Privacy Policy

Pavia is an online fashion boutique based in Beirut, Lebanon. We sell womenswear at pavialeb.com and deliver across Lebanon.

This policy covers the website and the ordering that happens on it. It does not cover a conversation you have with us on WhatsApp or Instagram, which those platforms carry under their own policies.

Reach us on WhatsApp on +961 3 017 725 or on Instagram at @pavia.leb to ask what we hold, to correct it or to have it deleted.

Nothing until you place an order. The checkout asks for:

• Your full name, so the courier knows who to hand the parcel to.
• Your phone number, so we can confirm the order and tell you when it is out for delivery. It is also the number a courier calls at the door.
• Your city or area and your full address, so it arrives.
• Delivery notes, if you write any. A size note, a best time, a building detail. Only what you put there.
• Your payment method, meaning which of cash on delivery or Whish Money you picked. No card number, no account number and no wallet identifier is asked for or stored.

Alongside those we keep the order: the pieces, the sizes, the quantities, the prices, the delivery fee, the total, the order number and the date.

The storefront works in your browser, so several things live there rather than with us. All of them are readable only by pavialeb.com, and clearing your browsing data removes every one:

• Your cart and your wishlist. Without these the cart empties every time you open a product.
• Recently viewed. The last few pieces you opened, so the row on the home page has something in it.
• Your own past orders. A copy kept on your device so you can see what you ordered without an account.
• A pending order marker. Written while an order is being placed and cleared when it is confirmed. It is what stops a dropped connection turning one order into two.
• A cached copy of the catalogue, so a second visit paints before the database answers.
• An anonymous sign in. Firebase gives your browser an identifier with no name or email attached, which is what lets it write its own order and read nothing of anybody else's.
• The preview password flag, while the site is behind its launch gate.

• Google Fonts. The two typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com, so Google receives your network address and the fact that a page here was opened. No cookie is set by the font request. If that matters to you, a content blocker that stops Google Fonts leaves the site readable in your system typefaces.
• imgbb (i.ibb.co). Product photographs are served from imgbb rather than from our own domain, so imgbb receives your network address when a photograph loads. It is used because it is reachable from Lebanon without a card on file, not for anything to do with tracking.
• Firebase, which is Google Cloud. The catalogue and the orders sit in a Firebase Realtime Database in Europe, and Firebase Authentication issues the anonymous identifier described above. Google acts as our processor here: it stores what we put there and does not use it for anything of its own.

Nothing else is loaded from anywhere else. There is no Google Analytics, no Meta pixel, no TikTok pixel and no session recorder on this site.

The site's content security policy allows Cloudflare's Web Analytics beacon, which is cookieless: it counts page views without setting anything on your device and without following you to another site.

It is a count of pages, not of people. There is nothing in it that could be tied back to your order.

Inside Pavia, whoever packs the order and whoever answers the phone.

A courier is given your name, your phone number and your address, because that is what a delivery needs. Nothing else about the order travels with it.

Nobody else. We do not pass details to a marketing agency, an advertiser, or another shop.

An order stays with us while it is being prepared and delivered, through any return, and afterwards as the record of a sale.

Ask us to delete an order and we will, unless a return is still open on it. Message us with the order number.

What sits in your own browser is yours: clear your browsing data and it is gone, and nothing of it was ever sent to us except the order you placed.

You can ask us at any time to:

• tell you what we hold about you and send you a copy,
• correct anything wrong in it,
• delete it, where no open order depends on it,
• stop using it for something you object to.

Lebanon's Law 81 of 2018 on electronic transactions and personal data gives you these rights here, and the GDPR gives you the same ones if you are ordering from Europe. Asking costs nothing and we do not ask why.

Pavia is not aimed at children and we do not knowingly take an order from one. If a child has sent us details, message us and we will remove them.

The site is served over HTTPS, and the database rules refuse any write that does not match the shape of a real order, which is what stops an order being altered from outside. The admin side is behind a password we alone hold and its dashboard ships encrypted.

If something goes wrong with data we hold about you, we will tell the people affected rather than hope nobody notices.

If this policy changes, the date at the top changes with it, and the version number in the storefront's footer tells you which build you are reading.