egypt

Some of these providers, including Clerk, process or store information outside Egypt. [to confirm: the legal basis and safeguards for transfers outside Egypt, and any licence or permit required (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Arts. 14-16 allow transfers only where protection is not less than Egypt’s and with the Center’s licence or permit, subject to listed exceptions; where Clerk and the hosting provider process data has not been researched)].

How long we keep it

We keep order records for as long as the law requires for accounting and tax purposes: [to confirm: the retention period for order and accounting records]. Account details and saved designs are kept until you ask us to remove them, or [to confirm: the period after which inactive accounts are removed, if any].

When we remove a customer’s details at their request, orders already made are kept as the law requires, and the rest is removed.

How we protect it

Access to customer information in our administration area is limited by role, every staff account must use two-step verification, and staff actions are recorded. Card details never reach our systems. No system is perfectly secure; if a breach affecting your information occurs, we will act as the law requires.

Your choices and rights

You can ask us for a copy of the information we hold about you, to correct it, or to remove your account details and saved designs, through Contact on WhatsApp (opens WhatsApp) or email sketchstitch190@gmail.com. [to confirm: how identity is checked, and the time within which the business will respond (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 32 sets six working days)].

You also have rights under the Egyptian Personal Data Protection Law (Law No. 151 of 2020). [to confirm: the statement of those rights and of how to complain to the Personal Data Protection Center, to be written by a lawyer (research (unofficial translation, for the lawyer to confirm): Art. 2 lists the rights to be told, to access, to withdraw consent, to correct, update or delete, to restrict and to object; Art. 33 sends complaints to the Center; Art. 7 requires breaches to be reported to the Center within 72 hours)].

Cookies

The website uses cookies only for signing in and keeping you signed in (set by Clerk). No analytics or advertising cookies are used.

Children

[to confirm: the business’s position on accounts and orders by people under 18 (research (unofficial translation, for the lawyer to confirm): Law 151/2020 Art. 12 requires a guardian’s consent for children’s data)]

Changes to this policy

We will update this policy when what we hold or who handles it changes, and show the date of the latest version here. [to confirm: the date this version takes effect].

[to confirm: an Arabic version of this policy (research (unofficial translation, for the lawyer to confirm): privacy notices under Law 151/2020 are expected in Arabic, and Law 181/2018 Art. 5 requires documents in Arabic)].