Privacy Policy

Who we are

LimeThreads is an online apparel store based in Pakistan. We sell ready made garments and garments printed with designs that customers create or upload themselves. When this policy says “we” or “us”, it means LimeThreads. When it says “you”, it means anyone who visits the site or places an order.

What we collect

We collect only what we need to run the shop and get your order to you.

• Account details. Your email address and password. Passwords are stored in hashed form, which means we cannot read them and neither can anyone who obtained a copy of our database.
• Order details. Your name, delivery address, phone number, the items you ordered and the amount you paid.
• Designs you upload. Artwork, images and text you place on a garment, along with the position and size you chose. These are stored so we can print your order and so you can reorder later.
• Technical information. Basic details your browser sends, such as pages visited and approximate location derived from your IP address. We use this to keep the site working and to spot abuse.
• Searches that found nothing. When a search for a design or product comes back empty — yours, or one Lime runs for you — we log the words searched for, with no account or device attached, and keep them for 90 days. It tells us which designs people want that we do not have yet.
• How the site is used, if you agree. With your permission, Google Analytics tells us which pages people visit and what they do there. See below and our cookie policy.

If you pay by bank transfer, we keep the name, reference and amount that appear on the transfer, to match your payment. If you pay by card, Safepay processes the payment; we never see your full card number. Safepay tells us only the card type, its last four digits and the transaction reference, which we print on your invoice. If we refund you, we keep the account you ask us to pay into, and use it for that refund only.

Why we use it

• To take payment, print your order and deliver it to you.
• To send order confirmations, delivery updates and answers to your questions.
• To let you sign in, see past orders and reuse designs you saved.
• To detect fraud, prevent abuse and keep the store secure.
• With your permission, to see which pages help people find what they want, and improve the ones that do not.
• To meet our obligations under Pakistani tax and commercial law.

Your data stays with us

Your personal information is never for sale. We never rent it, trade it, or hand it to other businesses, individuals or advertisers for their own use. There are no advertising trackers on this site, and we never build profiles of you to sell on.

Running the shop does mean a few trusted companies handle some of your information for us. We would rather be open about who they are:

• Delivery. A courier cannot bring a parcel to your door without your name, address and phone number. We give them only those details, and only for the delivery you ordered.
• Card payments, through Safepay. If you pay by card, wallet or Raast, Safepay, our payment processor, takes the payment on its own secure page and receives your card or account details, the amount and your order reference. We never see your full card number. Safepay handles that data under its own privacy policy and the State Bank of Pakistan’s rules for payment gateways.
• Email. Our email provider needs your email address in order to send you an order confirmation. It is used to deliver our messages to you and nothing else.
• Google sign-in. The sign-in and sign-up pages load Google’s “Sign in with Google” button from Google, so Google can see those pages were opened. If you choose to use it, Google knows you signed in to LimeThreads, and we receive your email address and your Google account id, nothing else.
• Google Analytics, only with your consent. If you accept analytics cookies, Google Analytics counts which pages are visited and what people do on them, so we can see what helps people find what they want. It is used for measurement only, not advertising: ad features are switched off, and it never receives your name, email, address or messages. If you decline, it is not loaded at all. Our cookie policy has the details.
• PostHog, only with your consent. The same answer covers PostHog, which shows us how people move through the shop, such as how many who start a design go on to order it. It receives the same limited information as Google Analytics and never your name, email, address or messages; it does not record your screen. Its servers are in the European Union. If you decline, it is not loaded at all.
• Lime, our shop assistant. What you type to Lime is sent to DeepSeek, the company whose AI model writes Lime’s replies, and its servers are in China. Lime can help you without any personal details, so please keep your phone number and address out of the chat.

The courier and our email provider act on our instructions only. They are not permitted to use your information for their own purposes, to contact you about anything other than your order, or to pass it on to anyone else. Safepay, Google and DeepSeek handle what they receive under their own privacy policies, which is why we keep what reaches them to the minimum described above. If we ever add another service that needs your data, we will update this page before it goes live, so you always know.

The one situation where we may have to disclose information is if a court, regulator or law enforcement agency in Pakistan lawfully requires it. If that happens we will disclose only what is actually required, and nothing more.

Where your data is stored

Our systems run on Amazon Web Services infrastructure located in Singapore, and our email and payment providers may process data outside Pakistan as well. Google processes sign-in and, if you allow it, analytics data in several countries, PostHog processes analytics data in the European Union, and what you type to Lime is processed in China. This means your information is stored and processed outside the country. We tell you this because you are entitled to know where your data lives before you hand it over, and because Pakistan’s e-commerce policy framework asks businesses to disclose it.

How long we keep it

Order records are kept for as long as tax and accounting rules require, currently six years. Account details and saved designs are kept while your account is open. If you ask us to close your account we will delete your designs and reduce your order records to the minimum we are legally required to retain.

A design you chose to contribute to the collection is the one exception, because other people may be buying it. Withdrawing it stops that immediately, and we then keep only the record that permission was given and withdrawn — that record is how we can show we had permission for garments we printed while it was in place. If you want our copy of the artwork destroyed as well, withdraw it and then ask us and we will destroy it.

Your choices

• You can ask for a copy of the personal information we hold about you.
• You can ask us to correct anything that is wrong.
• You can ask us to delete your account and the designs attached to it, subject to the retention rules above.
• You can withdraw a design you contributed to the collection at any time, yourself, without asking us — from My Designs in your account, the order, or the link in your email.
• You can unsubscribe from any marketing message using the link in it. Order and delivery messages keep coming, because they are part of the service you paid for.

Write to info@limethreads.com and we will take care of it. We may ask you to confirm your identity first, to make sure your information only ever reaches you.

Security

Traffic to and from the site is encrypted. Passwords are hashed. Access to customer data is limited to the people who need it to run the shop. No online service can honestly promise perfect security, but we work hard to protect yours, and if a breach ever affects your data, we will tell you what happened and what we are doing about it.

Cookies

Signing in, your basket and checkout do not use cookies. They use your browser’s local storage, which stays on your device, as do your theme, wishlist and designs in progress. The only cookie the site sets itself remembers your answer about analytics, and the analytics tools set their own cookies only if you say yes.

Our cookie policy lists each of them and how to change your answer. Clearing your browser’s site data removes all of it, and will sign you out.

Legal position in Pakistan

Pakistan does not yet have a single comprehensive data protection statute. The Prevention of Electronic Crimes Act 2016 governs unauthorised access to and misuse of personal data, and a dedicated Personal Data Protection Bill has been under consideration for some time. We aim to follow recognised data protection practice regardless of what the law currently requires, and we will update this policy when new legislation takes effect.

Changes to this policy

If we change this policy we will update the date at the top of this page. If a change materially affects how we use your information, we will tell account holders by email, so you never have to check back to stay informed.

Contact

We are always glad to help with any privacy question or request. Email info@limethreads.com. You can also reach us through our contact page.