Privacy policy

When you send a project enquiry: your name, your email address, your phone number if you give one, and what you write in the message. Name, email and message are required because we cannot answer without them; the phone number is optional. It is emailed to the studio and kept in that mailbox.

When you place an order: your name, email address, phone number, delivery address, and what you ordered. All of these are required — we cannot make the piece or get it to you without them, and the courier cannot deliver without the address and the phone number.

If you create an account: your email address, a password we store only as an irreversible hash, and any addresses and past orders on the account.

We never see or store card numbers. Card details are entered on the payment provider's own page and handled by them; we are told only whether the payment succeeded.

To reply to enquiries, to make and deliver orders, to send order confirmations, to keep accounts and tax records as required, and to answer you if something goes wrong with a piece. We do not use it to advertise to you and we do not profile you.

We hold this because we need it to carry out the contract you entered into when you ordered, or to take steps you asked for before ordering, and because keeping accounting records is a legal obligation. Where we rely on your consent instead — for anything that is optional — you can withdraw it at any time.

Some of it is processed outside Saudi Arabia. Our site hosting, our database hosting and our email provider operate from outside the Kingdom, and if you pay by card the payment provider processes it on its own systems. Your name, contact details and order therefore leave the Kingdom in the course of running this shop.

We use established providers, share only what each one needs to do its job, and rely on the safeguards the Personal Data Protection Law requires for transfers outside the Kingdom. If you want to know which provider holds what, ask us and we will tell you.

Only the services needed to run the shop: our hosting providers, which store the site and its database; our email provider, which sends order confirmations and delivers enquiries; our payment provider, which processes the card; the courier who delivers your order, who is given your name, address and phone number; and the studio's own production system, which receives the order so the piece can be made.

We do not sell your data, share it for advertising, or pass it to anyone who is not doing one of the jobs above.

The site sets five cookies, all its own: one holding your basket, one keeping you signed in, one used while an account is being created, one that keeps cached pages from being shown to the wrong region, and one remembering whether you chose Arabic or English. The basket and sign-in cookies last a week; the language one lasts a year.

There is no analytics, no advertising pixel, and no third-party tracker anywhere on this site. Nothing here follows you to another website.

Order and payment records are kept for as long as accounting and tax rules require. Enquiries are kept while we are talking to you and afterwards in the mailbox unless you ask us to delete them. Account details are kept until you ask us to close the account.

It is held in the shop's database and in the studio's mailbox, both reached only with credentials we control, and processed only by the people and services named above. When it is no longer needed — or when you ask and we are not required to keep it — the record is deleted from the database and the backups it appears in, and email is removed from the mailbox.

If you do not give the required details we cannot take the order: there would be no way to make the piece, invoice it, or have it delivered. Leaving out the optional ones costs you nothing but a slower reply.

Under Saudi Arabia's Personal Data Protection Law you may ask to be told what we hold about you, to see it, to have it corrected, to have it destroyed, and to receive it in a readable form. Email hello@athartuwaiq3d.com and we will answer. Records we are legally required to keep are the one thing we cannot destroy on request.

If you are not satisfied with how we answer, you can complain to the Saudi Data and AI Authority (SDAIA), which supervises this law.

If this policy changes the date at the top of the page changes with it. We do not change it quietly.