Privacy policy

SANA THE LABEL — Privacy Policy

Effective Date: 11 May 2026
Last Updated: 9 July 2026

This Privacy Policy describes how SANA The Label ("we," "us," or "our") collects, uses, and shares personal information when you use the SANA mobile application (the "App") and our website sanathelabel.com (collectively, the "Services").

By using the Services, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide
- Account information — name and email address when you create an account. Sign-in is passwordless (a one-time code sent to your email); we do not collect or store a password.
- Order information — shipping and billing addresses, items purchased, and order history.
- Payment information — payment is processed by our payment processor (Shopify Payments). We do not store full card numbers; we receive only a tokenised reference and the last four digits of your card for receipt display.
- User-generated content — comments you post on shoppable ("Runway") videos in the App. These are public: your comment text and the first name on your account are visible to other users. You can report or block others' comments, and you can delete your own.
- In-app chat messages — when you message our Client Care team ("Mariam") inside the App, the content of your messages (and our replies) is stored so we can read, answer, and keep a history of your conversation. Your first name and email are attached so we can identify and follow up with you.
- Order reviews — if you choose to rate or review an order, we store your star rating and any written comment, linked to your order, to improve our products and service.
- Bug reports — if you use "Report a problem," the description you write (and, if you are signed in, your email address) is sent to our error-monitoring provider so we can diagnose and fix the issue and, where you provide an email, follow up.
- Communications — messages you send us via support email or social channels.

1.2 Information Collected Automatically
- Device information — device model, operating system version, unique device identifiers, and crash logs.
- App usage data — pages and products viewed, items added to cart, and features used.
- Location data — approximate location derived from your device's regional setting (country only), used to display prices in your local currency. We do not collect precise GPS location.
- Cookies and similar technologies — used in the in-app browser during checkout to maintain your session.

1.3 Information from Third Parties
- Shopify — for catalogue, inventory, cart, and checkout data.
- Analytics providers — pseudonymised usage statistics to help us improve the App (see section 3.1 for named providers).

2. How We Use Your Information

We use your information to:
- Process and fulfil orders, including shipping, returns, and refunds.
- Provide customer support, including answering your in-app chat messages and following up on bug reports you send us.
- Display prices in your local currency.
- Send order confirmations, shipping updates, and (with your consent) marketing communications.
- Improve the App, diagnose technical issues, and prevent fraud, including reviewing order feedback you submit.
- Administer our loyalty rewards programme.
- Comply with legal obligations (tax, accounting, consumer protection law).

3. How We Share Your Information

We share personal information only as follows:
- Service providers — see section 3.1 for the named list of providers and the data they receive, all bound by contractual confidentiality obligations.
- Legal compliance — when required by law, court order, or to protect our rights, property, or safety.
- Business transfers — in connection with any merger, acquisition, or sale of assets, your information may be transferred to the successor entity.

We do NOT sell your personal information to third parties.

3.1 Named Service Providers (Processors)
- Shopify Inc. — E-commerce platform, cart, checkout, order management, payments (PCI-DSS certified). Data received: name, email, address, order history, payment tokenisation. Location: USA (with adequacy/SCCs).
- Supabase Inc. — Database and backend: wishlist, back-in-stock/price-drop watches, loyalty ledger, push-token storage, comments you post on shoppable videos, in-app chat with our Client Care team, and order reviews. Data received: account identifiers, your email and Shopify customer reference (to link your account), wishlist, notification preferences, loyalty points, device push token, comment text (shown publicly with your first name), the content of your in-app chat messages, and order ratings/reviews. Location: Australia (Sydney, ap-southeast-2).
- Klaviyo Inc. — Email and marketing automation: order and shipping emails, back-in-stock and price-drop alerts, and abandoned-cart reminders. Data received: email, name, order history (for segmentation). Location: USA (ISO 27001; SCCs for EU/UK).
- Expo (650 Industries, Inc.) — Push-notification delivery (Expo push service). Data received: device push token and the notification content sent to your device. Location: USA (SCCs for EU/UK).
- Sentry (Functional Software Inc.) — Crash reporting, error monitoring, and user-submitted bug reports. Data received: crash logs, device model, OS version, anonymised stack traces, and — when you file a bug report — the description you write plus your email address if you provide one. Location: USA (SCCs for EU/UK).
- PostHog Inc. — Product analytics and funnel measurement. Data received: pseudonymous event data (screens and products viewed, items added to cart) tied to a random device identifier only; we do NOT send your name, email, or address. Location: EU (eu.posthog.com).

All providers are prohibited from using your data for their own commercial purposes.

4. International Data Transfers

We are based in Australia. If you access the Services from outside Australia, your information will be transferred to, stored, and processed in Australia and in other countries where our service providers operate (see section 3.1). We rely on adequacy decisions and standard contractual clauses where required by law.

5. Data Retention

We retain personal information for as long as your account is active, as needed to provide the Services, and as required to comply with our legal obligations (typically 7 years for financial records in Australia). When information is no longer needed, we securely delete or de-identify it.

We keep your in-app chat conversations and support records (including bug reports and order reviews) for as long as your account is active and for a reasonable period afterwards so we can resolve queries, honour warranties and returns, and meet our legal obligations. We do not sell your chat messages, reviews, or support communications, and we do not use them for advertising. When you delete your account, this information is deleted or de-identified except where we are required to retain it by law.

Loyalty points expire after 12 months of inactivity. You will be notified before expiry.

6. Your Rights

Depending on your jurisdiction, you may have the right to:
- Access — request a copy of the personal information we hold about you.
- Correct — request that we update inaccurate or incomplete information.
- Delete — request that we delete your personal information ("right to be forgotten"). You may also delete your account directly within the App (Account → Delete Account).
- Restrict or object — to certain processing.
- Data portability — receive a copy of your data in a portable format. Email info@sanathelabel.com to request an export and we will provide it within 30 days.
- Withdraw consent — for marketing communications at any time.
- Lodge a complaint — with a supervisory authority (e.g., OAIC in Australia, ICO in the UK, your state Attorney General in the US).

To exercise any of these rights, email info@sanathelabel.com. We will respond within 30 days.

California Residents (CCPA / CPRA): You have the right to know what categories of personal information we collect, to delete your information, to opt out of any sale/sharing (we do not sell), and to non-discrimination for exercising these rights.

European Residents (GDPR): Our legal bases for processing are: (a) performance of a contract (orders), (b) legitimate interests (security, fraud prevention, product improvement, loyalty programme administration), (c) consent (marketing), and (d) legal obligations (tax, accounting).

Australian Residents (Privacy Act 1988): We comply with the 13 Australian Privacy Principles. You may contact the OAIC at www.oaic.gov.au.

7. Children's Privacy

The Services are not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.

8. Security

We use industry-standard technical and organisational measures to protect your information, including encryption in transit (TLS), encrypted on-device storage of authentication tokens (using hardware-backed key storage on iOS and Android), and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

9. Permissions Used by the App

The App may request the following device permissions:
- Notifications — to send order updates and (with your consent) promotional notices. You can disable this in your device settings at any time.

No permission is used in the background or without an action you initiate.

10. Third-Party Links

The App may contain links to third-party websites (e.g., the Shopify-hosted checkout). We are not responsible for the privacy practices of those sites. Please review their policies separately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified in-app or by email. The "Last Updated" date at the top reflects the most recent version.

12. Contact Us

For privacy questions or to exercise your rights:

SANA THE LABEL
Email: info@sanathelabel.com
Website: https://sanathelabel.com

© 2026 SANA THE LABEL. All rights reserved.