Privacy Policy

1. What we collect, and why

Name, phone and delivery address, so our driver can find you and confirm the order before arriving.

Email address, to send you order-status updates and, if you opt in, occasional offer announcements you can unsubscribe from at any time.

Order history and Paddock Club Miles, tied to your account, so you can see your past orders and use your rewards.

If you pay online, only the fact that the order was paid, when, and through which method. The payment itself happens on Whish’s own page: we never receive your Whish phone number, wallet details or one-time codes, and we can’t charge you again.

If you pay by bank transfer (Neo, MyMonty or BO2), you send the money yourself from your own banking app, under your bank’s terms. We only see what reaches our account (the amount, the sender name and your note) to match it to your order, and we record that the order was paid, when, and by which method. We never receive your banking login or card details.

Your date of birth, only if you choose to add it, when you create your account or later in your profile. It is optional, we use it to send you an offer on your birthday and to understand the age range of our customers as a whole, and we never share it. You can remove it from your profile at any time.

If you leave a review, your rating and text are published on the product page with your name and region. If you review without an account, from the personal link we email after delivery, only your first name, last initial and region are shown. Ask us on WhatsApp and we’ll remove a review at any time.

Your password is never visible to us: it’s stored encrypted by our authentication provider (Supabase), not as plain text.

If you sign in with Google, Google shares your name, email address and profile photo with us. Your photo is only shown to you, on your profile and in the menu bar; it stays on Google’s servers (we don’t copy it) and it changes when you change it on Google.

Where your visit came from, unless you refused cookies: if you arrived from one of our ads or links, its campaign labels (the utm_ tags in the link), whether it was a click on a Meta ad, the page you landed on and the website that sent you. Kept on your device for 30 days and attached to your order, so we know which ads lead to sales.

2. How we use it

To process and deliver your orders, manage your account and Miles, send you order-status emails, and reply to you on WhatsApp. We don’t use your data for anything beyond running BricksLand.

3. Who we share it with

We don’t sell or rent your personal data. Three companies process it on our behalf, strictly to run the site:

Supabase (our database and account provider) stores your account, orders and Miles.

Resend (our email provider) sends your order-status emails and, if you opt in, offer announcements.

Whish Money (our online payment provider) processes online payments when you choose to pay with Whish. It receives the order number and amount, and handles your wallet details under its own privacy policy.

Three others (Meta/Instagram/Facebook, TikTok, and Google Analytics) measure our ads and how the site is used. Unless you click “No thanks” on the cookie banner, they receive that a page or product was viewed, that something was added to a cart or checkout started, and that an order was completed with its total. Never your street address, and never anything readable about who you are (see the next points for Meta).

For Meta, these events are also sent from our own server, so ads can be measured even when a browser blocks tracking. When you are signed in, or when you place an order, your email, phone number, first and last name and delivery region (your governorate, never your street address) are included in hashed form (SHA-256, an irreversible fingerprint Meta uses to match the event to an account). The Meta Pixel in your browser does the same, hashing them before anything is sent. They are never sent in plain text.

Completed orders are always reported to Meta from our server in this hashed form, even if you refused cookies, so we can tell which ads lead to sales. Nothing about your browsing is sent once you refuse.

4. Cookies & local storage

We use your browser’s local storage for things you can see the effect of directly: your cart, your saved items, your light/dark theme choice, whether you asked to see prices in Lebanese pounds, your answer to the cookie banner, and, for a few minutes during an online payment, the order you’re paying for. None of that leaves your device.

Marketing and analytics cookies (Meta and TikTok for ads, Google Analytics to understand how the site is used) are on while you browse, and the banner tells you so. Click “No thanks” and they stop: nothing more is sent from your browser and their cookies are deleted. You can change your mind any time with the “Cookie preferences” link at the bottom of any page. See our Cookie Policy for exactly what is shared.

5. Your rights

You can ask us for a copy of your data, or ask us to delete your account, any time: message us on WhatsApp or write to contact@brickslands.com.

6. Children

BricksLand isn’t directed at children, and accounts should be created by adults.

If you add a date of birth, it has to show you are at least 13; anything younger is refused.

7. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.

8. Contact

Questions about your data? Reach us on WhatsApp or at contact@brickslands.com.