Privacy Policy

1. Information we collect

COREXAU collects only the information needed to operate the catalogue, process orders, and maintain account access. This includes:

• Account information (name, email address, hashed password)
• Order details (cart contents, totals, payment method, order status)
• Payment references (transaction hash for crypto, bank reference for transfer)
• Optional uploaded payment screenshots, stored in a private bucket
• Technical logs (timestamps, IP address, user agent) used to operate and secure the service

2. How we use information

• Verify and fulfil your orders
• Communicate order status updates and tracking information
• Maintain the security and integrity of the catalogue
• Comply with applicable record-keeping obligations

We do not sell your personal information and we do not use it for third-party marketing.

3. Storage and security

Account and order data is stored on managed cloud infrastructure with row-level access controls. Customers can only view their own orders; only authorised administrators can view aggregated order data, payment proofs, and internal notes. Payment screenshots are kept in a private bucket and accessed via short-lived signed URLs.

4. Sharing with third parties

We share data only with:

• Our hosting and database providers, strictly to operate the service
• Shipping carriers, limited to the information required to dispatch your order
• Email delivery providers, limited to addressing transactional notifications
• Authorities, where compelled by valid legal process

5. Cookies and analytics

We use the minimum cookies required to keep you signed in and to remember your cart. We do not run third-party advertising trackers.

6. Your rights

You may request access to, correction of, or deletion of your personal information by contacting the COREXAU operations team. Some records may be retained where we are required to keep them for compliance purposes (for example, order and payment records).

7. Data retention

Account and order records are retained for the period required to operate the service and meet record-keeping obligations. Inactive accounts may be removed on request.

8. Children

The catalogue is not directed to anyone under the age of 18. We do not knowingly collect information from children.

9. Updates to this policy

We may update this policy from time to time. The version published on this page is the current version.