Security Overview

How we protect your account, your data and your payments.

🔐 Your connection

• Every page on totot.ae is served over encrypted HTTPS (TLS) — you can verify this from the padlock in your browser’s address bar.
• Our hosting sits behind a firewall with automatic blocking of suspicious traffic.

💳 Your payment details

• We never see or store your card number. Card entry happens on our payment providers’ systems — Stripe and Telr — which are PCI DSS compliant gateways.
• Tabby and Tamara handle their own checkout and identity checks under their licences.
• Cash on Delivery involves no card data at all.
• We only receive a payment confirmation and the last four digits of the card for your invoice.

🗄️ Your data

• Our website and database are hosted on infrastructure located in the United Arab Emirates.
• Access to customer data is limited to the team members who need it for orders, delivery and support.
• We keep WordPress, WooCommerce and our plugins updated, and take regular backups.
• Full detail on data handling is in our Privacy Policy, which follows UAE Federal Decree-Law No. 45 of 2021 (PDPL).

👤 Your account — how to stay safe

• Use a strong, unique password and never share it. Our team will never ask you for your password or for a card CVV.
• We only contact you from @totot.ae email addresses and our official WhatsApp number +971 56 633 7279.
• We never ask for payment by personal bank transfer. If someone requests that in our name, it is a scam — please report it to us.

🚨 Reporting a security concern

If you notice anything suspicious — a strange email, an unexpected charge, or a possible vulnerability on the site — write to support@totot.ae with the subject “Security”. We investigate every report and reply as quickly as we can.

🔄 Keeping this current

We review our security practices and this page regularly. Last internal review: August 2026.