Privacy Policy

Last updated: 20 October 2026

This policy explains what personal information Khuri Pharm Ltd ("we", "us") collects when you use this website, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. We are the party responsible for your information (the "database owner" under the Israeli Privacy Protection Law, 1981, and the "controller" under the EU GDPR where it applies).

1. What we collect

Information you give us

• Account: first and last name, email address, password and, if you choose to add it, a phone number. Your password goes straight to our login provider (Supabase) and is stored there in hashed form — we never see or keep it.
• Sign-in with Google (optional): your name and email address from your Google account.
• Orders: name, email, phone number and delivery address, the items you buy, prices, any discount code, and any note you add to the order.
• Saved addresses, wishlist and cart.
• Reviews: your star rating, your review text and your first name, which are published on the product page together with a "Verified purchase" label if you bought the item from us.
• Newsletter (optional): your email address, preferred language, and when you subscribed, confirmed or unsubscribed.
• Requests and messages: anything you send us, including cancellation, return and data-deletion requests.
• Records of your consent: when you accepted our Terms, confirmed you are 18 or older, or agreed to marketing emails, and which version of our documents was in force.

Payment details

You pay on the secure payment page of our payment provider, PayPlus. Your card details are entered there and never reach our servers. We only receive the payment status, a transaction reference and the approval number.

Information collected automatically

• Essential cookies: a session cookie that keeps you signed in, remembers your language and protects our forms, plus a cookie that remembers your cookie choices. See our Cookie Policy.
• Server logs: our hosting provider records technical data such as IP address, browser type, the page requested and the time, to deliver the site and keep it secure.
• Performance measurement — only if you allow it: Vercel Speed Insights records how quickly pages load (page address, device type, browser, connection speed and approximate country). It sets no cookies and is not used for advertising.

We do not use advertising cookies, tracking pixels or cross-site tracking, and we do not sell or rent personal information.

2. Why we use it

You are not legally required to give us your information, but without your name, email and delivery details we cannot create an account or deliver an order. Your phone number is optional for an account but is needed at checkout so the courier can reach you. The newsletter is always optional.

3. Who we share it with

We share information only with the service providers that run the store for us, and only what each one needs:

• Supabase — our database and login service (stores your account and order data).
• Vercel — hosts the website, and processes server logs and, with your consent, Speed Insights data.
• PayPlus — processes your payment.
• Our email provider — delivers order confirmations, shipping notices, account emails and, if you subscribe, the newsletter.
• Telegram (and WhatsApp, if enabled) — sends the store owner an alert about each new order. The alert contains only the order number, items, totals, the customer's first name and city — not your email, phone or full address.
• Our courier — your name, phone number and delivery address, to deliver your order.
• Google — only if you choose "Continue with Google", or allow the embedded Google Map in your cookie settings.
• Authorities and advisers — our accountant and the tax authorities, or others where the law requires it.

Some of these providers store data outside Israel (for example in the European Union or the United States). We only use providers that commit to protecting it, as required by the Privacy Protection (Transfer of Data to Databases Abroad) Regulations.

4. How long we keep it

• Account information — while your account exists. After a verified deletion request we erase it within 30 days.
• Orders and invoices — at least 7 years, because Israeli tax and accounting law requires it, even if you delete your account. They are disconnected from your deleted account.
• Newsletter — until you unsubscribe. We then keep only your email address and the date you unsubscribed, so that we never email you again.
• Consent records — as long as the account or subscription they relate to; they are anonymised when you delete your account.
• Deletion and cancellation requests — up to 3 years, to show how we handled them.
• Cookies — the session cookie for up to 7 days; your cookie choices for 180 days.
• Server logs — for the short period set by our hosting provider.

5. Your rights and choices

• See your information (Privacy Protection Law, section 13) — much of it is on your profile and orders pages; for a full copy, email us.
• Correct it (section 14) — edit your details on your profile page, or ask us.
• Delete it — use "Delete my account and data" on your profile page, or email us. We confirm by email and complete the request within 30 days, apart from records the law requires us to keep.
• Stop marketing (section 17F) — every newsletter has an unsubscribe link, and you can unsubscribe from your profile page. Unsubscribing never affects order emails.
• Change cookie choices — at any time via "Cookie settings" at the bottom of every page.
• Visitors in the EU/EEA or UK also have the rights to data portability, to restrict or object to processing, and to withdraw consent at any time.

We answer requests within 30 days and may ask you to confirm your identity first. If you are unhappy with how we handle your information, you can complain to the Israeli Privacy Protection Authority (gov.il) or, in the EU/EEA, your local data-protection authority.

6. Children

This store is for adults. You must be 18 or older to create an account or place an order, and we ask you to confirm this when you sign up and at checkout. We do not knowingly collect information from anyone under 18 and we do not ask for dates of birth. If you believe a child has given us information, contact us and we will delete it.

7. Security

We use encrypted connections (HTTPS), hashed passwords, secure session cookies, protection against forged requests, and access controls that limit who on our team can see customer data. Card details never touch our systems. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the authorities of a serious breach as the law requires.

8. Changes to this policy

If we change this policy we will update the date at the top of this page. If a change is significant we will tell you on the site or by email before it takes effect.