Privacy policy

Effective October 27, 2026 · Version 2026-10-27

This Privacy Policy explains how Rehan Spices Corporation handles personal information through our retail and wholesale website, inquiries, business relationships and related communications. It also explains choices you can make and how to contact us about your information.

Information you provide

We receive information that you submit or give us when you contact us, request a quote or product document, discuss a supply requirement, or place an order. This can include:

• Contact details: your name, email address, telephone number and delivery or billing details.
• Business details: company name, buyer type, role and business or institutional purchasing requirements.
• Inquiry and transaction details: ingredients, quantities, preferred pack sizes, order frequency, purchase-order references, requested documents, delivery locations, deadlines, receiving instructions and order correspondence.
• Messages and other information: the content you choose to send us when asking for help or discussing a purchase.

Please do not put payment-card details, bank passwords, government identification numbers, health information or other sensitive personal information into general inquiry fields. If payment or additional business documentation is needed, we will explain the appropriate method.

Website and referral information

Shopify hosts our store. Website technologies can process technical information such as an IP address, browser and device details, cookie or similar identifiers, pages and links used, referral information and approximate location inferred from technical information.

When analytics processing is permitted through the site's Shopify privacy settings, our inquiry features can carry campaign labels and a landing-page reference between pages and include them with a submitted inquiry. This helps us understand how people find us. The current inquiry page and product or application references can also accompany a request so that we can respond to it.

Some fonts are delivered from Google's font servers. Your browser connects to those servers to display the typefaces, which makes technical connection information available to that provider. Our website also connects to Shopify's content-delivery and platform services.

How we use information

We use information as needed to respond to inquiries; prepare quotations; discuss specifications, samples or supply requirements; handle orders, payment arrangements and delivery where applicable; provide customer support; maintain business and accounting records; operate and protect the website; investigate misuse; and meet legal obligations or resolve disputes.

We also use permitted website measurements and referral information to understand the usefulness of our pages and communications. We send promotional email, text messages or promotional telephone communications only when you have opted in to the relevant type of marketing and the applicable legal requirements are met. Marketing consent is optional and is not a condition of purchase. You can withdraw that marketing choice by contacting us or using an unsubscribe method provided in the communication. Withdrawing marketing permission does not prevent necessary messages about an inquiry, order or privacy request.

Service providers and other disclosures

When you pay online, the checkout and payment services process the payment information needed to authorize and complete your transaction, detect fraud and handle refunds or disputes. Rehan receives the order, payment status and transaction details made available through those services. Payment choices and providers are those actually offered at checkout; enabling a payment service does not enroll you in our marketing.

Information is made available to people and service providers who need it to support the relevant activity. Depending on your interaction, these can include website and communications providers, payment services, delivery providers and professional advisers. We may also disclose information when required by law or reasonably needed to protect rights, investigate fraud or security issues, resolve a dispute, or address a business reorganization subject to applicable protections.

Shopify processes information to provide the storefront and related services for us. For certain Shopify services, Shopify also determines its own uses of information. Its role and your options for those activities are explained in the Shopify Consumer Privacy Policy and Shopify Privacy Portal. If Shopify Network Intelligence or other enhanced services are enabled, Shopify can combine information about interactions with our store and other Shopify merchants for those services. These providers may process information in the United States and other countries.

Third-party features may apply their own privacy terms. A privacy choice made on our website does not necessarily change a separate choice you have made directly with another service.

Cookies, saved selections and local files

Shopify and enabled services use cookies and similar technologies for necessary site functions and, where permitted, optional preferences, analytics or marketing. See the Shopify Cookie Policy for information about Shopify's technologies.

Our ingredient selection list uses session storage in your browser to remember selected catalogue items. Inquiry features can temporarily retain selected product and business-request details in the same browser session to help recover a form after an error. Our custom recovery features do not intentionally save your name, email address, telephone number or message in this session storage. Browser settings and the site's clear-list controls can remove saved selections; blocking storage can limit these convenience features.

If you choose to download an ingredient plan, the file contains selected ingredient references, quantities, units and preferred pack descriptions. Importing that file fills a request on your device; it does not submit an inquiry. Review a file before sharing it, particularly if you typed personal or confidential information into a description. Printing or saving a worksheet creates a copy under your control.

Your browser privacy choices

Visit our website privacy page and open Your privacy choices using the website's privacy control to manage optional preferences, analytics and marketing through Shopify. The separate Do not sell or share my personal information control records that browser-level opt-out with Shopify. Rejecting optional uses also requests that opt-out. The control reports a saved choice only when the platform confirms it. These settings concern this browser and the connected platform features; they do not by themselves delete an inquiry or order.

Shopify handles Global Privacy Control (GPC) browser signals in regions configured for its sale-or-sharing opt-out. The privacy control displays the state the platform can confirm. If you need help with a signal, a choice on another device, or information already associated with you, contact us. We do not ask you to prove your identity merely to set a browser opt-out.

The custom website features do not separately interpret the older browser Do Not Track setting. Shopify and third-party services may have their own handling of that setting. Enabled third-party services may collect personal information about online activities over time and across different websites. Which activities occur depends on the services and privacy settings in use. Use the website privacy control and the relevant provider's choices rather than relying on Do Not Track alone.

California privacy rights

Where the California Consumer Privacy Act (CCPA) applies, California residents have the rights below, subject to the law's exceptions. These rights can apply to personal information about a business contact as well as an individual shopper.

• Know and access: request the categories and specific pieces of personal information collected about you, its sources, the purposes for collecting, selling or sharing it, and the categories of recipients. This includes information about categories sold, shared or disclosed for a business purpose. You may request an accessible, portable copy where the law requires one.
• Delete: request deletion of personal information collected from you, subject to exceptions such as completing a transaction or meeting a legal obligation.
• Correct: request correction of inaccurate personal information we maintain about you.
• Opt out: direct a business to stop selling your personal information or sharing it for cross-context behavioral advertising, if it engages in those activities.
• Limit sensitive uses: direct a business to limit uses or disclosures of sensitive personal information that go beyond purposes permitted by the CCPA, if it engages in those uses.
• Equal treatment: exercise CCPA rights without unlawful discrimination or retaliation.

Requests to know may be made free of charge up to twice in a 12-month period. Other rights are not subject to that twice-yearly limit. A request to know may cover information collected before the preceding 12 months, including all available information collected on or after January 1, 2022, subject to applicable limits. We do not require you to waive these rights as a condition of purchasing.

Information categories and ordinary uses

The following categories describe information used in the website and ordinary buyer interactions addressed by this policy. One record can fall into more than one category. The examples explain the category; they do not mean that every example is collected from every visitor.

Identifiers: name, email, phone, postal address, IP address and online identifiers

Sources and purposes: You and your browser or device; used to respond, connect an inquiry with an order, deliver goods, operate the website and protect it.

Providers involved where relevant: Website and communications providers; delivery providers for shipment details; payment providers for a payment interaction.

Personal information described in California Civil Code section 1798.80(e): contact, customer and transaction records

Sources and purposes: You and correspondence with you; used to administer quotes, purchases, payment arrangements and business records.

Providers involved where relevant: Communications providers; payment and delivery providers as needed for the transaction; accounting or professional advisers where involved.

Commercial information: products considered or ordered, quantities, pack preferences, quote requests and purchase-order references

Sources and purposes: Your requests and transactions; used to prepare quotations, discuss requirements, supply products and support an order.

Providers involved where relevant: Website and communications providers; delivery, payment and professional-service providers where needed for that activity.

Internet or other electronic network activity information: pages, links, referral or campaign references and privacy choices

Sources and purposes: Browser or device interactions with the store; used to operate and protect the site and, where permitted, understand how its pages and inquiries are used.

Providers involved where relevant: Shopify and website technology providers involved in the relevant service.

Geolocation data: approximate area inferred from an IP address

Sources and purposes: Technical website interactions; used by website services for their operation and regional settings. This example concerns approximate location, rather than a request for precise device location.

Providers involved where relevant: Shopify and website technology providers involved in the relevant service.

Electronic information: messages and order correspondence

Sources and purposes: Communications you send us; used to answer questions, document requirements and resolve issues.

Providers involved where relevant: Website and communications providers; relevant advisers where needed to address an issue.

Professional or employment-related information: business affiliation, buyer role and work contact details

Sources and purposes: You or a business representative contacting us; used to understand purchasing authority, supply requirements and business communications.

Providers involved where relevant: Website and communications providers; relevant providers or advisers supporting that business interaction.

Provider access depends on the activity and information needed for it. A provider's legal role can differ between services; the Shopify disclosures above explain that distinction. Information may also be disclosed for the legal, security or business-transfer purposes described in this policy.

Retention depends on the category and purpose: inquiry and commercial records support the relationship, open issues, accounting and legal duties; correspondence and business-contact records support communication and dispute handling; website identifiers, activity and approximate-location information support the relevant website functions and provider settings. Privacy-request records also document our response and applicable compliance obligations. These criteria do not create a promise to retain all information indefinitely.

Submitting and verifying a privacy request

Submit a request by emailing rehanspice@gmail.com or using our privacy request form. Tell us which right you want to exercise and provide enough context to locate your interaction with Rehan, such as the email address you used and an inquiry or order reference if available. You may write “Privacy request” in your message to help us route it, but those words are not required. The privacy request form asks for a reply email and the request type; your name and additional context are optional. You can also contact us at (562) 229-0049 for assistance.

For a request to know, delete or correct, we may compare information you supply with existing records and ask for additional information reasonably necessary to verify your identity. The checks depend on the request and the sensitivity of the information. We will explain a verification problem or applicable reason we cannot fulfil all or part of a request. You do not need to create an account to submit a request. Please do not send passwords, full payment details or identification documents unless we explain a necessary and appropriate verification method.

Information collected specifically for verification is used only for that purpose and is not retained longer than necessary for verification. We separately keep limited records of requests and our responses as required by law. An opt-out of sale or sharing, or an applicable request to limit sensitive uses, does not require the identity-verification process used for an access request. We ask only for information needed to carry out that choice when it cannot be applied without it.

When to expect a response

For a CCPA request to know, delete or correct, we acknowledge receipt within 10 business days and explain the verification process and expected response timing, unless the request has already been completed or denied. We provide a substantive response within 45 calendar days after receipt. Time spent verifying a request does not restart that period.

If reasonably necessary, we may take up to an additional 45 calendar days, for a maximum of 90 calendar days from receipt. We will explain the reason and notify you of the extension within the first 45-day period. A response will explain an applicable exception or inability to verify rather than promise deletion of records that the law permits or requires us to retain.

Where the CCPA requires us to act on a sale-or-sharing opt-out or sensitive-use limitation, we do so as soon as feasibly possible and no later than 15 business days after receipt. That is a maximum, not a waiting period. These requests do not use the 45-day access-request timetable.

Using an authorized agent

An authorized agent may submit a request through the contact methods above. For a request to know, delete or correct, we may ask the agent for proof of your signed permission and ask you to verify your identity directly with us or directly confirm that you authorized the agent. We do not require you to submit the request again in your own name.

Different rules apply when the agent holds a valid power of attorney under California Probate Code sections 4121–4130. A power of attorney is not required merely to appoint an authorized agent. For an agent's sale-or-sharing opt-out or applicable sensitive-use limitation, we may request your signed authorization. Signed agent authorization is not required to send a qualifying browser opt-out preference signal.

Sale, sharing and browser signals

The CCPA gives “sale” and “sharing” specific meanings. A sale can involve valuable consideration other than money. Sharing concerns disclosure for advertising that targets a person based on activity across different businesses or services. Ordinary disclosures to a properly contracted service provider are assessed differently. These terms are not limited to selling a mailing list.

You can use the site's Do not sell or share my personal information control, or contact us to direct an opt-out. A supported browser or extension can also send a Global Privacy Control (GPC) signal. A qualifying signal is a request to opt out of covered sale or sharing for that browser or device and profiles associated with it; when a covered business knows the consumer, the request also applies to that consumer. Sending that signal does not require an account, an additional form or proof of identity.

The website's privacy control shows the browser-level state Shopify can confirm. Contact us to exercise a choice for identifiable information outside that browser session or ask about its scope. An optional-cookie setting alone is not the same as a request to stop selling or sharing information, and a browser choice does not itself delete an order or inquiry. The separate request methods above also accept applicable requests to limit sensitive uses.

Retention and security

We keep information for the purposes described in this policy. Relevant factors include the nature of the inquiry or business relationship, whether an order or issue remains open, applicable accounting and legal requirements, fraud prevention, dispute handling and the need to maintain reliable business records. Different types of information may therefore be kept for different periods.

We use reasonable safeguards appropriate to the information and services involved, but no website, email service or storage system can be guaranteed completely secure. Please use the contact details below if you believe information sent to us has been misdirected or exposed.

Children

Our website and business services are not directed to children under 13, and we do not knowingly seek personal information from children under 13. A parent or guardian who believes a child has provided personal information can contact us so that we can review the situation and take appropriate steps under applicable law.

Changes to this policy

We may update this policy as our website, services or obligations change. We will post the revised policy with its updated date and provide any additional notice required by applicable law for a material change.

Contact Rehan Spices

For a privacy question, request or marketing opt-out, contact Rehan Spices Corporation at rehanspice@gmail.com or (562) 229-0049, or write to 14434 Best Ave, Santa Fe Springs, CA 90670, United States. Please include enough context for us to understand your request, but do not send sensitive identification documents unless we explain why and how they are needed.