Privacy Policy

This policy explains what personal data Trove collects when you use troveathome.com, why, who it is shared with, how long it is kept and the rights you have. It is written to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the PDPL) and is in plain English on purpose.

1. Who is responsible for your data

Trove and Trove at Home are brand names of Serein Consultancy LLC, a limited liability company licensed by Sharjah Media City (Shams), licence no. 2220356.01. Serein Consultancy LLC is the controller of the personal data described here; in this policy, Trove, we and us mean that company. Its details are also on the About page. To ask anything about your data, or to use any of your rights, write to us through the Contact page and choose Privacy and my data.

2. What we collect

When you shop

Your name, email address and password (the password is stored only as a one-way hash, never in readable form). If you sign in with Google, we receive your name and email address from Google.
Your UAE mobile number, which the courier needs for every delivery.
Your delivery addresses.
Your orders: what you bought, prices, delivery and return history, and any return request, including the reason and photos you upload.
Payment: card payments are handled by Stripe. We receive a payment reference and the payment's status. Trove does not offer saved cards, and we never see or store your card number.
Reviews you write, and messages you send us through the contact form.
If you check out as a guest and you have, or later open, an account with the same email address, your guest orders are added to that account once the email address has been confirmed, so you can follow and return them there.

When you book a service

The name, email, mobile number, area and note you put in a booking request. The provider sees your name, area, date and note; your mobile number is released to them only once they confirm; your email address is never shared with the provider.

When you sell or offer services on Trove (makers and providers)

Your application: name, email, mobile or WhatsApp number, shop or practice details, links and what you make.
Your collection (pickup) address and phone, which we need before your shop is approved, shared only with the courier.
Your bank details (account name, bank and IBAN), used only to pay you. The IBAN is stored encrypted; everywhere else it is shown masked.
If you sell without a UAE trade licence: photos of the front and back of your Emirates ID, its last four digits, its expiry date and, if you give it, its issue date, and your home address. The ID photos are stored encrypted. All of it is seen only by Trove's administrator and used only to verify who you are and to meet Trove's legal obligations. The last four digits of your Emirates ID are printed on the purchase notes Trove issues you for each settlement. We use the expiry date to email you 30 days before your Emirates ID expires and to pause settlements while it has expired, until you upload the renewed card. If you have a trade licence, the licence number and the licence document you upload, kept in private storage that is never published and only Trove's administrator can open.
If you verify your identity with Didit instead of sending photos: Didit, our identity verification provider, asks you to scan your Emirates ID and take a live selfie, checks that the card is genuine and that your face matches its photo, and tells Trove the result. Trove keeps only that result: the name printed on your ID, its last four digits, its issue and expiry dates, whether each check passed, and the reasons a check did not pass. Trove does not download or store your ID images or your selfie, and does not store your full ID number or your date of birth. Didit processes the images and face data for Trove under its own Verification Privacy Notice, and you agree to the check on Trove's page before it starts. We use the expiry date in the same way as for photos sent to us.

When you browse

A session cookie that keeps you signed in and your checkout secure. It is essential; the site cannot work without it.
Your basket, kept in your own browser (local storage) so it survives a refresh.
An anonymous visitor id, a random code kept in your browser's local storage, only if you agree to measurement cookies. When you open a shop or a piece, or add a piece to your basket, we record that action with this id so makers can see how their shop is doing, in totals only. Until you agree, no id is stored or sent; if you refuse, or later withdraw your agreement, the id is deleted from your browser. The id is not linked to your name or account, it is removed from our records after 90 days, and the records themselves are deleted after a year.
The words you search for, stored without any link to you for 90 days, to improve search results.
Standard server logs (such as IP address and browser type), kept briefly for security and to keep the site running.
Your cookie choice. On your first visit a banner asks whether you agree to measurement cookies. Nothing optional runs until you say yes, wherever you are, and you can change your mind any time with Cookie settings at the bottom of every page. The choice is recorded by iubenda (our consent tool) in a cookie in your browser and kept for 180 days, with a record of the choice kept as proof of consent.
Google Analytics, through Google Tag Manager, a script from Google that our pages load. It runs only if you agree to measurement cookies: until then it sets no cookies, stores nothing in your browser and sends nothing to Google Analytics. Like any file your browser fetches, loading Tag Manager shares your IP address and browser details with Google. Tag Manager and Google Analytics are not loaded at all on your account pages, the maker and provider dashboards, the admin panel or private links (such as a password reset or a booking link).

We do not use advertising or marketing cookies. If we ever add any, we will update this policy first and they will run only if you agree to them. We do not sell your personal data.

3. Why we use it (and our legal basis)

To sell you what you order and deliver it: processing your order, taking payment, booking the courier, handling returns and refunds, and sending order and return emails. This is necessary to perform our contract with you.
To pay makers and providers and verify who they are: necessary for our contract with them and to meet legal obligations. A Didit check uses your face, so for it we rely on your explicit consent, given on Trove's page before the check starts; if you do not want it, you can send photos of your Emirates ID instead.
To keep Trove safe: preventing fraud and abuse, rate-limiting, and keeping backups. This is in our legitimate interest and yours.
To meet legal obligations: keeping accounting, tax and commercial records, and responding to lawful requests from UAE authorities.
To improve Trove: anonymous search statistics, and shop statistics only where you have agreed to measurement cookies (your consent).
We will ask for your consent before using your data for anything else, such as marketing emails, and you can withdraw consent at any time.

We share only what each service needs, under contracts that require them to protect it and use it only to provide their service to Trove:

Stripe (card payments and refunds).
OTO, the courier platform that books our deliveries, and the courier companies it assigns (your name, mobile number and delivery address for your parcel; a maker's collection address and phone). If OTO is unavailable we may use Quiqup in the same way.
Resend (sending our transactional emails, such as receipts).
Didit (identity verification, only for makers who choose it): the images of your Emirates ID, your live selfie and the face data needed to compare them, which you give to Didit directly in its secure check. Didit tells Trove the result described in section 2.
Render (the hosting provider whose servers run troveathome.com and hold its database and backups).
Google (if you choose "Sign in with Google"; the site's fonts are loaded from Google Fonts and our public pages load Google Tag Manager, both of which receive your IP address; Google Analytics receives nothing unless you agree to measurement cookies).
iubenda (our cookie banner: it shows the banner, records your cookie choice and passes it to Google's consent settings).
Anthropic (only for makers who use the optional AI tag-writer: the product name, description, category and shop name are sent to suggest search tags. No buyer data is sent.)
Our bank, which carries out the transfers that pay makers and providers (the account holder's name, IBAN, the amount and a reference). Provider fees are paid by bank transfer from Serein Consultancy LLC, the company that runs Trove, so that name appears on a provider's statement.
Makers and providers see only what they need: a maker sees the pieces ordered from their shop and the name on the order, and sees your full delivery address only for a parcel the maker delivers by hand, and only until that order's return window closes; a maker never sees your email address or mobile number. A provider sees what is described in section 2.
Authorities, where UAE law requires it.

Some of these services are based outside the UAE, so your data may be processed in other countries (for example the United States or the European Union). Where that happens, we rely on the safeguards the PDPL allows, including contractual protections with each provider.

5. How long we keep it

Account data (name, email, mobile, password, addresses): while your account is open. When you ask us to close it, we close and anonymise it as described below.
Orders, payments, refunds and settlements: at least five years, as UAE tax and commercial record-keeping rules require. If you close your account, these records are kept without your name, email address, mobile number or delivery address.
Return request photos: one year after the return is closed (refunded or declined), then deleted automatically. The record of the return and its refund is kept with the order.
Emirates ID photos, Emirates ID digits and dates, the result of a Didit check, home address and licence document (makers): while you sell on Trove, and for five years after your shop is closed, then deleted automatically. We can delete them sooner on request where no law requires us to keep them. Didit keeps the images it captured as its Verification Privacy Notice describes.
Bank details (IBAN): while you sell or provide services on Trove. They are deleted when your account is closed; the masked number and bank name stay on past settlement records.
Contact form messages: two years from when they were sent, then deleted automatically.
The words you search for: 90 days.
Anonymous visitor ids: 90 days; the anonymous event records: one year.
Backups: rolling nightly copies, each kept for seven days, so anything deleted also leaves our backups within seven days.

Closing your account. When you ask us to close your account, we first make sure nothing is still in progress (an order not yet delivered or still inside its return window, an open return, an upcoming booking, or money still owed to or by a maker or provider); we will tell you if something needs to finish first. Then we:

replace your name, email address and mobile number with a placeholder and make the account impossible to sign in to, and sign it out everywhere;
delete your saved addresses, the reviews you wrote and your contact form messages;
remove your name, email address, mobile number and delivery address from your past orders and bookings, any personalisation text and the details and photos of your return requests, keeping only the amounts, dates and pieces that the record-keeping rules above require; and
for makers and providers, take the shop or practice off Trove, delete the application details, collection address and phone, and bank details, and keep identity documents only for the period stated above.

6. How we protect it

Connections to troveathome.com are encrypted (HTTPS). Passwords are hashed. Bank account numbers (IBANs) and Emirates ID images are encrypted at rest. Licence documents are kept in private storage that is never published. Only Trove's administrator can see any of them, and signing in to the administrator account needs a one-time code sent by email as well as the password. Access to the database is limited to the people who run Trove. No system is perfectly secure, but we work to protect your data and will tell you and the authorities about a breach where the law requires.

7. Your rights

Under the PDPL you have the right to:

know what personal data we hold about you and get a copy;
have it corrected if it is wrong or incomplete;
have it erased, where we no longer need it or have no legal reason to keep it;
restrict or object to how we use it in some cases;
receive it in a structured, machine-readable form (portability); and
withdraw consent where we rely on it.

To use any of these rights, write to us through the Contact page and choose Privacy and my data. We may need to confirm who you are first (usually by replying from the email address on your account). We will reply within 30 days. A copy of your data is sent as a structured, machine-readable file (JSON) covering your account, addresses, orders, returns, reviews, bookings and messages, and, for makers and providers, your shop or practice details. An erasure request is carried out by closing and anonymising your account as described in section 5. If you are not satisfied with our answer, you can complain to the UAE Data Office.

8. Children

Trove is for adults. You must be 18 or over to open an account or place an order; the Terms of Sale say the same. We do not knowingly collect data from children.

9. Changes

We may update this policy. We will show the date of the latest version at the top, and tell you by email about any change that significantly affects how we use your data.

10. Contact

Questions about this policy or your data: use the Contact page and choose Privacy and my data.