Privacy Policy

1. Information We Collect

At ROSH Atelier, we collect personal data that you share directly with us, including:

• Account Profile Data: Full Name, Email Address, Phone Number, Shipping Address, Gender, Birthday, Bio, and custom profile avatar images.
• Authentication Details: Email addresses and temporary transient cryptographic verification payloads/tokens.
• Purchase and Checkout Data: Cart contents, coupon codes applied, purchase amounts, order status, and billing details.
• Communications: Messages sent to customer support, inquiries via concierge channels, and chatbot interactions.

2. How We Use and Process Your Information

We process customer data for the following legitimate purposes:

• Creating and maintaining your secure customer profile.
• Verifying your identity during registration, password resets, and session reactivations using the Resend OTP system.
• Processing, packing, shipping, and delivering orders, as well as handling returns or refunds.
• Applying promotional discounts and verifying database coupon constraints.
• Analyzing store activity, handling diagnostics, maintaining site security, and preventing fraudulent behaviors or double-coupon abuse.

3. Database Records and Data Security

All user and order data is securely stored in our backend databases (SQLite or MongoDB). To ensure high security:

• Password Security: Passwords are never stored in plain text. They are securely hashed and salted using standard bcrypt algorithms before being committed to the database.
• Transient OTP Storage: OTP codes are stored temporarily in a verification database table and automatically expire and delete after 10 minutes.
• Asset Processing: Profile avatar pictures are uploaded to the filesystem, processed using the Sharp graphics library for standard optimization (WebP), and indexed in the database.

4. Cookies and Session Management

We use cookies and browser local storage to provide a seamless, secure shopping experience:

• Authentication Cookie (connect.sid): A secure, HTTP-only session cookie is set in your browser upon sign-in. This cookie identifies your session and automatically expires after 14 days of inactivity.
• Storefront Session Reactivation: If your session cookie expires or you remain inactive for over 14 days, you must re-verify your identity with a 6-digit OTP code to reactivate your session.
• Local Storage: We use browser storage to temporarily persist cart contents, wishlists, and user interface preferences (such as light/dark mode configurations).

5. Data Sharing and Third-Party Disclosures

We do not sell, rent, or trade your personal information. Data is shared with trusted third parties only to provide our services:

• Email Services: Transactional emails, announcements, newsletters, and OTP verifications are routed via Resend API.
• Shipping & Delivery: Delivery addresses and phone numbers are shared with logistics partners to fulfill shipments.
• Legal Compliance: We may share data when required to comply with law enforcement requests, regulatory investigations, or to protect our legal rights.

6. Your Rights and Data Deletion

You have full control over your data. Within your customer dashboard, you can review and update account details or upload a new profile picture. If you wish to permanently delete your account, wipe all database records associated with your identity, or request a portable copy of your order history, please contact us at support@roshbrand.com.

7. Dynamic Policy Maintenance

The administrators of ROSH Atelier can modify this Privacy Policy dynamically via the Admin Dashboard. Any changes to data collection or processing rules will reflect storefront-wide immediately upon saving. We suggest reviewing this page periodically for updates.

8. Contact Information

For questions regarding this policy, data practices, or security disclosures, please reach out to ROSH Concierge at support@roshbrand.com.