Privacy Policy

Last updated 30 September 2026

Cambay is one of three brands run by AuraByt Inc., an online fashion retailer. We sell directly to you: there is no other seller on this site, and no marketplace behind it. The brand you see is decided by the website address you are on, but the same company, the same systems and the same people are behind all three, so this policy covers whichever brand site you are reading it on.

This policy explains what personal information we collect, why we collect it, which other companies handle it for us, where in the world it goes, and what you can ask us to do with it. Our agreement with you is governed by the law of Ontario, Canada. Read it alongside our terms and our shipping and returns policy. If anything here is unclear, write to privacy@tanahq.com or use our contact page.

What personal information we collect and why

We collect only what we need to run a shop, and we tell you why:

• Account information. Your name, email address and password if you create an account. We use it to sign you in, show you your past orders, and let you start a return yourself. Your password is stored as a hash, never as text we can read.
• Order information. What you bought, the size and colour, the price you paid, the currency, the brand site you bought from, and the order number. We use it to take your order, ship it, handle a return or refund, and keep our books.
• Address information. Your shipping address, your billing address, and the email address the order confirmation goes to. We use it to deliver the order and to prove where it went if a parcel goes missing.
• Phone number. Checkout asks for a phone number so the carrier can reach you about the delivery. We pass it to Stallion Express and the carrier for that reason and share it with nobody else.
• Payment information. The last digits of your card and the card brand, so you can tell which card you used when you look at an order. Your full card number never reaches us. See the Stripe section below.
• Support messages. Anything you write to us by email, including returns requests from guest customers, and whatever you attach, such as a photo of a damaged item. We use it to answer you and to decide a return or refund fairly.
• Analytics and device information. Pages you view, links and buttons you click, the site that referred you, your browser and device type, your rough location worked out from your IP address, and the brand site you were on. We use it to see which products and pages people actually use, and to find parts of the checkout that are broken or confusing.

We do not sell your personal information, we do not share it for advertising, and we do not build profiles of you to sell to anyone else.

Stripe, our payment processor

Payments are processed by Stripe. When you pay, your card details are entered into fields hosted by Stripe and go to Stripe directly. We never see or store your full card number, its expiry date, or its security code.

What we keep from a payment is the last digits of the card, the card brand, the amount, the currency and Stripe's reference for the payment, which is what we need to show you the order and to refund it later.

Payment is authorized when you place the order and captured, meaning actually charged, when the order is fulfilled and shipped. It is not charged before that. Stripe processes this payment as its own controller as well as on our behalf, under its own privacy policy.

Resend, our email provider

Transactional email is sent through Resend. That is your order confirmation, shipping and tracking notices, and emails about a return or a refund. To send them, Resend receives your email address, your name, and the details that appear in the message, such as the items in the order and the tracking number.

These emails are part of buying from us, not marketing, so we send them when you place an order rather than asking you to subscribe.

PostHog analytics, hosted in the United States

We use PostHog for product analytics, on its United States region. This means analytics data about your visit leaves Canada and is processed in the United States.

Autocapture is on. PostHog records the pages you view and the elements you click without us writing code for each one, so we can answer questions about how the shop is used after the fact. It keeps PostHog's default masking of form inputs: what you type into a field, and anything in a password field, is not recorded.

Session recording is off. We do not record your screen, your mouse movements or your keystrokes as a replay.

This site honours the Do Not Track and Global Privacy Control signals. If your browser sends either one, PostHog is never loaded at all on your visit, so nothing about you is sent to it. Requests to PostHog are also passed through our own domain, which means your browser talks to us and we forward the event.

If your browser sends neither signal, you can turn analytics off here instead, and PostHog is then never loaded on your visits, as with the signals. The choice is kept in this browser, for this site only: another browser or device, another of our brand sites, or clearing this site's data from your browser starts with analytics on again. The same switch is linked as Analytics choices at the foot of every page.

Cloudflare and Vercel, our hosting and content delivery

This website is hosted on Vercel, and requests to it are processed in the United States. Vercel receives what any web host receives: your IP address, the page you asked for, your browser's user agent, and the time of the request. It keeps short-lived server logs so we can diagnose errors.

Product images are stored in Cloudflare R2 and served through Cloudflare, which also processes requests in the United States and sits in front of image requests as a content delivery network.

Because both run in the United States, ordinary browsing of this site is processed in the United States even when you are in Canada. The section on cross-border disclosure below explains what that means for you.

Our shop backend and our database run on our own server, and your order and account records live there.

Shipping, our carriers, and the United States border

Everything ships from our one warehouse in Brampton, Ontario, Canada. An order going to the United States is an export, so it carries customs paperwork.

We ship through Stallion Express, a Canadian shipping company that buys the postage for each parcel and hands it to the carrier that delivers it: Canada Post and USPS. Stallion Express and that carrier receive your name, your delivery address, your email address and your phone number for delivery notices, and the weight and dimensions of the parcel. For a parcel going to the United States, Stallion Express also receives the customs details described below. Neither receives anything about how you paid.

United States Customs and Border Protection receives the recipient's name and address, a customs description of the goods, their declared value, their country of origin, and their tariff classification. We have to provide this for the parcel to enter the country, and we cannot ship to you in the United States without it.

US prices already include our estimate of import duty, so there is no separate duty or customs charge worked out at checkout. That is a pricing decision, not a privacy one, and it does not change what customs receives.

Your rights under PIPEDA

Canada's Personal Information Protection and Electronic Documents Act, PIPEDA, gives you these rights, and we honour them wherever you live:

• Access. You can ask what personal information we hold about you, what we have used it for, and who we have disclosed it to, and ask for a copy.
• Correction. You can ask us to correct information that is wrong or incomplete. If we disagree, we will record that you asked.
• Withdrawal of consent. You can withdraw your consent to our use of your information, subject to what the law and our contract with you still require. Withdrawing consent for analytics changes nothing about your order. Withdrawing consent for order processing part way through means we may not be able to complete or ship your order.
• Complaint. You can complain to us, and you can complain to the Office of the Privacy Commissioner of Canada, whether or not you have raised it with us first. Contact details are on the Commissioner's own website, priv.gc.ca.

To exercise any of these, email privacy@tanahq.com and say what you want. We may ask you to confirm your identity, for example by writing from the email address on the order, so that we do not hand your information to someone else.

Privacy requests are handled by our privacy officer, Rushil Shah, who is accountable for the personal information we hold. Address yours to the Privacy Officer at privacy@tanahq.com.

We answer within 30 days, which is the time PIPEDA allows, and we will tell you if we need longer and why.

If you would rather write to us on paper, our postal address is AuraByt Inc., Brampton, ON, Canada.

Cross-border disclosure and access by United States authorities

Several of the companies that process information for us are in the United States: Stripe, Resend, PostHog, Vercel and Cloudflare. Your information is transferred to them and processed there.

While your information is in the United States, it is subject to United States law. That means courts, law enforcement and national security authorities there may be able to compel access to it, under legal processes that differ from Canada's and that may not give you the same notice or recourse a Canadian process would. We are telling you this plainly because PIPEDA requires us to, and there is no way for us to put it beyond their reach while using processors in that country.

We use these companies under their standard terms, which commit them to process information only on our instructions and to protect it. We remain accountable to you for information we hand to them.

Cookies and similar storage

We set a small number of cookies and browser storage entries, and we keep the list short:

• Session and sign-in. A cookie that keeps you signed in to your account, and one that keeps a short-lived cache identifier for the site.
• Cart. A cookie holding the identifier of your shopping cart, so your cart survives a page reload and a return visit. Without it, checkout cannot work.
• Analytics. PostHog sets a cookie and a matching entry in your browser's local storage to recognize the same browser across page views and visits. The site also notes, in the tab's session storage, the last checkout and the last order it reported to PostHog, so that reloading the page does not report them twice. That note never leaves your browser and is gone when you close the tab. If you turn analytics off with the switch, the site keeps that choice in your browser's local storage so it applies on your next visit; it never leaves your browser either.

The session and cart cookies are strictly necessary. Refusing them means you cannot sign in or check out.

To refuse analytics, turn on Global Privacy Control or Do Not Track in your browser or privacy extension before you visit, or turn analytics off with the switch in the PostHog section above, and PostHog is never loaded. You can also block cookies for this site in your browser settings, or clear them afterwards. Either way the shop keeps working.

The PostHog analytics cookie lasts 12 months from your last visit, and clearing your cookies resets it.

How long we keep information, and how to ask for deletion

We keep personal information only while we have a reason to, then delete it.

Order, invoice and payment records are kept for 7 years, because our tax and business record rules oblige us to keep them even if you ask us to delete them.

Account details, including saved addresses, are kept until you ask us to delete your account.

Support messages are kept for 2 years, so we can follow up if the same issue comes back.

Analytics events are kept for 12 months, after which PostHog deletes them.

To ask for deletion, email privacy@tanahq.com. We will delete what we are not required to keep, tell you plainly what we are keeping and why, and confirm when it is done. Deleting your account does not cancel an order that is already on its way.

Children

This store is not intended for anyone under 18, which is also the minimum age to order under our terms. We do not knowingly collect personal information from children, and we do not aim any of our brands at them.

If we learn that we hold information about someone under 18, we delete it.

If you are a parent or guardian and think your child has given us information, email privacy@tanahq.com and we will remove it.

How we tell you about changes to this policy

When we change this policy, we change the last updated date at the foot of this page, and the current version is always here at privacy. Small corrections, such as clearer wording, take effect as soon as they are published.

If a change is material, for example a new processor, a new country your information is processed in, or a new purpose we use it for, we announce it by email to account holders and by a notice on the site.

We will not reduce your rights under this policy for information we already hold without asking for your consent.