Privacy Policy

1. Introduction

iruali ("we", "us", "our") operates the iruali online store. This Privacy Policy explains how we collect, use and protect your personal information when you use our website and services.

2. Information we collect

• Name, email address and mobile number: to create your account, sign you in and contact you about your orders.
• Password: stored only in hashed (scrambled) form; we cannot read it.
• Google, Facebook or Apple sign-in: if you choose to sign in with one of them, we receive your name, email address and an account ID from it, and nothing else (no posts, contacts or passwords). You can disconnect it in My Account.
• Delivery address and island: to deliver your orders.
• Your location, only if you press "Use my location": your browser's position is used once to find the nearest island. We keep the island, not the position.
• Date of birth, if you add it in My Account: for a birthday offer. It is optional.
• Business details, if you buy for a business: the business name, address and GST (TIN) number, for tax invoices.
• Order history: to show your orders, give loyalty points and handle returns.
• Payment information: the payment method, amount, and the transaction reference and status sent to us by Bank of Maldives. We never receive or store your card number, expiry date or security code.
• Reviews and questions you post, with your name.
• Messages, complaints and feedback: what you write to us through the website, return requests with their photos, and how you rate an order.
• Wallet and gift cards: your credit balance and its history, and for a gift card you send, the recipient's name, email address and your message.
• Push notifications, if you allow them: a code from your browser that lets us send order updates to it.
• Partner businesses that supply products: business name, contact person, island, bank account, the details they gave us, when they agreed to our terms (with the IP address and browser used), and, for business verification, the business registration and the owner's ID card number and photo. These documents are kept outside the public website and seen only by our administrators.
• Technical information: IP address, browser type and pages visited, in our server logs.

3. How we use your information

• Process, deliver and support your orders, cancellations, returns and refunds
• Send one-time codes for secure sign-in and two-step verification
• Send order confirmations, delivery updates and receipts by email, SMS or push notification
• Run loyalty points, referrals, gift cards, your wallet, wishlist, cart and saved items, and a birthday offer if you gave your date of birth
• Provide customer support and prevent fraud
• Send our newsletter and offers, only if you subscribed
• Improve our website and meet legal and accounting obligations

4. SMS and email communications

By giving us your mobile number and email address, you agree to receive:

• one-time verification codes (needed to verify and secure your account);
• order confirmations, status updates and receipts;
• our newsletter and offers, only if you subscribed.

Opt out: to stop the newsletter or offers, use the unsubscribe link in any newsletter or contact us using the details above. Order and security messages are part of the service and continue while you have an account.

5. Card payment security

All card payments are processed exclusively on Bank of Maldives' (BML) secure payment page. iruali does not store, view, process or retain any card details (card number, CVV, expiry) on its servers. Card data is handled entirely by BML using SSL/TLS encryption. See Payment Security.

We strongly recommend you keep a copy of your order confirmation and payment receipt for your records.

6. Data security

We use industry-standard measures to protect your personal data against unauthorised access:

• encrypted data transmission (HTTPS / TLS) on every page;
• hashed passwords and optional two-step sign-in;
• role-based access for staff and partners; each partner sees only the orders it handles;
• photos you add to a return request stored outside the public website, shown only to you and the people handling your return;
• every payment result checked directly with Bank of Maldives, never trusted from the browser;
• regular reviews of access and security.

7. Data sharing

We do not sell or rent your personal information. We share it only with:

• The partner business that prepares your order, where there is one: your name, phone, delivery address and what you ordered, to prepare and deliver it;
• Bank of Maldives (BML): to process card payments and refunds;
• Delivery partners: your name, phone and address for delivery;
• Our SMS and email providers: your phone number or email address, only to deliver messages;
• Our team's alerts: short notices to a private group of iruali staff on Telegram (for example a new order's number and amount, or the name on a new complaint), so we can act quickly;
• Google, Facebook or Apple, only if you choose to sign in with them;
• Authorities: when required by Maldivian law.

Product videos are hosted by YouTube, TikTok, Instagram or Facebook. Nothing is loaded from them until you press play on a video; the video site then receives your IP address and browser details under its own privacy policy.

8. Cookies

We use the cookies needed for the website to work: keeping you signed in, your cart, your language, your island, and items you recently viewed or are comparing.

We do not use advertising cookies.

9. Data retention

Order and payment records, tax invoices and the terms our partners agreed to are kept for at least 5 years to meet accounting, tax and legal rules. Other information is kept while your account is open. If you ask us to delete your account, we delete or anonymise your information except records we must keep by law.

10. Your rights

• Access your personal data (see My Account)
• Request correction or deletion of your data
• Opt out of the newsletter, offers and push notifications, and remove your date of birth in My Account

11. Contact

For any privacy question or request, use the contact details at the top of this page or on About & Contact. We may update this policy; the latest version is always on this page.