Privacy Policy

Last updated: 25 September 2026

1. Who we are

This policy explains how BeautyBrats UAE handles personal information through this store, customer support and its connected-account advertising reporting features. You can request details of the relevant seller or store operator through our contact form. For privacy questions, use our contact form or email support@beautybrats.com.

Our related storefronts include BeautyBrats India, Core Retails, Glow Hub / BeautyBrats and BeautyBrats UAE. This notice describes this store; using it does not automatically subscribe you to another store's marketing or authorize another store to access your advertising account.

2. Information we receive

Depending on the features you use, we receive your name, email, telephone number, account identifiers, delivery addresses, cart and wishlist items, order details, payment status and transaction references, reviews, support messages and attachments. Payment credentials are entered through the selected payment provider's payment flow. Do not send payment credentials in messages or reviews.

Our website and infrastructure process technical data such as IP addresses, browser and device information, requested pages, timestamps, security events and approximate location. Where a delivery-location feature is available, device location is used only when you choose it and grant permission; you may provide an address or postal code instead. We receive information directly from you, your device and providers supporting payments, authentication and delivery.

3. Why we use information

We use information to provide accounts, process orders and refunds, arrange delivery, respond to questions, maintain carts and wishlists, display submitted reviews, send service updates, prevent fraud, understand store usage and improve reliability. Reviews may be public, so avoid including private information. Marketing messages are subject to applicable permission requirements and your choices. Use the unsubscribe instructions in promotional messages or contact us to stop them; essential order updates are separate.

Where a legal basis is required, it may be contract performance, legal obligations, consent or legitimate interests where permitted and appropriately balanced, such as service security. We obtain consent for processing that requires it. Continuing to browse is not permission for new optional tracking.

4. Cookies, analytics and advertising choices

Essential cookies and browser storage support login sessions, security, carts and payment continuity. Where enabled, first-party visitor analytics help us understand visits and approximate geography. Browser privacy controls can restrict cookies and storage; doing so may affect login, your bag or payment continuity. Clearing browser data does not delete order records or a store account.

Connecting Meta or Google Ads in the business dashboard is separate from tracking shoppers. The connection is used for account selection and advertising reports; it does not by itself install an advertising pixel, upload customer lists or start ads. Before introducing optional advertising tags, enhanced conversions or remarketing, we will disclose the actual tools, events and identifiers involved and provide the consent or opt-out controls required for that processing. Server-side event sharing must respect applicable choices too.

External authentication, payment, image and other service providers receive ordinary web-request information when their resources are used and may apply their own privacy policies. For advertising preferences managed by providers, see Google My Ad Center and Meta's account settings. You may contact us to exercise applicable targeted-advertising or sale/sharing opt-out rights. Advertising disclosures can qualify as sale or sharing under some laws even without payment.

5. Meta and Google account connections

When you choose an available provider sign-in, we receive the authorized account identifier and supplied profile information, such as name and email, to authenticate or recognize your store account. We do not receive your provider password.

When an authorized business administrator connects Meta or Google Ads, we access the advertising accounts available to that login and the account selected for this store. Information includes account ID, name and currency; authorization tokens and connection records; campaign names and identifiers; and performance metrics such as spend, impressions, clicks, conversions and conversion value. We use it to maintain the authorized connection and show account-specific reports. Connecting an account does not authorize campaign spending. Any additional management features or access will be explained before authorization.

We restrict access to connected credentials to authorized systems and staff. We do not sell Meta Platform Data or Google API data or use it for unrelated advertising. Google API information is not used to train general-purpose AI models. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. Transfers and human access are limited to purposes permitted by those policies, such as necessary feature provision, authorized assistance, security or legal requirements. Meta data is processed for the disclosed authorized features under applicable Meta terms.

6. Providers and other disclosures

Information necessary to operate the store is shared with relevant hosting and database, payment, authentication, delivery, messaging, customer-support and security providers and authorized personnel. This includes Railway hosting and the payment and authentication providers you choose where available. Each receives information appropriate to its role. Staff supporting multiple stores may access records when necessary for service or security; this does not permit unrestricted reuse for another store's marketing.

We may disclose information to meet legal duties, protect rights, investigate fraud, obtain professional advice or undertake a business transfer with applicable safeguards. Some providers independently process information under their own notices. We do not disclose passwords, payment credentials or sensitive health information for advertising.

7. Retention, security and international processing

We retain information while reasonably necessary to provide the requested services, maintain the account, resolve disputes, protect security and comply with recordkeeping obligations. Retention depends on the information and purpose; required transaction records can remain after account deletion. Contact us for details relevant to your records. Information no longer needed is deleted or anonymized, subject to lawful exceptions and backup rotation.

Access restrictions, secure connections and appropriate technical and organizational safeguards help protect information, but no online service is completely secure. Our operators and providers may process information outside your country. Where applicable, legally required transfer safeguards are used; contact us for information about arrangements relevant to your data.

8. Your choices and rights

Depending on applicable law, you may request access, correction, deletion or a copy of personal information, withdraw consent, object to or restrict processing, or opt out of specified advertising uses. We verify requests proportionately, explain lawful exceptions and respond within applicable deadlines. Withdrawal does not affect earlier lawful processing. We will not unlawfully discriminate against you for exercising rights.

Use our contact form or email support@beautybrats.com with the subject Privacy request. Authorized agents may submit requests subject to appropriate verification. To appeal a decision where applicable, contact us with the subject Privacy request appeal. You may complain to the privacy or consumer authority competent for your location. Read the full data deletion instructions.

9. Children

Our shopping and business administration services are not directed to children. We do not knowingly seek children's personal information or use it for personalized advertising. Contact us if you believe a child has provided information that should be removed.

10. Changes and provider information

We update this policy when practices change and provide additional notice or obtain consent where required before materially new uses. The date below identifies this version. Provider notices: Meta Privacy Policy, Google Privacy Policy, and how Google uses information from partner sites.