Legal

Privacy policy

What we collect, why, and who else sees it. No trackers, no data sales, and a plain account of where your details go.

Last updated August 2026

What this covers

This policy explains what personal information this website collects, why, where it goes and what you can do about it. It applies to customers in Australia, the United States, Canada and the United Kingdom.

The company handling your information is HAYAITI HOLDINGS LTD, an Ontario corporation. That means Canadian privacy law, PIPEDA, applies to what we do. Because we sell into other countries, more than one regime can apply at once, and the practical answer is that we hold you to whichever gives you more.

Canada: PIPEDA, the federal private sector privacy law, and provincial law where it applies.
Australia: The Privacy Act 1988 and the Australian Privacy Principles.
United Kingdom: UK GDPR and the Data Protection Act 2018.
United States: State privacy law where you live, including the CCPA and CPRA if you are in California.
Data controller: HAYAITI HOLDINGS LTD, 4 Robert Speck Parkway, Suite 1200, Mississauga ON L4Z 1S1, Canada.
Privacy requests go to: The contact form, which reaches the people who run the store, or call +1 (289) 856-8434 Mon to Fri, 9am to 5pm ET. Ask for the request to be treated as a privacy request and it is logged as one.

What we collect

When you order: Name, email, delivery address, billing address, phone if you give one, and what you bought.
When you message us: Name, email, order number if you give one, and the contents of your message.
When you subscribe: Your email address and the date you subscribed.
When you ask to be notified: Your email address and the product you asked about.
Automatically: Your IP address and browser user agent are processed by Cloudflare, which serves this site, so the page can be delivered and abusive traffic can be blocked. We do not build a profile from it.
In your own browser: Your bag and the country you picked in the currency selector, stored in local storage in this browser only. Neither leaves your device until you check out. Clearing your browser data clears both.

We do not collect date of birth, gender, health information, or anything about your hair or skin unless you volunteer it in a message. We ask for nothing we do not need to send you a parcel.

Payment details

Card payments are handled by Stripe. Your card number is entered on a page hosted by Stripe, not on this site, and it never reaches us. We never see it, we cannot store it, and there is no card form anywhere on this domain. Stripe is an independent controller of the payment data it collects and has its own privacy policy, which is worth reading if you want the detail of how a card payment is processed.

Why we collect it

To pack and deliver your order and to give the carrier an address.
To complete the customs declaration when your order crosses a border.
To email you about that order, including dispatch and tracking.
To answer the message you sent us.
To send marketing email only if you asked for it, and to stop the moment you unsubscribe.
To keep the site running, to spot abuse, and to meet our tax and record keeping obligations.

Tracking and cookies

This site runs no third party analytics, no advertising pixels, no social media trackers and no tracking cookies. There is no Google Analytics tag, no Meta pixel and no session cookie set by this site. That is a design decision and it is verifiable: view the page source.

Your cart uses local storage in your own browser rather than a server side session. Clearing your browser data clears your cart.

Carriers: Your name, address, phone and email, so the parcel can be delivered and tracked.
Customs authorities: On an international parcel, your name, address and what is in the box go on the customs declaration and are seen by the customs authority of the destination country. There is no way to send a parcel across a border without that.
Payment provider: Stripe. It collects your card details, your billing address and the delivery address you type on its checkout page, and it holds the record of what you were charged.
Hosting: Cloudflare. It serves every page and image on this site, and it sees the IP address and request headers of anyone who loads one.
Email provider: None connected today, so no third party holds your address for email purposes. When one is connected it will be named in this row before it sends anything.
Advertisers: None. We do not sell, rent or trade your details to anyone.
Law enforcement: Only where we are legally required to, and only what is required.

Where it is stored and for how long

This is the part most privacy policies are vague about, so here is the actual architecture. This store is a set of static pages on a content delivery network. It has no customer database of its own. That is not a promise about how careful we are, it is a fact about what exists: there is nowhere on this site for a customer list to sit.

Who is responsible: HAYAITI HOLDINGS LTD, in Ontario, Canada. Staff access is from Canada.
Hosting: Cloudflare Pages serves the site. Product images are held in Cloudflare R2 object storage. Neither holds anything about you: the pages and the photographs are the same for every visitor.
Server region: There is no single one. A static site on a content delivery network is served from whichever data centre is nearest to you, so the page you are reading right now was almost certainly delivered from your own country.
Your order record: Held by Stripe, our payment processor, which is where the record of what you bought and what you paid lives. We read it from there to pack and send your parcel.
Contact messages: Sent to our support inbox and kept there.
Cross border transfer: If you are in Australia, the United Kingdom or the United States, the people handling your order are in Canada and your details are processed there. Ordering from us means accepting that.

Order records are kept for seven years, because tax law requires it.
Contact messages are kept for two years, then deleted.
Newsletter subscriptions are kept until you unsubscribe, and the unsubscribe record itself is kept so we do not email you again by accident.
We do not run a marketing CRM, an advertising audience list, or any profile of you beyond the order itself.

Canada has been recognised by the European Commission as providing adequate protection for personal data transferred to Canadian commercial organisations, which is the relevant point for a UK buyer.

How it is protected

There is no customer database on this site to break into, and no card data anywhere on this domain.
The site is served over HTTPS everywhere, with no mixed content.
Access to stored orders is limited to the people who need it to run the store.
No system is perfect. If we ever have a breach that is likely to cause real harm we will tell you and we will report it to the regulator that covers you: the Privacy Commissioner of Canada, the OAIC in Australia, or the ICO in the United Kingdom.

Your rights

You can ask what personal information we hold about you and we will tell you.
You can ask us to correct anything wrong.
You can ask us to delete your details, and we will, except where tax law makes us keep an order record.
You can ask for a copy of what you gave us in a portable format.
You can object to a use, or ask us to restrict one, and we will stop unless we have to keep going to finish your order or to meet the law.
You can unsubscribe from marketing at any time, on one click, in any marketing email.
You can ask us not to email you at all beyond what an order requires.
If you are in California, you can ask what we collected, ask us to delete it, and opt out of any sale of it. We do not sell personal information, so the last one is already done.

Send any of those requests through the contact form. We reply within one business day and complete the request within 30 days, which also satisfies the one month deadline under UK GDPR. We do not charge for it.

Complaints

If you think we have mishandled your information, tell us first. We investigate and reply in writing within 30 days. If you are not satisfied, go to your own regulator, and you do not need our permission to do it.

Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca
Australia: Office of the Australian Information Commissioner, oaic.gov.au
United Kingdom: Information Commissioner's Office, ico.org.uk
United States: Your state attorney general, and the California Privacy Protection Agency if you are in California.
Privacy contact: The people who run the store. We are small enough that there is no separate privacy officer, and pretending otherwise would just put a title between you and an answer. If that changes, this row will name them.
Phone: +1 (289) 856-8434
Privacy email: support@hayaiti.com
Postal address: 4 Robert Speck Parkway, Suite 1200, Mississauga ON L4Z 1S1, Canada

Children

This site is not aimed at children and we do not knowingly collect information from anyone under 18. If you believe a child has given us their details, tell us and we will delete them.

Changes to this policy

We will update this page when what we do changes, and we will change the date at the top. If a change is material we will say what changed rather than quietly reissue the page.

Still stuck?

Send us the order number and what went wrong, or call +1 (289) 856-8434 Mon to Fri, 9am to 5pm ET.