Policies

Privacy Policy

Last updated November 8, 2026

At a glance

We do not sell personal data for money. We share limited data with Google (and, once we advertise there, Meta and Pinterest) to measure and show our ads; you can opt out in Your privacy choices, and we honour Global Privacy Control.
Card details are handled by our payment processor, never stored by us.
EU and UK visitors: analytics and marketing cookies are off until you accept.
Access or deletion requests: hello@zarbish.com.

Who is responsible

Zarbish is operated by Rekia Home LLC, 5830 E 2nd St, Ste 7000 #34693, Casper, WY 82609, USA. Data requests: hello@zarbish.com.

Data we collect

Name, email, address and phone, to process your order.
Payment information, processed by our payment processor. We do not store card data.
Browsing data from cookies. See Cookies below.
Chat messages, if you use Ask Zarbish. They are processed by our AI provider (Anthropic) to answer your questions and are not used for marketing.
Your email, if you type it into the chat: to email you a copy of the conversation when you ask, and to recognize you later. We write to it for marketing only with your yes (always in the EU, UK, Canada, Australia and UAE), and every such email has an unsubscribe link. Email hello@zarbish.com to have it deleted.
What you chose, if you share your email with us (in the newsletter, a form, the chat or a room preview): we may remember the rugs in your cart, the rugs you saved or looked at and the room previews you made, so our reminders show the right designs and your previews can be sent to you. We do this for reminders only with your yes (always in the EU, UK, Canada, Australia and UAE), and every such email has an unsubscribe link. Unsubscribing deletes what we remembered. Without your email, none of this leaves your browser. Email hello@zarbish.com to have it deleted.
Your room photo and room previews, if you use See it in your room. They are stored privately, never at a public link, and used only to make and show your previews. Signed in: saved to your account until you delete them, and deleted 12 months after you last opened them. Not signed in: they can join your account if you sign in on this device within 7 days, and are deleted after 30 days. Email hello@zarbish.com to have them deleted sooner.
Photos you send with a Custom Rugs request. They are stored privately and used only to design your rug; the workshop sees them through links that expire. They are kept with your request (see Retention). Email hello@zarbish.com to have them deleted.
Your conversations with Ask Zarbish, kept up to 12 months (legitimate interest: to answer you, pick the chat up later, and review and improve the assistant). We keep the messages with the pages you viewed and, if you give it, your name and email; never card numbers. Email hello@zarbish.com to have them deleted.
Messages you send us by chat, form or email may be handled through Telegram, a messaging tool our team uses to read and answer them.
Chat memory, if you allow functional cookies: a short summary of what you looked at (rugs, sizes, rooms, colors, your last open question), linked to a random id in a cookie. The summary never holds your email, address, phone number or order details. Turn off Functional cookies in Cookie settings to delete it, or email hello@zarbish.com and we will delete it.

How we use it

Process and fulfill orders.
Send order updates and tracking.
Email marketing, with your consent. Opt out anytime.
Improve the site.

Service providers

Supabase: our database (orders, accounts, chats, saved rugs and previews).
Cloudflare: hosting, content delivery and security for zarbish.com.
Resend: the emails we send you.
Slash: our payment processor, for card payments at our checkout. Slash is an independent controller for the payment data it handles, under its own privacy notice.
Shopify: checkout and order records, when your order is placed through Shopify.
Gorgias: our helpdesk, for the emails you send us.
Anthropic: the AI behind Ask Zarbish.
Google: Google Analytics 4, our site analytics, and Gemini, the AI that places the rug in your room photo when you use See it in your room.
Telegram: the messaging tool our team uses for order and production notifications and to read and answer the messages you send us.
Microsoft: Microsoft Clarity, heatmaps and session recordings.

DHL or FedEx receive your name, delivery address and phone number to deliver your rug.

Transfers outside Europe

Rekia Home LLC and most of these providers are in the United States. When personal data from the EU, the UK or Switzerland goes to a provider outside those regions, the transfer is covered by the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), set out in each provider's data processing terms.

Slash receives card payment data as an independent controller; that transfer is covered by the Standard Contractual Clauses for transfers between controllers.

Telegram is run by Telegram Messenger Inc., which is based outside the EEA. It is not covered by the clauses above:

it handles the messages our team receives under its own privacy policy (telegram.org/privacy), as the controller of its service.

Cloudflare, Google, Microsoft and Resend are also certified under the EU-U.S. Data Privacy Framework and its UK Extension. For a copy of these safeguards, email hello@zarbish.com.

Your rights by region

EU (GDPR): Lawful basis: contract performance and legitimate interest. Right to access, rectify, erase, restrict and port your data. We do not sell personal data.
UK (UK GDPR/PECR): Same rights as the EU; marketing requires opt-in.
US (CCPA/CPRA and similar state laws): We do not sell personal data for money. We 'share' limited data for cross-context ads: pages and products viewed, cart and checkout events, a random visitor id, and a hashed email when you gave it, sent to Google and, once used, Meta and Pinterest. You can opt out at any time with Your privacy choices at the bottom of every page, or by sending a Global Privacy Control signal, which we treat as an opt-out. Email opt-outs are honoured within 10 business days.
Canada (CASL): Marketing email requires express or implied consent. No cold lists.
Australia (Spam Act): Marketing requires consent; unsubscribe honored.
UAE (PDPL): Consent-based processing for marketing. No cold lists.

To make a request, email hello@zarbish.com.

Complaints

If you live in the EU or the UK and believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the data protection authority of your country (in the UK, the Information Commissioner's Office). You can also write to us first at hello@zarbish.com.

Retention

Order data: 7 years, for tax compliance.
Marketing data: Until you opt out.
Support and dispute records: As long as necessary to resolve claims (legitimate interest, chargeback and dispute defense).
Chat email: Kept until you ask us to delete it or unsubscribe.
Remembered cart, saved rugs and previews: Until you unsubscribe or ask us to delete them, and at most 12 months after your last visit.
Room photos and previews: In your account until you delete them, and at most 12 months after you last opened them; without an account, 30 days.
Custom Rugs photos: Kept with your request, as long as necessary to make and support your rug, or until you ask us to delete them.
Chat conversations: 12 months from the chat, or until you ask us to delete them.
Chat memory: A summary is deleted 12 months after your last visit, or at once when you turn off functional cookies or ask us to delete it.

Cookies

Essential: Checkout, cart and session. Always on.
Functional: The chat memory cookie (zb_vid, 12 months). EU and UK require consent.
Analytics: Google Analytics 4, and Microsoft Clarity (cookies _clck, 12 months, and _clsk, 1 day; Microsoft keeps recordings for 30 days and heatmap and click data for 9 months). Can be declined.
Our own measurement: A first-party cookie (zb_v, 60 days) and a record of what was viewed and clicked on our site, kept in our own database for 13 months to improve the site and test page layouts. It never holds your name, email or address. EU and UK: only with your consent to Analytics.
Marketing: Ads measurement and audiences with Google (and Meta and Pinterest once used), including hashed email lists. EU and UK require consent; elsewhere you can opt out in Your privacy choices or with Global Privacy Control.

Microsoft Clarity. We use Microsoft Clarity to see how visitors use our site, through heatmaps and session recordings. Form fields and personal details are hidden and never recorded. Microsoft processes this data under its privacy statement (privacy.microsoft.com). In the EEA, the UK and Switzerland, Clarity runs only after you accept analytics cookies.

EU and UK visitors see a consent choice on their first visit; non-essential cookies stay off until accepted. US visitors: functional, analytics and marketing are active unless opted out. Change your choice anytime from Cookie settings at the bottom of every page.