Studio by Toth

Privacy policy

This policy explains how we handle your personal data when you browse the site, design your journal or order it. It is written under the Saudi Personal Data Protection Law and its regulations. The Arabic text is the binding one.

Who we are

The controller of your data is استوديو توته, the business behind the Studio by Toth shop, freelance licence FL-982043012, Riyadh, Saudi Arabia.

For any question or request about your data, email hello@studiobytoth.com or message us on WhatsApp at +966 56 464 9072.

What we collect

  • Name, mobile and email: at checkout; all three are required.
  • Your order's WhatsApp messages: from the shop's number to the mobile on your order, a message when we confirm your order, when we start making it and when we ship it, with the order number, the link to its page and its status. We record that each one was sent.
  • Sign-in code: a one-time code sent to your mobile by text message when you sign in to your account, or when we check your number at checkout.
  • National Address short code: at checkout, with the address it points to: building number, street, district, city, postal code and map location.
  • Gift details: if the order is a gift, the recipient's name and their mobile if you give it, the card message, and your name if you choose to sign it.
  • Your journal's design: when you share its link or order it, the format, colour, options, embossed name and a preview picture.
  • Discount code: if you use one, with the mobile number it was used with.
  • Payment status: the result of the payment and its reference at the payment provider. We never see or store your card details.
  • Email confirmation: if you tap the confirmation link in your order email.
  • Account data: if you sign in, your mobile number, your email if we have checked it with a code, the site language, when you last signed in, and the orders linked to your account.
  • Launch-notice request: if you ask for one, your name, your email or WhatsApp number, and your design's link.
  • Your messages to us: what you write to us by email or WhatsApp.
  • Page performance measurements: loading and response speed while you browse, with no IP address and nothing that identifies you.
  • How you browse the site: a recording of pointer, touch, scrolling and clicks on the site's pages, collected by Microsoft Clarity, with everything you type and all your personal details hidden before it leaves your device.

Name, mobile, email and the National Address short code are needed to complete and deliver your order; everything else is your choice. We do not ask for sensitive data, your ID number or a password.

If you give us a gift recipient's details, make sure they are happy for us to use them to deliver the gift. We never send them any message of our own; the carrier may call them to hand over the parcel.

Why we collect it, and on what basis

  • To fulfil your order: making, packing and shipping your journal, issuing the receipt, emailing you to confirm and ship it and about any refund or cancellation, messaging you on WhatsApp when it is confirmed, made and shipped, and answering your questions. Basis: performing our contract with you. These WhatsApp messages are about your order only; you can stop them at any time, and email still brings you every update.
  • To sign you in to your account: we send a one-time code to your mobile, and the account shows the orders you placed with the same number in the last twelve months. Basis: providing the service you asked for.
  • To meet our legal duties: keeping accounting and tax records, and answering requests from the competent authorities. Basis: a legal obligation.
  • To run the site safely: spotting faults, limiting suspicious repeated requests, and preventing fraud and abuse. Basis: our legitimate interest, never at the cost of your rights.
  • To improve the site: we watch browsing recordings and click maps to see where visitors get stuck, and fix it. Basis: our legitimate interest in improving the site, never at the cost of your rights; a recording carries no name, mobile, email, address or anything you type.
  • To tell you when the shop opens: one message, by email or WhatsApp, only if you ask for it and agree. Basis: your consent, which is never a condition of any order and which you can withdraw at any time.

We do not sell or rent your data, we never send you marketing without your consent, and we make no automated decisions about you that affect you.

Who we share it with

We share your data only with those needed to fulfil your order and run the site, all of whom process it on our behalf, on our instructions and under the data protection terms they are bound by:

  • Supabase: our database, and signing you in to your account, in the United Kingdom (London).
  • Cloudflare: hosting and protecting the site, storing pictures, sending email, and delivering your messages to our inbox, on a worldwide server network run by a US company.
  • StreamPay: payment processing in Saudi Arabia; it receives your mobile number, email and language, and takes your card details directly from you.
  • Authentica: sending your sign-in code to your mobile by text message, in Saudi Arabia.
  • National Address service (SPL): checking your National Address short code and completing the address, in Saudi Arabia; we send it the short code and nothing else.
  • Microsoft Clarity: browsing recordings and click maps, run by Microsoft, a US company. Everything you type is hidden, and nothing from the checkout, your order and account pages or signing in appears in it, nor the embossed name or the gift details.
  • The carrier: delivering the parcel inside Saudi Arabia; it receives only the name, mobile and address printed on its label.
  • WhatsApp (Meta Platforms): delivering your order messages to your mobile. We send them from the shop's number through a gateway we run on our own server, and they then travel through WhatsApp, a Meta service, which receives your mobile number and the message text, including the order number, the link to its page and its status, and processes them on its servers outside the Kingdom.

StreamPay may also write to you itself about the payment. If you message us on WhatsApp, your message travels through WhatsApp, a Meta service, and is subject to its policy.

We may also disclose data when a competent government authority requires it of us under the law.

Transfers outside the Kingdom

Our database is with Supabase in London, Cloudflare works through a worldwide server network, browsing recordings are kept by Microsoft Clarity in the United States, and WhatsApp messages travel through Meta's servers outside the Kingdom, so your data leaves the Kingdom for these purposes. We transfer it under the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, only as far as the purpose needs, and only to providers contractually bound to protect it. Payment, sign-in codes by text message, address checks and shipping are processed inside the Kingdom.

How long we keep it

  • Shared design links: 180 days, then deleted, unless tied to an order or a request to hear when the shop opens.
  • Preview pictures not tied to an order: one day.
  • Requests to hear when the shop opens: 12 months, then deleted.
  • Orders never paid: closed after 40 minutes without payment, deleted after 90 days.
  • Paid orders and their receipts: the period the law requires for accounting and tax records.
  • Account data: as long as your account exists, or until you ask us to delete it.
  • Sign-in codes: we do not keep them; the sign-in service keeps a code until it is used or expires.
  • Your messages to us: as long as we need them to answer you and follow up your order.
  • Order message log: we record which emails and WhatsApp messages we sent about each order and when, without your email, number or the message text, for as long as the order is kept. The WhatsApp chat on the shop's number is kept, like your messages to us, as long as we need it to follow up your order.
  • Browsing recordings: 30 days, then Microsoft Clarity deletes them, except a recording we keep to look into a fault, which stays for up to 13 months.

When a paid order's retention period ends, we erase what identifies you in it: name, contact details, address, gift details and the embossed name. Only the amounts and the accounting records remain.

What is kept on your device

Cookies

We use those the site needs to work:

  • sbt_order opens your order page on this device, for 30 days.
  • sbt_email_link carries the confirmation link from your email to the confirm button, for one hour.
  • sbt_at and sbt_rt keep your account session after you sign in with your mobile code, for 90 days, renewed while you use the site, or until you sign out.
  • sbt_in is a marker holding only the number 1, which tells the page you are signed in so it can show that at the top, for 90 days, renewed while you use the site, or until you sign out.

Microsoft Clarity sets two for browsing measurement:

  • _clck links your visits on this device together, without knowing who you are, for one year.
  • _clsk groups the pages of one visit into a single recording, for one day.

Storage in your browser

  • The draft of your journal's design, so you find it when you come back. It stays until you start a new design or clear the site's data in your browser.
  • The journals you put in your cart, for up to 150 days.
  • When the site last renewed your account session, so it does so at most once a day. It stays until you clear the site's data in your browser.
  • The code we send Microsoft Clarity once you sign in or order (see Tracking tools), until you sign out or clear the site's data in your browser.
  • The checkout step you reached, for 30 minutes, without your mobile, email or address.
  • The discount code you opened the site with, and any announcement you closed, in this tab only until you close it.

The draft and the cart may include the name you chose to emboss. They stay in your browser and reach us only when you share or order your design.

Tracking tools

We use Microsoft Clarity for browsing recordings and click maps, and no advertising tool that tracks you. Clarity records how you move around the site's pages and where you tap, and before the recording leaves your device it hides everything you type, the checkout, your order and account pages, signing in, the embossed name and the gift details. We never send it your name, mobile or email. Once you sign in or order, we send it a code made from your mobile with a secret key of ours, which cannot be turned back into your number, so that your visits on different devices count as one visitor and we can find them if you report a problem. We measure page performance ourselves, without cookies and without your IP address. We also count, as daily totals, how many visits reach each step from the first page to checkout, with no cookies, no IP address, and nothing that links a count to you. Our hosting provider sees the IP address of every connection, as with any website; we use it in the moment to limit repeated requests and do not keep it. If we ever add advertising measurement, it will only run after your explicit consent, and we will update this policy first.

How we protect it

  • No passwords: you sign in to your account with a one-time code sent to your mobile.
  • The connection to the site is always encrypted.
  • Your account and order session cookies cannot be read by scripts on the page, and are sent only over an encrypted connection.
  • Your order page opens through a secret link sent only to you.
  • Only our team can enter the shop's admin, each person with their own account and permissions for their role, behind an extra layer of verification.
  • Card details are entered directly into the payment provider's form and never pass through our servers.
  • Our technical logs carry no name, mobile, email, address or embossing text.

If a breach affects your data, we notify the Saudi Data and AI Authority (SDAIA) within 72 hours of learning of it, and we tell you without delay if it is likely to harm you.

Your rights

The law gives you the right to:

  • Know how and why we collect your data, which is what this policy explains.
  • Access the data we hold about you, and get a copy of it in a clear, readable format.
  • Correct anything inaccurate, complete it or bring it up to date.
  • Ask us to destroy your data once it is no longer needed, except what the law requires us to keep.
  • Withdraw your consent to anything we based on it, at any time, without affecting what came before.

Your account page does not yet let you edit or delete your data yourself, so to use any of these rights, email us or message us on WhatsApp, giving your order number if you have one, ideally from the email or number on the order. We may ask for proof that the data is yours before we show or change it. We reply within 30 days; if we need longer, we tell you why, and never more than 30 days more. To cancel a request to hear when the shop opens, just tell us.

To stop your order's WhatsApp messages, email us or message us on WhatsApp, and we will stop them for your number within a reasonable time; email still brings you every update about your order.

If you are not satisfied with our answer, you can complain to the Saudi Data and AI Authority (SDAIA).

Children

Ordering from the site is for people aged 18 or over; anyone younger should ask a parent or guardian to order for them. We do not knowingly collect data from anyone under 18, and if you learn that a child has sent us their data, write to us and we will delete it. If a gift is for a child, we use their name and number only to deliver it.

Changes to this policy

We may update this policy when something about how we work changes. We publish the updated text here and change the date below, and if a change is significant we tell you through the contact details we hold, and ask for your consent again if it affects anything based on your consent.

Contact us

  • Email: hello@studiobytoth.com
  • WhatsApp: +966 56 464 9072
  • City: Riyadh, Saudi Arabia

Last updated: 4 October 2026