YOUR INFORMATION

Privacy Policy

Last updated: September 27, 2026

Who operates this site

AliEspresso is an independently operated deal-discovery website. Its operator is responsible for the processing described in this policy.

This policy covers aliespresso.com. AliExpress, sellers and external image hosts operate separately; their own privacy notices apply to their services.

What we process and why

• Page delivery and security: IP address, request time, requested URL path, request method, response status and related technical information may appear in server logs. We use them to deliver the site, investigate errors and defend against abuse. Failed administrative logins and requests to decoy paths create IP-based security records and may trigger a temporary block. These records contain counters, timestamps, a reason and the requested path, not submitted passwords.
• Country selection: we estimate your country using an IP database on our server. We do not send your IP address to a geolocation API for this lookup and do not request precise device location. If you select a country, a cookie remembers the country code.
• Basic usage statistics: product-page views and outbound affiliate clicks create records containing the product, event type, time and referring website hostname when available. These event records do not include your IP address, a visitor identifier or the full referring URL. They are event counts, not a record of purchases or unique people.
• Administration: authorised administrators use account, session, authentication and audit records. Public visitors do not need an account to browse.
• Messages you send us: if you contact us, we process your contact details and message to respond. Do not send passwords, payment details or unnecessary identity documents.

We rely on legitimate interests in operating, securing and improving this service for proportionate technical logging, security and basic service measurement. Requested settings and administrative access support the service you request. We rely on legal obligations where applicable. If a future feature requires consent, it must be introduced with the appropriate choice rather than treating this policy as consent.

Cookies and browser choices

• delivery_country: your selected delivery country; up to 180 days.
• sessionid: an administrative login session; configured for four hours.
• csrftoken: protection for forms such as administrative login; the framework can retain it for approximately one year.

The current site does not install a third-party advertising or analytics script. Browser settings let you remove or block cookies. Removing the country cookie forgets your preference; blocking security/session cookies can prevent administration or protected forms from working.

Affiliate links and external content

We may earn a commission if you purchase through an affiliate link. Those links contain partner attribution information. Following a link sends you to AliExpress, where AliExpress or its partners may use their own tracking and cookies under their own policies. We do not receive your payment-card details or delivery address through this website.

Product images may load directly from external hosts even before you click an affiliate link. The image host receives the network information needed to deliver the image, including your IP address and request headers. Its processing is outside this website's own logs and cookie settings.

Recipients and locations

Hosting and infrastructure providers process information needed to operate the site. Access to management data is restricted to the operator and authorised personnel. Information may also be disclosed where required by law or reasonably necessary to investigate an incident or defend a legal claim. We do not sell our visitor event records.

External services may process information in countries other than yours. Their recipients, locations and safeguards are described in their own notices. Contact us for information about the hosting arrangements relevant to this site's own processing and any applicable international-transfer safeguards.

How long information is kept

• System and web logs use rotation and approximately seven-day retention settings; size thresholds can remove records earlier.
• IP bans normally last 24 hours. Inactive security records are pruned after seven days or earlier when the history limit is reached; active bans remain until expiry.
• Product view/click records are kept for up to 90 days, with a maximum of 100,000 records. Deleting a product also deletes its associated event records.
• Administrative audit history is limited to 180 days/10,000 records; completed bot-run history to 30 days/1,000 records. Expired sessions and disposable cache are cleaned regularly.
• Database backups retain seven daily copies. Separate deployment/recovery snapshots can retain older database information beyond the live-record retention periods; access is restricted and they are not used as live visitor profiles.

Cleanup runs periodically, so expiry and physical deletion need not occur at precisely the same instant. Records needed for an active security investigation, legal requirement or claim may need to be retained longer. Contact correspondence is kept as necessary to resolve the request and meet applicable obligations.

Your rights and requests

Depending on applicable law, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where consent is used, it can be withdrawn without affecting earlier lawful processing. These rights have legal conditions and exceptions.

A data request should describe the information or activity concerned. Proportionate information may be needed to verify a request and locate a record. We do not collect extra visitor identifiers merely to identify otherwise unlinked event records. You may complain to the relevant data-protection authority, including the authority where you live or work when applicable. Exercising a right does not require giving up any other statutory remedy.

Updates

We will update this page when our practices change and revise the date above. A policy update does not itself authorise a new use of information that requires a separate legal basis or consent.