In short
- Your cart, wishlist, account details, orders and routine tracker are saved on your own device, not on our servers.
- To sign in you only need your phone number: we send you a one-time code on WhatsApp. There's no password.
- Mi remembers you only if you say yes, and health details (pregnancy, allergies, age) need a yes of their own. If you're under 18, she keeps nothing.
- What you tell Mi or our WhatsApp assistant is sent to AI providers so they can answer you.
- We don't sell your data, and we use no advertising or analytics trackers.
- You can delete your account in the app at any time. We keep only the orders and invoices the law requires.
1Who we are
CHOMI (تشومي) is an online store for Korean beauty products in Saudi Arabia, on chomi.store and in the CHOMI app for iPhone. It is run by ChoMI Company, commercial registration 4030607670, VAT number 312785923700003, Madinah Road (service road), Jeddah 23442, Saudi Arabia.
We decide how the personal data described here is used, and we handle it under Saudi Arabia's Personal Data Protection Law (PDPL).
2What stays on your device
Much of CHOMI works without sending your details to anyone. These are saved in your browser on the website, or on your phone in the app, and stay there until you delete them:
- your cart, wishlist and the routine bundle you added;
- your account details on the website: name, email, birthday, skin type and delivery addresses, with the map pin if you drop one;
- your Ask the expert answers and routine report;
- your conversation with Mi, which lasts only while that page (or the app) is open;
- the routine tracker: your daily check-ins, skin scores, notes and progress photos.
Clearing your browser's data for chomi.store, or deleting the app, removes them. Because they never reach us, we can't see them or recover them for you.
3What we collect, and why
Some features need to send data to us or to a service we use. Here is each one: what it sends, and why.
Signing in with your phone
You sign in with your phone number. We send a six-digit code to it on WhatsApp, through our WhatsApp provider, and the code expires after 5 minutes. There's no password.
Once you're in, a secure cookie keeps you signed in on that device for 30 days. Signing in on its own doesn't save your number with us; we keep it only with the features below that need it.
Ask Mi and calls with Mi
What you write or say to Mi, with the chat so far and the skin details you've shared (including health details such as pregnancy, allergies or being under 18), is sent through our server to an AI provider so it can write her answer: Anthropic (Claude), or OpenAI if our team switches her to it. Mi uses health details only to leave out what doesn't suit you.
When you call Mi, your browser or the app asks to use your microphone, and it's on only during the call. Your voice goes straight to OpenAI, which turns it into words for Mi. Her answers are spoken by ElevenLabs, which receives the text of what she says. If these aren't available, your device's own speech recognition and voice are used instead, under its maker's terms.
For a warmer hello, a call may use the city and map pin of your saved address: our server rounds the location to about 10 km and asks Open-Meteo for the weather there.
What Mi remembers
Mi asks whether she may remember you, and you choose separately: (1) your skin profile, routine and her notes; (2) health details: pregnancy, allergies and age, which are sensitive data. If you say no, she forgets everything when you close the page. If you're under 18, she keeps nothing.
If you agree while signed out, or in the app, the memory stays on that device. If you're signed in on the website, it's saved with your account on our server, so Mi knows you on any device. It's filed under a coded key made from your phone number, not the number itself, and holds only what you agreed to, plus the products you've ordered so Mi can tell when they're running low. It never holds your name.
You can change your choice or clear Mi's memory at any time from your skin profile. Clearing it deletes the copy on our server too.
Ask the expert and the routine tracker
Ask the expert asks about your skin, your age group, whether you're pregnant, and anything you'd like to add, to build your routine. When the routine is written by our AI, your answers go through our server to Anthropic (Claude). The report is saved on your device.
The tracker's check-ins and photos stay on your device. Only when you ask for an AI analysis of a day are that day's scores, steps and note, your recent days, and, if you tick it, that day's photo and your first photo sent to Anthropic (Claude) through our server, for that analysis only. We don't store them.
Reminders are set on your own device: the website gives you a calendar file, and the app schedules them on your phone.
When you message us on WhatsApp, we keep your number, your WhatsApp name, your messages and any photos you send, with our replies, so our team can follow the conversation.
Our automatic assistant reads your messages and answers with the help of Anthropic (Claude); it can look at skin photos you send to suggest a routine. Our team can step in at any time, and you can always ask for a person.
We also use WhatsApp for sign-in codes, order updates and the back-in-stock alerts you ask for. To stop our other messages, write “stop messages” (or «إيقاف الرسائل») to us.
Messages pass through WhatsApp (Meta) and our WhatsApp provider, 360dialog, under their own terms.
Product requests and votes
When you suggest a product, we keep the brand, the product name and any link you add; our server opens the link to show the product's picture and details. Your first name is shown on the request, and your phone number is kept for our team, to reach you about your reward.
Votes are saved under a coded key made from your phone number, not the number itself, so each request gets one vote from you a month.
Reviews
To write a review you sign in with your phone. We keep your stars, your words, the name you enter and your phone number. Once our team has checked it, your review appears with the name you gave; your number is never shown. We use it to mark reviews from customers and to let you edit yours.
If our team sends you a private review link, it carries your name and the products from your order.
Back-in-stock alerts and the newsletter
If you ask to be told when a product is back, we keep your phone number, the product and your language, and send you a WhatsApp message when it returns.
If you tap “I want it” on a product on the Korea trends page, we keep your phone number, the product and your language, to count you among those who want it and message you on WhatsApp when it's here. Everyone sees how many want each product, never who.
If you join the newsletter, we keep your email address and language to send you news and offers; the emails are sent through Resend. Every email has a link to unsubscribe, which removes you.
Checkout and addresses
You can fill in your address from its Saudi National Address short code or a map pin: our server looks it up with the National Address service (address.gov.sa). The map is shown by Google Maps, which receives the pin's location. If you use your current location, your browser asks you first.
When you place an order, it goes to Shopify, which runs our orders: your name, phone number, email (if you give it), delivery address and map pin, what you bought and how you pay. That's what shows under My orders, and we send you its updates and tax invoice on WhatsApp and by email (through Resend).
If you pay with Tabby or Tamara, you finish on their page: they receive your name, phone number, email, address and the order, to approve and collect your payments under their own terms. Cash on delivery involves no payment provider.
BaridX, which stores and delivers our orders, receives your name, phone number, address and map pin to bring you your parcel.
The contact form
The contact form sends nothing to us by itself: it opens WhatsApp, or your email app, with your message ready for you to send.
Cookies and technical data
The website uses two cookies: one remembers your language (for a year), the other keeps you signed in (30 days). There are no advertising or analytics cookies.
Like any website, our servers see your IP address. We use it briefly to stop abuse, such as too many sign-in codes, and don't build profiles from it. Product photos load from Salla's image servers (cdn.salla.sa), which also see it. Our hosting provider, DigitalOcean, keeps technical logs of requests for a short time to run and protect the service.
4The CHOMI app
The app for iPhone follows the same rules as the website, and keeps even more on your phone:
- Your cart, wishlist, recent searches, language, Ask the expert answers and report, Mi's memory (if you agree) and your routine tracker are saved on your phone only.
- Progress photos you take or pick are saved inside the app on your phone. It asks for the camera or your photos only when you add one, and a photo leaves your phone only if you tick the box to send it for an AI analysis of that day.
- Talking to Mi works as on the website: your messages and skin profile go to chomi.store and our AI provider so Mi can answer, and the microphone is on only during a call.
- Before anything you tell Mi, Ask the expert or the tracker goes to an AI provider, the app asks for your OK once and names each provider. You can take it back at any time under Account → Mi & AI.
- Routine reminders are scheduled on your phone; the app asks to send notifications when you turn them on. We don't send push notifications.
- The home-screen widget shows today's routine steps and the name you gave in Ask the expert. The app shares these with its widget on your phone only, through an iOS App Group.
- The app has no advertising, analytics or tracking tools, and doesn't track you across other apps or websites.
Deleting the app deletes everything it saved. Inside the app you can also clear Mi's memory, stop tracking and delete your log and photos, and clear your recent searches. To delete your account with us too, see “Deleting your account” below.
6Data outside Saudi Arabia
Some of these providers, including the AI and voice providers, process data on servers outside the Kingdom.: mainly in the United States (Anthropic, OpenAI, ElevenLabs, Resend, Google), Canada and the United States (Shopify), and Germany (DigitalOcean, 360dialog), with WhatsApp messages on Meta's servers. We send each one only what its feature needs, and rely on its data protection terms, as the PDPL and its regulation on transferring personal data outside the Kingdom allow.
7How long we keep it
- On your device: until you delete it, clear your browser's data or delete the app.
- Sign-in codes: 5 minutes. The sign-in cookie: 30 days. The language cookie: one year.
- Mi's memory on our server: until you clear it, or 12 months after it was last updated.
- WhatsApp conversations and photos: 12 months after the last message.
- Reviews: while they're shown on the site. Votes: 12 months. Product requests stay on the list, without your name or number after 12 months.
- Back-in-stock alerts: deleted 30 days after the alert is sent.
- “I want it” on the Korea trends page: deleted 30 days after we tell you the product is here, or 12 months after you asked.
- The newsletter: until you unsubscribe.
- Records the law requires us to keep, such as your orders and their invoices, even after you delete your account: 10 years, as the Law of Commercial Books requires.
8Your rights
Under the PDPL you can:
- know what data we hold about you and why (this page);
- get a copy of it;
- ask us to correct it;
- ask us to delete it, unless the law requires us to keep it, or delete your account yourself in the app;
- withdraw your consent at any time, for example by clearing Mi's memory or unsubscribing.
Write to us at [email protected] or on WhatsApp at +966 58 192 0766, from the number you used with us, so we can confirm it's you. We reply within 30 days. If you're not satisfied with our answer, you can complain to the Saudi Data & AI Authority (SDAIA).
9Deleting your account
In the CHOMI app, open Account and tap Delete account. The app tells you what will be deleted and asks you to confirm. Deleting is final: we can't bring your account back afterwards. On the website, or if you'd rather we did it, write to us at [email protected] or on WhatsApp at +966 58 192 0766 from the number you sign in with.
Deleting your account removes what we keep under your phone number:
- what Mi remembers about you on our server;
- your votes. The products you suggested stay on the list without your name or number, and one that nobody else voted for is removed;
- your back-in-stock alerts, and the products you said you want on the Korea trends page;
- your reviews, and the private review links we sent you;
- your record in our customer list;
- your WhatsApp conversations with us, with the photos you sent;
- your number in our records of the order updates and bulk messages we sent you, and in our team's activity log.
We keep your orders and their tax invoices, because the law requires us to keep them for 10 years. They're no longer linked to your account: if you sign in again with the same number, you start with a new, empty account, and they won't show under My orders. An order still waiting for online payment, or for a shipping quote, is cancelled.
You're signed out on the device you deleted your account from. Other devices where you're signed in stay signed in until you sign out there or 30 days pass, but nothing of yours is left on our server for them to show.
What's saved only on your device isn't touched: delete the app, or clear your browser's data for chomi.store, to remove it.
10Under 18
You need to be 18 or over to use CHOMI on your own; under 18, use it only with your parent or guardian's permission. Mi doesn't keep anything for anyone who tells her she's under 18.
11Keeping it safe
The website and the app use encrypted connections. Your sign-in cookie is signed, and scripts on the page can't read it. Where we only need to recognise you (votes, Mi's memory), we use a coded key instead of your phone number, and only our team can open our tools.
No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.
12Changes to this policy
When we change how we use your data, we'll update this page and the date at the top. If a change needs your consent, we'll ask you first.
A question about your privacy?
Write to us about anything on this page, or to use any of your rights. There's no separate data protection officer: the same email and WhatsApp number reach the team responsible for your data.
- Commercial registration
- 4030607670
- VAT number
- 312785923700003
