Last updated:
Who we are
talisman.vision is run by Fractal Technologies FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (trade licence no. 34972). We decide how the personal data described here is used.
For privacy questions and requests, email privacy@talisman.vision. For anything else, email hello@talisman.vision.
Talisman Vision is an eyewear concept in development, and ordering is not open. We do not sell personal data, and we do not use advertising or tracking cookies.
What we collect and why
Visiting the site
Your browser sends your IP address, browser details and the page address with every request. Cloudflare, which hosts the site, uses them to deliver pages and protect the site from attacks. Cloudflare also keeps hosting logs for us. They record details of each request our code handles, such as the address requested, the time and result, your IP address, browser details and approximate location, and any error messages our code writes. We use them to find faults and investigate abuse.
Your basket
When you save a frame and lens pairing, we keep your basket on our server: the frames and lenses you chose, their quantities, and when the basket was created and changed. A cookie called talisman-cart holds a random code that links your browser to it. A basket saved without signing in does not hold your name, email address or IP address.
Signing in with your email
If you sign in on the account page, we email you a one-time link that expires after 15 minutes, and we keep your email address with the link. We create your shopper account only when you use the link, so asking for a link you never use does not create one. When you use it, we create the account if you do not have one yet, mark the address as verified, create a matching user record that cannot access our admin area, and keep you signed in for 30 days with a cookie called talisman-customer. Before you sign in, the page the link opens shows a shortened form of the address the link was sent to, so you can check that it is yours. We store only one-way hashes of the link and session codes. While you are signed in, your basket can be kept with your account.
Referrals
Our referral programme is not running. Account pages show no referral links, and we do not set the referral cookie (talisman-referral). If you open an old referral link, an address that starts with talisman.vision/r/, we delete that cookie if your browser still has it and take you to the account page. If your account page offered you a referral link before the programme stopped, we keep that link's code with your shopper account, but the link does not work and the code is not used while the programme is not running. We will update this notice before a referral programme starts.
Protecting sign-in
To stop password guessing and misuse of our sign-in emails, we count sign-in requests from each IP address. For shopper sign-in we store a one-way hash of the address. For staff sign-in we store the address itself (for IPv6, only its network part). We also count the sign-in emails requested for each email address, so no single address can use up the day's emails; these counters are stored under a one-way hash of the email address, not the address itself.
We also limit how many sign-in emails we send each day. Part of that limit is kept for addresses that already have a verified shopper account or an order with us. Once the rest is used up, we check whether the address you enter has one before we send a link. The page gives the same answer either way.
The shopper sign-in form can also show a Cloudflare Turnstile security check, which tells people apart from automated programs. When the form shows it, your browser loads the check from Cloudflare at challenges.cloudflare.com. Cloudflare processes signals such as your IP address, TLS fingerprint and browser details for it, and states in its Turnstile Privacy Addendum that it uses them to detect and block bots, not to identify, profile or target anyone. Before we send a sign-in email, we send the check's result code and your IP address to Cloudflare to confirm the result. We do not store the result code. When the form does not show the check, none of this happens.
Traffic statistics
Cloudflare Web Analytics adds a small script to our pages. It records page views, referring sites, browser and device type, country and page speed. Cloudflare states that it does not use cookies or local storage. We see only totals, never individual visitors. You can block the script with a content blocker, and the site works the same without it.
Staff accounts
For our editors and administrator, we keep their name, email address, role and account status, and a hash of each editor's password. For each sign-in session, we keep the IP address, browser details and times. The administrator signs in through Cloudflare Access, which checks their identity and logs sign-in attempts. Questions typed into our admin reporting assistant are sent to Cloudflare Workers AI to prepare the report, and are not stored.
Mail you send to our addresses is received by Cloudflare Email Routing and forwarded to our company mailbox, where we read and answer it. Sign-in emails are sent by Cloudflare Email Service from no-reply@talisman.vision, and replies to them go to hello@talisman.vision.
Our reasons
Data protection law asks us to have a valid reason for each use. Ours are:
- To provide what you ask for: your basket, sign-in and shopper account, staff access to the admin area, and replies to your emails.
- Our legitimate interest in a working, secure website: hosting logs, sign-in protection, traffic statistics and staff session records. We use these only in ways that do not outweigh your interests.
- Referrals: we collect no new referral data today, because our referral programme is not running. A referral code issued to your account earlier is kept only as part of your account record. We will add the reason here before a programme starts.
- Legal duties: for example, answering a request about your rights.
We do not rely on your consent for anything today.
Who receives your data
We share personal data only with the providers that run the site and our email for us, and with authorities where the law requires it.
Cloudflare, Inc. hosts and protects the site and stores our data in its database (D1), key-value (KV) and file (R2) storage. Cloudflare also provides Web Analytics, which does not use cookies. It provides Email Routing, which forwards mail sent to our addresses to our company mailbox, and Email Service, which sends sign-in emails. When the sign-in form shows a security check, Cloudflare Turnstile runs it. For our admin area, it provides Cloudflare Access and Workers AI.
Mail forwarded by Email Routing is stored by the provider of our company mailbox.
When checkout opens, Stripe will process payments. We will update this notice before then.
International transfers
We are based in the United Arab Emirates. Our providers operate internationally, and Cloudflare runs a global network, so your data may be handled in the country you connect from and stored or accessed in other countries, including the United States. Data protection law in those countries may differ from yours. Where the law requires safeguards for these transfers, we rely on those in our providers' terms.
How long we keep data
- Guest baskets that are not linked to an account: deleted 30 days after they were last changed. The
talisman-cartcookie expires 30 days after it is set. - Referral cookie: not set, because our referral programme is not running.
- Sign-in links and shopper sessions: deleted one day after they expire or are used, or one day after you sign out. The email address kept with a link is deleted with it. Links expire after 15 minutes and sessions after 30 days.
- Sign-in request counters: deleted 24 hours after the last request.
- Staff sessions: expire after at most 12 hours without use, and are then deleted.
- Hosting logs: Cloudflare deletes them after 7 days.
- Traffic statistics: kept by Cloudflare. They contain no cookie or identifier, so we cannot find or delete a single visitor's data.
- Everything else (shopper accounts with the baskets and any earlier referral code linked to them, staff accounts, and emails you send us): until you ask us to delete it.
Your rights
Depending on the law that applies to you, you can ask us to:
- tell you whether we hold personal data about you, and give you a copy;
- correct data that is wrong or incomplete;
- delete your data;
- limit or stop how we use it, including objecting to uses based on our legitimate interest;
- give you the data you provided in a format you can reuse.
To use these rights, email privacy@talisman.vision. We may ask you to confirm that the request comes from you. We reply within one month, and there is no charge. You can also complain to a data protection authority, for example where you live or work.
A guest basket is not linked to your name or email address, so we cannot look it up for you. You can empty it on the basket page or delete the cookie in your browser. The basket is then deleted 30 days after its last change.
Cookies
The public site sets its own cookies only for the basket and shopper sign-in. When the sign-in form shows the Cloudflare Turnstile check, Cloudflare may use its own cookies or browser storage for that check. Our cookie page lists each one, what it does and how long it lasts.
Security
Our pages are served over HTTPS. Scripts on the page cannot read our cookies. We store passwords, sign-in links and shopper session codes only as one-way hashes.
Changes
We will update this notice when the site or our use of personal data changes, and before checkout opens. The date at the top shows when it last changed.