Privacy Policy.

What we collect

When you send us a request we collect your name, phone number and a description of the item, submitted through the form on this site or over WhatsApp.

When you message us on WhatsApp we receive your WhatsApp phone number, your WhatsApp profile name, and the content of the messages and any media you send us. We do not receive your WhatsApp contacts, and we cannot read your conversations with anyone else.

When you send us photographs or video of a piece for quotation, we retain that media as part of the item’s file.

We do not collect payment card details through this website.

How long we keep items and data

Items awaiting collection are held at the Qurm workshop. Uncollected items are stored for a period after completion; storage terms are confirmed at intake.

Item files (photographs, notes, quotations) are retained to support warranty questions and repeat work.

Third parties

This site is hosted on Vercel. Requests sent through the form are delivered by Resend (transactional email). News content is served from Sanity. The location map is embedded from Google Maps, which loads only when you scroll to it.

Requests sent through the form — your name, phone number, item description and any photographs you attach — are also filed in our customer-relationship system, Odoo (Odoo S.A.), where they form part of the item’s file.

To keep the request form free of spam, each request is checked by Vercel BotID (Vercel Inc.), which looks at technical signals from your browser to tell a person from an automated script and sets no cookies. To limit repeated requests we keep short-lived counters with Upstash (Upstash, Inc., in the United States); they are keyed by a one-way hash of your connection’s IP address, hold nothing you type, and expire within 24 hours.

Our WhatsApp Business number is operated through the WhatsApp Business Platform provided by Meta Platforms Ireland Ltd. Messages you send us pass through Meta’s systems in order to be delivered, and are governed by WhatsApp’s own privacy policy in addition to this one. Messages are then filed against your record in Odoo so the bench can answer you.

We use Vercel Analytics and Google Analytics to understand how the site is used. Both receive technical usage data — pages viewed, approximate location, browser and device type — but only Google Analytics needs your consent: Vercel Analytics sets no cookies and counts every visit. Neither receives anything you type into the request form. How they work, and how to turn Google Analytics off, is set out under “Cookies and analytics” below.

Cookies and analytics

Google Analytics does not run on this site until you choose Accept in the cookie notice. If you choose Reject — or your browser sends a Global Privacy Control signal — it never loads, and the site works exactly the same. Vercel Analytics, described below, sets no cookies and is not part of that choice: it counts every visit.

Google Analytics 4 (Google Ireland Limited, with Google LLC as its processor) sets two cookies on this site: _ga, which tells one browser’s visits apart, and _ga_<ID>, which keeps the current session. Both expire after 13 months. Google Signals and every advertising feature are switched off, so the data is not used for advertising or linked to a Google account, and Google Analytics does not store IP addresses.

Vercel Analytics (Vercel Inc.) sets no cookies and stores nothing on your device, which is why it runs without asking. It counts page views — with the page, the referring site, the approximate location and the type of device, operating system and browser — using a hash of the request that is discarded within 24 hours, so it cannot recognise you on a later day. We see only totals.

Both services may process this data in the United States. Google LLC and Vercel Inc. are certified under the EU–U.S. Data Privacy Framework, and both use standard contractual clauses where that framework does not apply.

Google Analytics runs only on the basis of your consent (Article 6(1)(a) GDPR, and the consent provisions of the Personal Data Protection Law). You can withdraw it at any time — choose Cookie settings at the foot of any page, or switch Cookies & analytics off on the Preferences page. Google Analytics stops at once and its cookies are deleted; withdrawing does not affect measurement that took place before. Vercel Analytics rests on our legitimate interest in knowing how many people use the site and which pages help them (Article 6(1)(f) GDPR); because it identifies no one and stores nothing on your device, it does not depend on the cookie notice.

Your answer is kept in your browser’s local storage for 12 months, after which we ask again. It is not a cookie and is never sent to us. Your display preferences — motion, text size and pointer — are kept the same way; they are needed for the settings you choose to work, and are never shared. The NEXT_LOCALE cookie remembers the language you chose and is deleted when you close your browser; it too is needed for the site to work and is never used for measurement.

The location map in the footer is embedded from Google Maps and may set Google’s own cookies when it loads.

Messaging on WhatsApp

We use WhatsApp to quote, to confirm collections and deliveries, and to answer questions about a piece on the bench. Our number is a WhatsApp Business number connected to our workshop system; you are not messaging a personal phone, and more than one member of the bench may read and answer you.

We message you first only where you have given us your number for that purpose — by sending a request through this site, by writing to us, or by handing in a piece. First messages of that kind use message templates approved in advance by Meta, as the platform requires.

You can stop them at any time by replying STOP, or by telling us in any other way you prefer. Asking us to stop messaging does not affect work already in progress, and we will still reach you about a piece we are holding for you — by telephone if you have asked us not to use WhatsApp.

Message content and media sent to us on WhatsApp are stored against your record in our workshop system and kept on the same terms as the rest of your item file, set out above. WhatsApp itself keeps messages according to its own policy, which we do not control.

We do not use WhatsApp for marketing lists, we do not add you to groups or broadcast lists, and we do not sell or share your number with anyone.

Your rights under Omani law

Personal data is handled with regard to the Sultanate of Oman’s Personal Data Protection Law (Royal Decree 6/2022). You may request access to, correction of, or deletion of your personal data.

You may also withdraw your consent to be contacted on WhatsApp or to Google Analytics (see “Cookies and analytics”), object to our use of your data, or ask for a copy of what we hold about you. We answer these requests at the address below and do not charge for them.

Data requests

For any request concerning your data, write to info@heroluxury.co or call +968 2465 2518.