Payment Security

The card number, expiry date and security code fields at checkout are not part of this website. They are secure fields hosted by our PCI-DSS Level 1 certified payment provider and displayed inside this page, so the values you type go directly to them and never pass through, or rest on, any system we operate.

This is a deliberate architectural choice rather than a claim about our carefulness. We cannot leak a card number we have never held.

What we receive back is a token — a reference that lets us charge the card for this order — plus the last four digits, the card brand, the issuing country and the card type. That is the entire set of card information available to us, and it is what appears on your order record.

Every page on this site, including every page before and after checkout, is served over TLS with a 256-bit cipher. There is no unencrypted version of this site; requests to the insecure port are redirected before any data is sent.

The connection carrying your card details is established directly between your browser and the payment provider, with its own certificate.

Some payments are routed through 3-D Secure, the additional verification step your bank runs — you may be asked to approve the payment in your banking app or to enter a code sent to your phone.

Whether this happens is decided by your bank and the payment network, not by us, and it is more likely on higher-value orders and on cards being used at a new merchant. If it happens, complete the step in the window that opens; closing it will leave the order unpaid.

We store your name, email address, delivery address, billing address, the items you bought, the amount charged, and the card token, brand and last four digits. We keep order records for seven years, because tax and accounting rules require it.

We never store a full card number, an expiry date or a security code, because we never receive one.

We do not sell customer information, and we do not share it with anyone except the parties needed to complete your order: the payment provider that processes the charge, and the carrier that delivers the parcel.

Your card statement will show OROVIA.

If a charge is not familiar, contact us before disputing it — hello@oroviatable.com, or call during Monday–Friday, 9:00am–5:00pm PT. We can identify an order from the amount and the last four digits of the card in a few minutes.