Privacy Policy

Alima World ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website (alimaworld.com), mobile applications, or interact with our services (collectively, the "Platform").

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Platform.

We collect information that you voluntarily provide when you:

• Create an account: name, email address, password, and optional phone number. • Make a purchase: shipping address, billing address, and payment information (processed by our payment processors — we do not store full credit card numbers). • Subscribe to our newsletter: email address. • Submit a review or rating: your name (or display name), rating, review text, and any images you upload. • Contact us: name, email address, and the content of your message. • Participate in promotions or surveys: information relevant to the promotion or survey.

When you access the Platform, we automatically collect:

• Device information: browser type, operating system, device type, and screen resolution. • Usage data: pages visited, time spent on pages, click patterns, referral URLs, and exit pages. • Log data: IP address, access times, and request timestamps. • Cookie and tracking data: information collected through cookies, web beacons, and similar technologies (see Section 9 — Cookies).

We may receive information about you from third-party sources, including:

• Payment processors (Stripe, PayPal) — transaction confirmation and fraud detection signals. • Authentication providers (Google) — if you use social sign-in, we receive your name, email, and profile picture. • Analytics providers — aggregated usage and demographic data. • Shipping carriers (Shippo) — delivery status and tracking information.

We use your personal information for the following purposes:

• Order fulfillment: to process, ship, and deliver your purchases, and to send order confirmations, shipping updates, and delivery notifications. • Account management: to create and maintain your account, authenticate your identity, and provide customer support. • Payment processing: to process payments, issue refunds, and detect fraudulent transactions. • Customer service: to respond to your inquiries, resolve disputes, and provide technical assistance. • Marketing and promotions: to send you newsletters, promotional offers, and personalized recommendations (with your consent where required by law). • Platform improvement: to analyze usage patterns, diagnose technical issues, and improve our products and services. • Legal compliance: to comply with applicable laws, regulations, legal processes, and enforceable governmental requests. • Security: to detect, prevent, and address fraud, unauthorized access, and other illegal activities.

For users in the European Economic Area (EEA), United Kingdom (UK), and other jurisdictions that require a legal basis for data processing under the General Data Protection Regulation (GDPR), we process your personal information based on the following legal grounds:

• Performance of a contract: processing necessary to fulfill our contractual obligations to you (e.g., processing your order, delivering your purchase, managing your account). • Consent: where you have given explicit consent for a specific purpose (e.g., subscribing to marketing emails, accepting non-essential cookies). You may withdraw consent at any time. • Legitimate interests: processing necessary for our legitimate business interests (e.g., improving our Platform, preventing fraud, ensuring network security), provided these interests are not overridden by your fundamental rights. • Legal obligation: processing necessary to comply with a legal obligation to which we are subject (e.g., tax record-keeping, responding to lawful government requests).

We do not sell your personal information. We may share your information with the following categories of third parties:

• Payment processors: Stripe, Inc. and PayPal, Inc. process your payment information. They have their own privacy policies governing how they handle your data. See Stripe's Privacy Policy at stripe.com/privacy and PayPal's Privacy Policy at paypal.com/webapps/mpp/ua/privacy-full. • Shipping carriers: We share your name and shipping address with carriers (via Shippo) to fulfill your orders. Shippo's Privacy Policy can be found at goshippo.com/privacy. • Cloud infrastructure: Our platform is hosted on Vercel, Inc. Vercel processes technical data as part of hosting our services. See Vercel's Privacy Policy at vercel.com/legal/privacy-policy. • Analytics providers: We may share anonymized, aggregated usage data with analytics services to understand how our Platform is used. • Email service providers: We use Resend to send transactional and marketing emails. Resend processes email addresses and email content on our behalf. • Legal authorities: We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Alima World, our users, or the public. • Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction.

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account information: retained for the duration of your account and for 3 years after account deletion. • Order and transaction data: retained for 7 years to comply with tax, accounting, and legal requirements. • Marketing data: retained until you unsubscribe or for 2 years after your last interaction with our marketing communications. • Support communications: retained for 3 years from the date of the last communication. • Cookie data: varies by cookie type (see Section 10 — Cookies). • Reviews and ratings: retained indefinitely unless you request deletion.

Depending on your jurisdiction, you may have the following rights regarding your personal information.

• Right of access: request a copy of the personal information we hold about you. • Right to rectification: request correction of inaccurate or incomplete information. • Right to erasure ("right to be forgotten"): request deletion of your personal information, subject to certain exceptions. • Right to restriction of processing: request that we limit how we use your data. • Right to data portability: receive your personal information in a structured, commonly used, machine-readable format. • Right to object: object to our processing of your personal information, including for direct marketing. • Right to withdraw consent: withdraw your consent at any time where processing is based on consent. • Right to lodge a complaint: file a complaint with your local data protection supervisory authority.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share your information. • Right to delete: request deletion of your personal information, subject to certain exceptions. • Right to correct: request correction of inaccurate personal information. • Right to opt out of sale or sharing: request that we do not sell or share your personal information. We do not sell your personal information as defined by the CCPA. • Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at privacy@alimaworld.com. We will respond to your request within 45 days.

We use cookies and similar technologies to enhance your experience on the Platform. For full details, please see our Cookie Policy.

In summary:

• Essential cookies: required for basic Platform functionality (e.g., shopping cart, authentication, security). These cannot be disabled. • Functional cookies: remember your preferences and personalize your experience (e.g., language, currency, recently viewed products). • Analytics cookies: help us understand how visitors interact with the Platform (e.g., pages visited, time on site). We use these to improve our services. • Marketing cookies: used to deliver relevant advertisements and track campaign performance.

Non-essential cookies are only set with your consent. You can manage your cookie preferences at any time through our cookie consent banner or by adjusting your browser settings.

We implement industry-standard technical and organizational measures to protect your personal information, including:

• SSL/TLS encryption for all data transmitted between your browser and our servers. • Encrypted storage of sensitive data at rest. • PCI DSS compliance through our payment processors (Stripe and PayPal). • Regular security assessments and vulnerability scanning. • Access controls and authentication for internal systems. • Incident response procedures for data breaches.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

Alima World is based in the United States. If you access the Platform from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers of personal information from the EEA or UK to countries that have not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data is protected.

The Platform is not intended for children under the age of 13 (or 16 in the EEA/UK). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@alimaworld.com.

The Platform may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policies of every website you visit.

Some web browsers transmit "Do Not Track" (DNT) signals. There is currently no universally accepted standard for how businesses should respond to DNT signals. At this time, our Platform does not alter its data collection and usage practices in response to DNT signals.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on the Platform.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes constitutes acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Alima World Email: privacy@alimaworld.com General Support: support@alimaworld.com Address: New York, NY, United States Website: alimaworld.com

For GDPR-related inquiries from the EEA or UK, you may also contact our designated data protection representative at the email above.