Your data, handled with care.

Who we are

Baby Studio is a children's toy and baby-goods store based in Karachi, Pakistan, operating at babystudiopk.com. This policy explains what information we collect, why we collect it, and what your rights are regarding that information.

Information we collect

To fulfil your order we collect: your name, email address, phone number, and shipping address. If you create an account, we also store a hashed password (never the plain text). When you place an order, we record the items you bought, the price you paid, the discount code (if any), and your delivery status.

If you sign up for our newsletter without buying anything, the only thing we collect is your email address.

We use our own cookies for two things: keeping you signed in, and remembering your shopping cart.

We also use Google Analytics and the Meta (Facebook) Pixel to understand how the shop is used and to measure our advertising. These set their own cookies and record the pages you view, the products you look at, what you add to your bag, and — when you place an order — the order number and total. Google Analytics does not receive your name, address, email or phone number.

When you place an order we also send Meta a record of that purchase directly from our server, so that we can tell which of our adverts actually work. So that Meta can match the order to an advert you saw, this includes your email address, phone number, first name, city and postcode — but only ever as an irreversible scrambled code (a one-way “hash”), never as readable text. We never send your street address, and Meta cannot read the original details back out of the code.

You can opt out of Google Analytics with the official browser add-on, and of Meta ad targeting in your Facebook or Instagram ad settings. Blocking cookies in your browser, or any standard ad blocker, also stops both — nothing on this site depends on them working.

How we use it

Your information is used to ship your order, contact you about that order (placed, confirmed, shipped, delivered), and, if you have an account, to let you sign in and view your past orders. We send email through Resend, and we may message you on WhatsApp about an order you have actually placed.

If you have shopped with us or given us your email address, we may also send you occasional news about new arrivals and offers. Every one of those carries an Unsubscribe link: follow it, confirm on the page it opens, and they stop for good — messages about an order you have placed keep coming, because you need those. If you have an account you can also turn marketing email off at any time from your account page.

Giving us your phone number does not put you on any marketing list. That number is used for delivery and for messages about your own order. Our promotional WhatsApp list is a separate one and is never built from checkout or account details.

Beyond the anonymous usage and advertising measurement described above, we do not sell your data, rent it, or share your contact details with marketers.

Payments

Card and wallet payments (when enabled) are processed by XStak Pay. We do not see or store card numbers, CVVs, or wallet PINs — that data goes directly to the payment processor. We receive only the transaction reference and status.

If you ask us to save a card for next time, the card itself stays with XStak Pay. We keep only a reference to it, along with the brand, the last four digits and the expiry date, so we can show you which card it is. You can remove a saved card at any time from your account page, which deletes it at XStak Pay as well.

How long we keep your data

Order data is retained for accounting, warranty, and dispute-resolution purposes for as long as you are an active customer plus six years (matching Pakistani tax-record norms). Account passwords are stored as bcrypt hashes; we cannot retrieve them. Cart data is kept only while items are in your cart.

Your rights

You can request a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account and all associated personal data. Email us at info@babystudiopk.com. We will respond within 30 days. Note that we may retain order records for the legal-retention period mentioned above even after account deletion.

Security

Passwords are hashed with bcrypt. Connections to and from this site are encrypted with TLS. Our database is hosted on a private network and is not directly accessible from the internet.

Contact

Questions about this policy, your data, or to make a deletion request — please email info@babystudiopk.com.