This privacy policy applies to Arsh's Rugs ("Arsh's," "we," "us," or "our"), operating the website arshs.com and serving customers from our showroom at:

• 820 Washington Avenue, Suite 2, Carlstadt, NJ 07072, United States
• Phone: (201) 552-2733
• Email: Info@Arshs.com

For privacy-specific questions, requests, or complaints, please use the contact methods listed in Section 14 below.

We collect personal information in three ways: information you give us directly, information collected automatically when you use our website, and information we receive from third parties.

What we do NOT collect

We do not knowingly collect Social Security numbers, government identification numbers, biometric information, precise geolocation, or information about your children. We do not collect sensitive categories of personal information (such as health, religion, or political affiliation) in the ordinary course of business.

We use the personal information we collect for the following purposes:

• Fulfilling your orders — processing purchases, rentals, repair, and cleaning service requests; arranging shipping and delivery; handling returns and warranty claims.
• Communicating with you — sending order confirmations, shipping updates, delivery notifications, service quotes, and responding to your questions.
• Managing your account — if you create an account, to maintain your account, save your preferences, and remember your shopping cart.
• Marketing communications — sending newsletters, promotions, and new arrival announcements, only if you've opted in. You can unsubscribe at any time.
• Improving our website — analyzing how visitors use arshs.com so we can fix problems, improve navigation, and make the shopping experience better.
• Advertising — showing you Arsh's products on social media and other websites you visit, and measuring the effectiveness of our advertising.
• Fraud prevention and security — detecting and preventing fraudulent transactions, account takeovers, and other security threats.
• Legal compliance — meeting our obligations under applicable law, including sales tax collection, anti-fraud, anti-money-laundering, and responding to lawful requests from authorities.

We do not sell your personal information for money. We do share it with the following categories of third parties so we can operate our business and provide the services you request.

Service Providers

Companies we hire to help us run our business. They are only allowed to use your information to provide services to us, not for their own purposes:

• Shopify Inc. — our e-commerce platform. Shopify processes orders, hosts our website, and stores customer data on our behalf.
• Payment processors — Shopify Payments, PayPal, Afterpay, Klarna, and others, who process your payment securely.
• Shipping carriers — FedEx, UPS, USPS, and freight carriers for larger pieces, to deliver your orders.
• Email and marketing platforms — services that help us send newsletters and order updates (such as Klaviyo or Shopify Email).
• Analytics providers — Google Analytics, Shopify analytics, and similar services that help us understand how visitors use our website.
• Advertising partners — Meta (Facebook/Instagram), Google Ads, and other platforms we use to show you our products. See Section 9 on cookies for more.
• Customer service tools — chat platforms and CRM systems we use to respond to your inquiries.
• Fraud prevention — services that help us detect fraudulent orders.

Business Transfers

If Arsh's is involved in a merger, acquisition, financing, or sale of business assets, your information may be transferred as part of that transaction. We will notify you and give you choices before your information becomes subject to a different privacy policy.

Legal & Safety

We may disclose information when we believe in good faith that disclosure is necessary to: comply with a legal obligation; respond to a subpoena, court order, or government request; protect our rights, property, or safety, or that of others; or investigate fraud or security incidents.

Cookies are small text files placed on your device when you visit our website. We use cookies and similar technologies (pixels, web beacons, local storage) for the following purposes:

Essential Cookies

Required for the website to function — keeping you logged in, remembering items in your shopping cart, and processing checkout. These cannot be disabled.

Analytics Cookies

Help us understand how visitors use arshs.com so we can improve it. These tell us things like which pages are most popular and how visitors navigate from page to page.

Marketing & Advertising Cookies

Used to show you Arsh's products on social media and other websites, and to measure how effective our advertising is. These include pixels from Meta (Facebook/Instagram) and Google.

Managing Your Cookies

You can control cookies in three ways:

• Use our cookie banner when you first visit the site to accept or reject non-essential cookies
• Adjust your browser settings to block or delete cookies (note: this may break parts of the website)
• Use the Global Privacy Control (GPC) signal in supported browsers — we honor GPC signals from California, Colorado, and Connecticut residents as a valid opt-out request

If you've opted in to our newsletter or other marketing emails, you will receive updates about new arrivals, sales, and content from Arsh's.

How to Unsubscribe

You can opt out at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email we send
• Updating your preferences in your account settings (if you have an account)
• Emailing us at Info@Arshs.com with "Unsubscribe" in the subject line

Even if you opt out of marketing, we will still send you transactional emails related to your orders, service requests, and account.

We keep your personal information for as long as needed to fulfill the purposes outlined in this policy, and to meet our legal, accounting, and tax obligations. In general:

• Order and transaction records — at least 7 years, for tax and accounting compliance
• Account information — until you ask us to delete your account, plus a reasonable period for legal compliance
• Marketing data — until you unsubscribe, plus a reasonable suppression-list period to ensure we honor your opt-out
• Analytics and website logs — typically 26 months or less, depending on the analytics provider
• Customer service correspondence — typically 3 years from the date of last contact

After these periods, we either delete the information or de-identify it so it can no longer be linked to you.

We take reasonable administrative, technical, and physical safeguards to protect your personal information against loss, theft, and unauthorized access, use, modification, or disclosure. These include:

• SSL/TLS encryption for all data transmitted between your browser and our website
• PCI-DSS compliance for payment processing (handled by our PCI-compliant payment processors)
• Access controls limiting who at Arsh's can view customer information
• Regular security reviews of the platforms and services we use

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. If we ever experience a data breach affecting your personal information, we will notify you and the appropriate authorities as required by applicable law.

Depending on where you live, you may have the following rights regarding your personal information:

• Right to know / access — request a copy of the personal information we hold about you
• Right to delete — request that we delete your personal information, subject to legal exceptions
• Right to correct — ask us to fix inaccurate information about you
• Right to opt out — opt out of the sale or sharing of your personal information for cross-context behavioral advertising
• Right to portability — receive your information in a portable, machine-readable format
• Right to limit use of sensitive information — restrict our use of certain categories of sensitive personal information
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights

How to Exercise Your Rights

To make a request, email Info@Arshs.com with the subject line "Privacy Request" and tell us:

• Your full name and the email address associated with your Arsh's account or orders
• The right you wish to exercise (access, delete, correct, opt-out, etc.)
• Enough detail for us to verify your identity (we may ask for additional verification before fulfilling the request)

We will respond within the timeframes required by applicable law — generally within 45 days for U.S. state requests and 30 days for GDPR requests, with possible extensions if your request is complex.

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information.

Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information from California residents: identifiers (name, address, email, IP address), commercial information (purchase history), internet/network activity (browsing data), geolocation (approximate, from IP), and inferences drawn from this information. See Section 2 for full detail.

"Sale" or "Sharing" Disclosure

Arsh's does not sell personal information for money. However, our use of advertising cookies and pixels (such as the Meta Pixel and Google Ads tags) may constitute "sharing" of personal information for cross-context behavioral advertising under California law.

Your "Do Not Sell or Share My Personal Information" Right

You may opt out of this sharing in two ways:

• Use the "Do Not Sell or Share My Personal Information" link in our website footer
• Send a Global Privacy Control (GPC) signal from your browser — we honor GPC as a valid opt-out request

Shine the Light Disclosure

California Civil Code § 1798.83 ("Shine the Light") permits California residents to request information about the categories of personal information we have shared with third parties for those third parties' direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes.

Authorized Agents

You may designate an authorized agent to submit privacy requests on your behalf. We will require the agent to provide proof of your written authorization and may require you to verify your identity directly.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and other states with comprehensive consumer privacy laws have rights similar to those described in Section 9 above, with variations depending on your state of residence.

These typically include rights to access, correct, delete, and obtain a portable copy of your personal information, as well as the right to opt out of targeted advertising. Some states also grant rights to appeal a denied privacy request.

To exercise any of these rights, contact us at Info@Arshs.com using the process described in Section 9.

If you are located in the European Economic Area, United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and similar laws give you the following rights:

• Access to your personal data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing, including for direct marketing
• Withdrawal of consent at any time, where processing is based on consent
• The right to lodge a complaint with your local data protection authority

Legal Bases for Processing

We process your personal data on the following legal bases: contract (to fulfill orders and provide services), legitimate interest (to run and improve our business, prevent fraud), consent (for marketing communications and non-essential cookies), and legal obligation (to comply with tax, accounting, and other laws).

International Data Transfers

Because Arsh's is based in the United States and uses U.S.-based service providers like Shopify, your personal data will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses, the EU-U.S. Data Privacy Framework, and other valid transfer mechanisms to protect your data.

Arsh's services are intended for adults aged 18 and older. We do not knowingly collect personal information from children under 13 (or under 16 in some jurisdictions). If you believe we have collected information from a child, please contact us at Info@Arshs.com and we will promptly delete it.

Under the Children's Online Privacy Protection Act (COPPA), we will not knowingly market to children or process personal information of children without verified parental consent.

We may update this privacy policy from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our website
• For significant changes, notify customers with active accounts by email

We encourage you to review this policy periodically to stay informed about how we protect your information.