Privacy Policy

Information we collect

Account information includes your name, email address, password hash, and terms-acceptance and email-verification records. Orders and saved delivery details can include recipient names, phone numbers, addresses, location coordinates where provided, products purchased, and payment and delivery status.

We also record account and store activity, such as product views, searches, cart actions, sign-in events, and security records that may include IP addresses. If you use our mobile app, notification registration information may be used to deliver notifications.

Google Sign-In

When Google Sign-In is available and you choose to use it, Google provides basic profile information, including your name, email address, email-verification indication, and a unique Google account identifier. We use this information to authenticate you or, after you complete account setup and accept the terms, create an Achilles account.

Connecting Google to an existing Achilles account requires your explicit action, current Achilles password, and a verified matching Google email. An email match alone does not connect accounts. Achilles does not receive your Google password or request access to your Gmail messages or Google Drive files.

Google-created accounts receive an internally generated random password stored only as a hash. It is not sent to you. You can use our password-recovery flow to establish a password of your own. You can also manage Achilles authorization through your Google Account settings; revoking authorization there does not delete your Achilles account.

How we use information

We use information to manage accounts, process and deliver orders, handle customer requests, send account and order communications, personalize product recommendations, maintain store records, and detect misuse or unauthorized access.

Use and sharing of Google account information

Our Google integration requests only basic identity permissions: OpenID, email, and profile. Google account information is used for the sign-in, account-creation, and explicit account-linking functions described above. It is stored with your Achilles account in our database and is accessible to the systems and authorized personnel operating these account functions. It is not used by the Google integration to read your messages, access your files, or post on your behalf.

Removing Achilles access in your Google Account settings stops that authorization. To request removal of the Achilles account and its stored Google identifier, use the privacy-request contact described below. Records required for orders, security, or legal obligations may be retained as explained in this policy.

Service providers and disclosure

Information is processed through services used to operate Achilles, including database and hosting infrastructure, email delivery, payment processing, and notifications. Our payment integration uses PayMongo; payment information submitted to a payment provider is handled under that provider's privacy practices. Google handles its own authorization process.

Authorized store personnel may access information needed for their responsibilities. Information may also be disclosed where required by law or necessary to address fraud, security incidents, or legal claims. Service providers may process information outside your country.

Cookies and security

Achilles uses session cookies and security tokens to keep you signed in and protect account actions. Disabling necessary cookies may prevent login or checkout from working. Passwords are stored as hashes, and account access is restricted by authentication and authorization controls. No online service can guarantee complete security.

Retention and your choices

Account, order, and security records may remain after an account stops being used. Retention depends on the record type and operational, legal, accounting, and security needs; signing out or revoking Google authorization does not erase these records.

You can correct your profile and saved addresses through your account. Subject to applicable law, you may request access, correction, deletion or blocking, and object to processing of your personal information. Requests may require identity verification, and some records may need to be retained. You may contact the Philippine National Privacy Commission about a privacy concern.

Privacy questions and requests

For privacy questions or requests to access, correct, or delete your personal information, contact Achilles at markjamesdelasalas@gmail.com. Include enough information to identify your account and explain your request. Do not send passwords, payment credentials, or Google authorization codes. We may ask for appropriate identity verification before acting on an account request.

Changes to this policy

Updates will be published on this page with a revised date. Please review this policy when using new account or store features.