What we keep, and why.

When you place an order: your name, email, phone, shipping address, and the products you bought. Payment is handled by our payment processor (Razorpay or Stripe depending on your region) — we never see or store your card details.

When you visit the site: standard analytics — pages viewed, device, broad geography — via Google Analytics 4. No personal identifiers are stored without your explicit opt-in.

If you subscribe to the Saya Letter: just your email, your name if you give it, and which pieces you've expressed interest in.

We do not sell your data. We do not share it with advertising networks beyond what's necessary for the platforms you've explicitly opted into (e.g. Meta pixel only fires if you accept cookies).

We do not store your full payment card details, ever. PCI compliance is handled by our payment processor.

Order data: 7 years (Indian tax and accounting law requires this).

Marketing email subscription: until you unsubscribe, then deleted within 30 days.

Analytics data: 14 months (anonymised after that per GA4 defaults).

You can request: a copy of all data we hold on you, correction of incorrect data, or deletion of your data (except where retention is required by law, e.g. tax records). Write to hello@officialsaya.com and we'll action within 30 days.

Data protection enquiries: hello@officialsaya.com