Privacy policy

SANA THE LABEL — Privacy Policy

Effective Date: 11 May 2026
Last Updated: 5 October 2026

This Privacy Policy describes how SANA The Label ("we," "us," or "our") collects, uses, and shares personal information when you use the SANA mobile application (the "App") and our website sanathelabel.com (collectively, the "Services").

By using the Services, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide
- Account information — name and email address when you create an account. Sign-in is passwordless (a one-time code sent to your email); we do not collect or store a password.
- Order information — shipping and billing addresses, items purchased, and order history.
- Payment information — payment is processed by our payment processor (Shopify Payments). We do not store full card numbers; we receive only a tokenised reference and the last four digits of your card for receipt display.
- User-generated content — comments you post on shoppable ("Runway") videos in the App. These are public: your comment text and the first name on your account are visible to other users. You can report or block others' comments, and you can delete your own.
- In-app chat messages — when you message our Client Care team ("Mariam") inside the App, the content of your messages (and our replies) is stored so we can read, answer, and keep a history of your conversation. Your first name and email are attached so we can identify and follow up with you.
- Order reviews — if you choose to rate or review an order, we store your star rating and any written comment, linked to your order, to improve our products and service.
- Bug reports — if you use "Report a problem," the description you write (and, if you are signed in, your email address) is sent to our error-monitoring provider so we can diagnose and fix the issue and, where you provide an email, follow up.
- Communications — messages you send us via support email or social channels.

1.2 Information Collected Automatically
- Device information — device model, operating system version, unique device identifiers, and crash logs.
- App usage data — pages and products viewed, items added to cart, and features used.
- Location data — approximate location derived from your device's regional setting (country only), used to display prices in your local currency. We do not collect precise GPS location.
- Cookies and similar technologies — used in the in-app browser during checkout to maintain your session.

1.3 Information from Third Parties
- Shopify — for catalogue, inventory, cart, and checkout data.
- Analytics providers — pseudonymised usage statistics to help us improve the App (see section 3.1 for named providers).

2. How We Use Your Information

We use your information to:
- Process and fulfil orders, including shipping, returns, and refunds.
- Provide customer support, including answering your in-app chat messages and following up on bug reports you send us.
- Display prices in your local currency.
- Send order confirmations, shipping updates, and (with your consent) marketing communications.
- Improve the App, diagnose technical issues, and prevent fraud, including reviewing order feedback you submit.
- Administer our loyalty rewards programme.
- Comply with legal obligations (tax, accounting, consumer protection law).

3. How We Share Your Information

We share personal information only as follows:
- Service providers — see section 3.1 for the named list of providers and the data they receive, all bound by contractual confidentiality obligations.
- Legal compliance — when required by law, court order, or to protect our rights, property, or safety.
- Business transfers — in connection with any merger, acquisition, or sale of assets, your information may be transferred to the successor entity.

We do NOT sell your personal information to third parties.

3.1 Named Service Providers (Processors)
- Shopify Inc. — E-commerce platform, cart, checkout, order management, payments (PCI-DSS certified). Data received: name, email, address, order history, payment tokenisation. Location: USA (with adequacy/SCCs).
- Supabase Inc. — Database and backend: wishlist, back-in-stock/price-drop watches, loyalty ledger, push-token storage, comments you post on shoppable videos, in-app chat with our Client Care team, and order reviews. Data received: account identifiers, your email and Shopify customer reference (to link your account), wishlist, notification preferences, loyalty points, device push token, comment text (shown publicly with your first name), the content of your in-app chat messages, and order ratings/reviews. Location: Australia (Sydney, ap-southeast-2).
- Klaviyo Inc. — Email and marketing automation: order and shipping emails, back-in-stock and price-drop alerts, and abandoned-cart reminders. Data received: email, name, order history (for segmentation). Location: USA (ISO 27001; SCCs for EU/UK).
- Expo (650 Industries, Inc.) — Push-notification delivery (Expo push service). Data received: device push token and the notification content sent to your device. Location: USA (SCCs for EU/UK).
- Sentry (Functional Software Inc.) — Crash reporting, error monitoring, and user-submitted bug reports. Data received: crash logs, device model, OS version, anonymised stack traces, and — when you file a bug report — the description you write plus your email address if you provide one. Location: USA (SCCs for EU/UK).
- PostHog Inc. — Product analytics and funnel measurement. Data received: pseudonymous event data (screens and products viewed, items added to cart) tied to a random device identifier only; we do NOT send your name, email, or address. Location: EU (eu.posthog.com).

All providers are prohibited from using your data for their own commercial purposes.

3.2 Website Cookies, Analytics and Advertising

Our website (sanathelabel.com) uses cookies, pixels and similar technologies from the providers below to run the shop, measure visits, and show and measure our ads. Unlike the processors in section 3.1, these providers also handle this data under their own privacy policies.

• Shopify — cart, checkout, security and store analytics.
• Meta Platforms (Facebook and Instagram) — Meta Pixel and Conversions API, to measure ad results and show our ads to people who have visited our website.
• Google — Google Ads tag and Google Merchant Center, to measure ad results and show our ads and products on Google.
• TikTok — TikTok Pixel and Events API, to measure ad results.
• Klaviyo — records products viewed and items added to cart by subscribers, so we can send relevant emails such as cart reminders.
• Afterpay — shows instalment payment options on product pages and at checkout.
• Microsoft Clarity — heatmaps and session recordings, so we can see how visitors move through our pages and improve them. Text you type is masked by default and is never used for advertising.

These providers may receive your IP address, device and browser details, the pages you view, items added to cart and purchases, and, when you place an order, hashed (encrypted) contact details used to match ad results. You can opt out of the use of your data for targeted advertising through the “Your Privacy Choices” link in our website footer, block or delete cookies in your browser settings, and manage ad preferences in your Meta, Google and TikTok accounts.

How we improve the SANA app: session recordings and heatmaps

We want the SANA app to be easy to shop. To see where it works well and where it gets in the way, we use Microsoft Clarity, a service that shows us how people move through the app.

What we collect

While you browse the shopping parts of the app (Home, Shop, Runway, Saved, product pages, your bag and search), Clarity receives:

• how you use the screen: where you tap, how far you scroll, which screens you open and in what order, and how long you stay;
• a recording of those screens, so we can replay a visit the way you saw it. Text and images on screen are hidden in these recordings, and anything you type into a box is always hidden;
• basic details about your device: the type of phone, its operating system, the app version, your screen size and an approximate location (your country or city, worked out from your internet connection, not from GPS).

What we don't collect

• We never record the parts of the app that are about you: chats with our team, your addresses, your orders and returns, your profile, My Fit, the affiliate pages, Worn by you, or Shopify's checkout while you pay.
• We don't tell Clarity who you are. We never send your name, email address, phone number, account or customer number. Clarity gives your phone its own random number so it can tell one visit from the next, and that's all it knows.
• We don't use it for advertising. We don't use Clarity to track you across other apps or websites, and we don't connect it to any advertising service.
• Our team isn't recorded either. When our staff use the app, Clarity is switched off.

Why we collect it

To find and fix things that are hard to use: a button people keep tapping that doesn't respond, a page people leave too soon, a step that's confusing. We look at patterns across many visits, not at you personally.

Who can see it

Only our team, in Clarity's dashboard. Microsoft provides Clarity and stores this information for us on its servers, which may be outside Australia. Microsoft handles it on our behalf and under the Microsoft Clarity terms.

How long we keep it

Clarity keeps recordings for 30 days, and keeps the overall figures (such as heatmaps and counts) for up to 13 months. If we save a recording because it shows a problem we need to fix, we keep it until the problem is fixed.

Your choices and your rights

We handle this information in line with the Australian Privacy Principles in the Privacy Act 1988. You can ask us what we hold about you, ask us to correct it, or ask us to delete it by emailing info@sanathelabel.com. Because we don't link recordings to your name or account, please tell us roughly when you used the app and on what kind of phone, so we can find them.

If you have a concern about how we've handled your information, please email us first so we can put it right. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

4. International Data Transfers

We are based in Australia. If you access the Services from outside Australia, your information will be transferred to, stored, and processed in Australia and in other countries where our service providers operate (see section 3.1). We rely on adequacy decisions and standard contractual clauses where required by law.

5. Data Retention

We retain personal information for as long as your account is active, as needed to provide the Services, and as required to comply with our legal obligations (typically 7 years for financial records in Australia). When information is no longer needed, we securely delete or de-identify it.

We keep your in-app chat conversations and support records (including bug reports and order reviews) for as long as your account is active and for a reasonable period afterwards so we can resolve queries, honour warranties and returns, and meet our legal obligations. We do not sell your chat messages, reviews, or support communications, and we do not use them for advertising. When you delete your account, this information is deleted or de-identified except where we are required to retain it by law.

Loyalty points expire after 12 months of inactivity. You will be notified before expiry.

6. Your Rights

Depending on your jurisdiction, you may have the right to:
- Access — request a copy of the personal information we hold about you.
- Correct — request that we update inaccurate or incomplete information.
- Delete — request that we delete your personal information ("right to be forgotten"). You may also delete your account directly within the App (Account → Delete Account).
- Restrict or object — to certain processing.
- Data portability — receive a copy of your data in a portable format. Email info@sanathelabel.com to request an export and we will provide it within 30 days.
- Withdraw consent — for marketing communications at any time.
- Lodge a complaint — with a supervisory authority (e.g., OAIC in Australia, ICO in the UK, your state Attorney General in the US).

To exercise any of these rights, email info@sanathelabel.com. We will respond within 30 days.

California Residents (CCPA / CPRA): You have the right to know what categories of personal information we collect, to delete your information, to opt out of any sale/sharing (we do not sell), and to non-discrimination for exercising these rights.

European Residents (GDPR): Our legal bases for processing are: (a) performance of a contract (orders), (b) legitimate interests (security, fraud prevention, product improvement, loyalty programme administration), (c) consent (marketing), and (d) legal obligations (tax, accounting).

Australian Residents (Privacy Act 1988): We comply with the 13 Australian Privacy Principles. You may contact the OAIC at www.oaic.gov.au.

7. Children's Privacy

The Services are not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.

8. Security

We use industry-standard technical and organisational measures to protect your information, including encryption in transit (TLS), encrypted on-device storage of authentication tokens (using hardware-backed key storage on iOS and Android), and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

9. Permissions Used by the App

The App may request the following device permissions:
- Notifications — to send order updates and (with your consent) promotional notices. You can disable this in your device settings at any time.

No permission is used in the background or without an action you initiate.

10. Third-Party Links

The App may contain links to third-party websites (e.g., the Shopify-hosted checkout). We are not responsible for the privacy practices of those sites. Please review their policies separately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified in-app or by email. The "Last Updated" date at the top reflects the most recent version.

12. Contact Us

For privacy questions or to exercise your rights:

SANA THE LABEL
Email: info@sanathelabel.com
Website: https://sanathelabel.com

© 2026 SANA THE LABEL. All rights reserved.