Privacy Policy
Last updated September 28, 2026
Who looks after your data
Rugonic is run by two companies, one for each region. Each is the controller for the data of its own customers.
| For | Controller |
|---|---|
| Orders delivered outside Türkiye, and the rugonic.com waitlist | KAVELA LTD, a private limited company registered in England and Wales (Companies House no. 17051996), 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. |
| Orders delivered in Türkiye | Kavela İç Mimarlık ve Mobilya İnşaat Sanayi Ticaret Limited Şirketi, 41/A Üsküp Street, Çankaya, Ankara, Türkiye. Its notice under Türkiye’s data protection law is in Turkish: data protection notice for Türkiye. |
Write to either of us at hello@rugonic.com.
If you live in the European Union, you can also write to us at hello@rugonic.com about anything in this policy.
What we collect, and why
We collect what you give us when you order, write to us or join the waitlist, and a little technical data that every website receives.
| What | Details | Why | Legal basis (UK and EU GDPR) |
|---|---|---|---|
| Your order | Name, delivery and billing address, email, phone, the rugs you choose, amounts, order and delivery status. | To take your order, have your rug made and delivered, send order and shipping emails, handle returns, and keep invoices. | Contract (Art. 6(1)(b)). Legal obligation, for invoices and tax records (Art. 6(1)(c)). |
| Payment | The payment result, amount, method and a reference. Never your full card number, and never your wallet’s keys. | To match your payment to your order and to refund you. | Contract (Art. 6(1)(b)). |
| Your messages | What you write to us, and your email address. | To answer you and deal with what you asked. | Contract, or our legitimate interest in answering you (Art. 6(1)(f)). |
| Our email list | Your email address, where you signed up (the reply coupon, the opening page or the box at checkout), your ship-to country, the country your connection came from, the date and the words you agreed to, and when you confirmed; only with counting on, the page you first landed on and the campaign that brought you. | To email you when there are new rugs, a few times a year, and to know which pages bring people to the list. | Your consent (Art. 6(1)(a)), confirmed by the link we send. Leave in one click at any time. |
| A bag left at checkout | The email address you typed at checkout, the rugs in your bag with their sizes, types and prices, the currency and the country. | To send you up to three reminders with a link that puts the bag back, until you order or say stop. | Your consent in the EEA, the UK, Switzerland and Türkiye (the box at checkout). Elsewhere our legitimate interest in finishing an order you started (Art. 6(1)(f)); say no under the email field or in any reminder. |
| A packing slip by email | Your email address, the rugs on the slip and the country. | To send you the one email you asked for. | Your request (Art. 6(1)(b)); it puts you on no list. |
| Creators | What you write on the label on our creators page: name, email, country, handles and follower numbers, the rug you picked, what you would make, your niche, your rate and your address if you give it. | To decide whether we work together and to write back; if we do, the discount code we make for you and the orders placed with it. | Your consent, the box on the label (Art. 6(1)(a)). See creators. |
| Error reports | When something on our pages or at checkout breaks: what went wrong and in which of our scripts, the page address without anything after “?”, your browser and system type, the version of our site. Never your name, email, what you typed or your IP address. | To find and fix what is broken. | Our legitimate interest in a shop that works (Art. 6(1)(f)). See error reports. |
| Technical data | IP address, browser, the pages requested and when. | To deliver the site, keep it secure and fix problems. | Our legitimate interest in a secure, working site (Art. 6(1)(f)). |
| How you use our site | What you do on our pages (pages and rugs seen, sizes and types chosen, bag changes, checkout started, page speed, errors), with a random visit id, your country, device type and browser family. Never your IP address, name or email. See counting visits. | To learn which pages and rugs help people choose, and to find what is slow or broken. | Your consent in the EEA, the UK, Switzerland and Türkiye (Art. 6(1)(a)). Elsewhere our legitimate interest in a shop that works (Art. 6(1)(f)); say no at any time. |
We don’t collect sensitive data (such as health or beliefs), and we make no automated decisions that have legal or similar effects on you.
What our site keeps in your own browser is listed under cookies and local storage.
Where your data goes
KAVELA LTD is in the United Kingdom, and every rug is made in Türkiye. To make and deliver your rug, we send the order details above to our partner in Türkiye. The UK and the EU have not found Türkiye’s data protection adequate, so we send only what your order needs, because it is necessary to perform our contract with you (UK and EU GDPR, Art. 49(1)(b)).
Some of our service providers work outside the UK and the European Economic Area: Cloudflare and Stripe in the United States, and Resend, which sends our mail from Japan. Japan has an adequacy decision from the European Commission and from the UK, so mail to it needs no further safeguard. The others are covered by the European Commission’s Standard Contractual Clauses with the UK Addendum, or by another safeguard the law allows. Ask us for a copy. Our own server is in France, inside the European Economic Area.
How long we keep it
| What | How long |
|---|---|
| Orders and invoices | As long as tax and company law requires: 6 years in the UK, 10 years in Türkiye. |
| Your messages | As long as we need them to answer you and deal with any follow-up, then we delete them. |
| Our email list | Until you leave it. An address not confirmed within 30 days is deleted. When you leave, we keep the address only marked as left, so we never write to it again unless you sign up again. |
| A bag left at checkout | 30 days, then deleted. If you press stop, we keep a one-way scrambled form of the address (never the address) so no reminder reaches you again. |
| A packing slip by email | A record of what we sent, 30 days. |
| Creators labels | 12 months after the label last changed, or sooner if you ask. |
| Error reports | 90 days at most. |
| An ad click reference | In your browser, 90 days, only with your yes to ads. The scrambled email and phone we send Google with an order are deleted from our server once Google has accepted them. |
| Server logs | A short time, for security: normally a few weeks. |
| Visit counts | 13 months, then deleted. A visit’s random id ends after 30 minutes without activity. |
| Your browser’s storage | On your own device, until you clear it (see below). |
Our email list, bag reminders and packing slips
Our email list. If you ask to hear about new rugs (the reply coupon at the foot of every page, the opening page, or the box at checkout), we keep your email address, where you signed up, the country your connection came from, and the date and wording you agreed to. Nothing is sent until you click the link in the one email we send to confirm; an address that isn’t confirmed within 30 days is deleted. Once you’re on the list we email only when there are new rugs, a few times a year. Every email has a one-click way to leave; when you leave, we keep your address only as “left”, so we never write to it again unless you sign up again. The emails are sent by Resend (Resend, Inc., USA), which stores your address and whether you’re subscribed, on our behalf. The box at checkout is never ticked for you, and it hands your address to the list only once your order is paid.
If you leave something in your bag. When you type your email at checkout and don’t finish, we may email you that bag up to three times (about 1 hour, 1 day and 3 days later), with a link that puts it back. In the EU, the EEA, the UK, Switzerland and Türkiye we do this only if you tick the box that asks; elsewhere we tell you under the email field and you can say no there with one press. We keep the address, the rugs in the bag, their sizes and prices and the country for 30 days, then delete them. The reminders stop as soon as you order, press “stop” in an email, or start a new bag. If you press stop, we keep a one-way scrambled form of your address (not the address itself) so we never send you a bag reminder again.
The packing slip. If you ask us to email you a packing slip, we send that one email and keep a record of it (the address, the rugs and the country) for 30 days. It doesn’t put you on any list.
Error reports
When something on our pages or at checkout breaks, the page sends a short error report to Sentry (Functional Software, Inc.; stored in the EU, in Germany) so we can fix it: what went wrong and in which of our scripts, the page’s address without anything after “?”, your browser and operating system type, and the version of our site. Nothing is sent while everything works. A report carries no cookies, no email address, nothing you typed, no account or order details, and your IP address is not stored. Our shop’s own servers report their errors the same way. Reports are deleted after 90 days at most. We do this in our legitimate interest in keeping the shop working (GDPR Art. 6(1)(f), UK GDPR, KVKK Art. 5(2)(f)); it is never used for advertising and needs no cookie consent.
Creators
When you send us the label on our creators page, we keep what you wrote: your name, email address, country, handles and follower numbers, the rug you picked, what you’d make, your niche, your rate and your address if you gave it, together with the country your connection came from and, if you said yes to counting visits, the page and campaign that brought you. We use it only to decide whether to work with you and to write back. We keep it because you ask us to (the box on the label). If we work together, we also keep the discount code we make for you and the orders placed with it. A label is deleted 12 months after it last changed. To have it deleted sooner, reply to our email or write to hello@rugonic.com. Resend delivers the two emails the label triggers: our notification and your receipt.
Your rights
Under the UK and EU GDPR you can ask us to:
- tell you what we hold about you and give you a copy;
- correct it;
- delete it;
- restrict how we use it;
- give it to you, or to another company, in a common format;
- stop using it, where we rely on our legitimate interests; and stop sending you marketing at any time.
Where we rely on your consent, you can withdraw it at any time. Doing so doesn’t affect what we did before.
Write to hello@rugonic.com. We answer within one month, and we may ask you to confirm who you are first.
You can also complain to a regulator: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the data protection authority where you live or work. We’d be glad to hear from you first.
Customers in Türkiye have the rights in Article 11 of KVKK: see the data protection notice for Türkiye (in Turkish).
If you live in the United States
Some US states give their residents privacy rights: California (CCPA, as amended by the CPRA), and states such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon. We give these rights to every customer in the US, whether or not a state law applies to a business of our size:
- to know what personal information we collect, use and disclose, and to get a copy;
- to delete it;
- to correct it;
- to opt out of its sale, of its sharing for cross-context behavioral advertising, and of targeted advertising and profiling.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the past 12 months. We honor the Global Privacy Control (GPC) signal as a request to opt out: with it on, no ad platform is ever told about your visit. You can also say no to counting at any time under your privacy choices.
In the past 12 months we collected:
- identifiers: name, email, postal address, phone and IP address;
- commercial information: your orders;
- internet activity: the technical data in our server logs, and how you use our pages (counting visits).
We collected these from you and from your browser, for the purposes in What we collect, and why, and disclosed them only to the service providers in Who we share it with. We collect no sensitive personal information to infer anything about you.
To use your rights, write to hello@rugonic.com from the email address on your order, so we can confirm it’s you. Someone you authorize can write for you with your signed permission. We won’t treat you differently for using your rights. If we say no, reply with “Appeal” and we will look again within the time your state’s law sets.
Children
Our site and rugs are for adults. We don’t knowingly collect personal information from children under 16, or under 13 in the US. If you think a child has given us their details, write to us and we will delete them.
Keeping it safe
Our site and store use encrypted connections (HTTPS). Only the people who need your details can reach them, and our service providers are bound by contract to protect them. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the regulator when the law requires.
Cookies, your browser’s storage and counting visits
While you are browsing, our pages set no cookies of their own. They keep a few things in your browser’s local and session storage (listed below), so the site works the way you’d expect and, where you allow it, so we can count visits. Checkout is different: once you press Checkout, our store sets the cookies it needs to hold your order, and our security provider may set one to tell people from bots. Those are strictly necessary for the purchase you asked for and need no permission.
Counting visits
We count visits ourselves. A small script from our own site sends a short note to our own server (rugonic.com/api/e) when you open a page, look at a rug, choose a size or a type, change your bag, start checkout, or when a page is slow or breaks. No third-party script runs on our pages, and nothing about your visit goes to Google, Meta or anyone else.
A note holds what happened (for example, a rug added to the bag), the page, a random visit id that ends after 30 minutes without activity, your ship-to country and currency, the country our network provider sees your connection come from, whether you are on a phone, a tablet or a computer, your browser family (such as “iPhone Safari”) and your answer about counting. We never store your IP address, and nothing in a note names you. If you give us your email (the list, or “Post me this slip”), we keep the page and campaign you came from with it, never your visits.
We keep the notes for 13 months, then delete them. We read them only ourselves, in our shop’s own admin screen and in a daily summary email to ourselves: visits in aggregate, and a visit’s steps (for example “opened a rug page, changed the size, added it to the bag”) under a shortened, random visit number that is not linked to your name, email address or IP address. Nothing from this is shared with anyone else. Automated browsers, our own visits and our own test orders are not counted.
Who is asked first
In the European Economic Area, the United Kingdom, Switzerland and Türkiye, nothing is counted until you say yes. The ship tag that asks where to send your rug carries a declaration: “May we count your visit and tell our ads which ones worked?”, with “Yes, count me” and “No thanks”, neither chosen for you. Until you answer, notes wait in the page’s memory and are thrown away if you say no or leave. Closing the tag without answering is a no for that visit.
Everywhere else we count visits unless you say no, below.
Ads
Today we tell no ad platform anything, and no ad platform’s script runs on our pages. When we advertise with Google and measure those ads, this is what happens, and this page will say so first.
When you arrive from one of our Google ads, the link carries a click reference (gclid, gbraid or wbraid). With your permission to “tell our ads which ones worked”, we keep that reference in your browser for up to 90 days, and when you buy, our server tells Google Ads that the click led to an order: the reference, the order number, its time, value and currency, the rugs by their catalog codes, and a one-way scrambled (SHA-256 hashed) copy of the email address and phone number on the order, which Google uses only to match the order to the ad. We never send your name, address or the email itself, and we delete our copy of the scrambled values as soon as Google has accepted them. On our pages, Google’s tag loads only after that permission and then sets its own advertising cookies (_gcl_au, _gcl_aw); it records when you add a rug to your bag, start checkout or join our list. In the EEA, the UK, Switzerland and Türkiye nothing of this happens until you say yes; elsewhere it is on unless you say no in your privacy choices or your browser sends Global Privacy Control, which we treat as a no. Withdrawing your permission stops it and forgets the kept reference. Google’s own use is described at policies.google.com/technologies/ads.
Your privacy choices
With JavaScript off, nothing is counted. With it on, your choices appear here; the declaration on the ship tag, and “Your privacy choices” at the foot of every page, ask the same.
What your browser keeps
| Name | Storage | What it remembers | How long |
|---|---|---|---|
rugonic-theme-bag | Local | The rugs in your bag: design, size, type and quantity. | Until you empty your bag or clear your browser’s site data. |
rugonic-theme-country | Local | The country you ship to, so the prices, shipping and taxes you see are right. | Until you change it or clear site data. |
rugonic-theme-country-asked | Local | That the ship tag has dropped once, so it doesn’t again. | Until you clear site data. |
rugonic-consent | Local | Your answer about counting and ads, and when you gave it. | Until you change it or clear site data. |
rugonic-lift-hint, rugonic:coach-pdp | Local | That you’ve seen the “lift a corner” hint. | Until you clear site data. |
rugonic:surface | Local | The floor you chose to see a rug on. | Until you choose another or clear site data. |
rugonic-sid-ts | Local | Only when counting is on: the random visit id and the time of your last page, so a visit ends after 30 minutes without activity and a second tab joins it. | Replaced by each new visit; until you clear site data. |
rugonic-first-touch | Local | Only when counting is on: the page you first landed on, the site that sent you and any campaign tags in that link (utm_…); ad click ids (such as gclid) only if you said yes to ads. It goes with an order, so we know which campaign it came from. | Until you clear site data. |
rugonic-ad-click | Local | Only with your yes to ads, once we measure ads: the click reference of the Google ad that brought you (gclid, gbraid or wbraid). | 90 days, or until you withdraw your yes or clear site data. |
rugonic-exp | Local | Not written today. If we ever test two versions of a page, which one you see. | Until you clear site data. |
rugonic-internal | Local | Set only on our own browsers, so our visits aren’t counted. | Until cleared. |
rugonic-sid, rugonic-list | Session | Only when counting is on: the random visit id; which list the last rug you opened came from. | Until you close the tab. |
rugonic-theme-country-link | Session | The country a link asked for ( ?country=), so prices stay in that country’s terms while you look around. | Until you close the tab. |
rugonic-consent-s | Session | That you closed the ship tag’s declaration without answering: nothing is counted for this visit. | Until you close the tab. |
rugonic-cart-id | Session | A random id for your checkout, so an order can be matched to its visit. | Until you close the tab. |
rugonic-theme-rug, rugonic-choice, rugonic-dims-seen | Session | The rug the home page shows first; the size and type you last chose on a rug page; the rugs whose measurements have been drawn. | Until you close the tab. |
rugonic-theme-bagd-reopen, rugonic-theme-focus, rugonic-theme-decl | Session | After a change of currency the page reloads: whether to reopen your bag or the declaration, and where the focus goes back. | Until you close the tab. |
Once we measure our Google ads, and only after your yes to ads, Google’s tag sets _gcl_au and _gcl_aw (90 days) to connect an order to the ad that brought you. Nothing of Google’s loads today.
Our security provider, Cloudflare, may set a strictly necessary cookie (__cf_bm, 30 minutes) to tell people from bots, and cf_clearance if you are ever asked to prove you are one.
The bag, country, hint, surface and session keys are needed for a service you ask for, so they need no consent. The counting keys are written only once counting is on for you. You can clear all of them at any time in your browser’s settings.
Changes to this policy
If we change this policy, we’ll update this page and its date. If the change matters to you, for example a new use of your data, we’ll tell our customers by email first.
Contact
KAVELA LTD, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
Kavela İç Mimarlık ve Mobilya İnşaat Sanayi Ticaret Limited Şirketi, 41/A Üsküp Street, Çankaya, Ankara, Türkiye.