Privacy policy

This notice is written and published in English. Any translation we make available is provided for convenience only; where the two differ, the English text governs. Effective: 13/08/2026. Supersedes all previous versions.

Your use of our Properties is also subject to our Terms of Use & Conditions of Sale, which form a separate contract between us. This notice is not a contract — it is a disclosure. It explains what we do with information about you, and what you can require us to do about it.

---

1. The short version

The detail matters, and the sections below give it. But if you read nothing else:

---

2. Who and what this covers

This notice applies to two groups of people: anyone who visits, browses, contacts, subscribes to or buys from our Properties, and anyone who interacts with our advertising or content wherever it appears — including on platforms we do not own.

It does not cover our employees, contractors, suppliers or investors in those capacities; those relationships are handled through separate notices and agreements. It also does not cover what other companies do on their own platforms. If you comment on our post on Facebook, Instagram, Youtube or Tiktok, the platform's own privacy policy governs that interaction, not this one, even where the platform then passes information about you to us.

By Properties we mean byayra.com, every subdomain and landing page that links to this notice, any app or portal we operate, our email and SMS programmes, and any storefront we run inside a third-party platform.

3. Words with specific meanings

"We", "us", "our" — AYRA COMMERCE LLC, a limited liability company organised in Wyoming, trading as AYRA.

"You", "your" — any individual visitor or customer aged 13 or over, or a younger reader whose parent or guardian has given verifiable consent. Section 13 explains the age limits properly.

"Personal information" — anything, in any format, that on its own or combined with something else can be used to identify, describe, locate or single you out. Where a specific privacy law defines the term more narrowly or more broadly, that law's definition applies to processing governed by it.

"Engagement action" — following, liking, sharing, saving, commenting on or otherwise reacting to us on an external platform.

"Vendor" — a company processing personal information on our behalf and under our instructions.

---

4. Where your information comes from

4.1 You give it to us

Nothing in this category reaches us unless you type it, upload it or send it:

• Placing an order — name, shipping and billing address, email, phone, order contents, and whatever else the checkout requires to fulfil it. Card details go directly to our payment processor; we receive confirmation and a truncated reference, not the full number.
• Opening an account — email address, password and any profile detail you add.
• Joining our email or SMS list — email address and/or mobile number, plus the source and timestamp of your consent.
• Writing to us — anything contained in your message or its attachments, whether by email, contact form, live chat, SMS or social DM, plus anything said during a support call, which may be recorded.
• Entering a promotion, giveaway or event — the identifiers the entry requires, and payment details where there is a fee.
• Posting publicly — where we offer reviews, ratings, photo uploads or comment features, whatever you post is public. Your display name and anything you choose to include leaves the protection of this notice the moment it is published.

If you would rather we did not hold a particular piece of information, the reliable way to achieve that is not to submit it. Declining will narrow what you can do — you cannot check out without an address — but almost all of our content stays open to you, and we do not treat you differently based on how much you share.

4.2 Your browser and device supply it automatically

When you load a page we record technical and behavioural signals: IP address, approximate location derived from it, browser and operating system, device type and screen characteristics, referring URL, the pages and products you viewed, time spent, items added to cart, and whether you completed a purchase. This happens through cookies, pixels, SDKs, server logs and similar tools described in section 10.

Where you reach us from a mobile device, your carrier or the platform may pass us device-level identifiers, which lets us associate a mobile number with a device.

4.3 It reaches us from somebody else

We buy, receive or are given personal information by: advertising and social platforms reporting on campaign performance and audience characteristics; data and audience providers who help us reach people likely to be interested in what we sell; analytics and attribution vendors; fraud-screening and address-verification services; and our fulfilment and logistics partners returning delivery status.

These third parties collect through their own cookies, tags and identity graphs, under their own policies. We are not responsible for how they gathered anything before it came to us. Several advertising trade bodies operate industry-wide opt-outs — the Digital Advertising Alliance and the Network Advertising Initiative among them — and those opt-outs are the appropriate route for objecting to interest-based advertising across their whole membership. Be aware they are stored per browser and per device, so you must repeat them everywhere you browse.

---

5. The categories we hold

Over the past twelve months we have collected, and expect to continue collecting, the following:

Identifiers — real name, alias, postal address, email address, telephone number, account name, IP address, cookie and device identifiers, and date of birth where you supply it.

Commercial information — products viewed, added to cart, bought, returned or refunded; order values; subscription status; and the purchasing patterns that emerge from these.

Electronic activity information — browsing and search history on our Properties, clickstream, chat transcripts, email open and click data, and how you interacted with a given advertisement, on any device.

Audio and visual information — profile or review photographs, uploaded images and video, and recordings of customer service calls where local law permits and you have been told.

Inferences and analytics — profiles built from the above reflecting your apparent preferences, price sensitivity, likely interests and predicted lifetime value, used to tailor what we show you and to improve what we sell.

Sensitive information — we do not intentionally collect data revealing health conditions, precise geolocation, racial or ethnic origin, religious belief, sexual orientation, union membership, immigration status, biometrics, or the contents of your private communications, and we ask you not to send such information to us. Bear in mind that buying a product intended for a particular condition can imply something about you; treat what you write in an order note accordingly.

De-identified and aggregated data — statistics and derivations that cannot reasonably be linked back to you. We maintain these without identifiers, do not attempt to re-identify them, and require the same of anyone we give them to.

---

6. Why we process it

We process personal information only where we have a lawful basis to do so — your consent, the necessity of performing our contract with you, compliance with a legal obligation, protection of someone's vital interests, or a legitimate interest of ours that is not outweighed by your rights.

In practice, the purposes are:

Running the transaction — accepting and processing your order, taking payment, screening for fraud, arranging shipment, handling returns and refunds, and keeping the records the law requires us to keep.

Serving you afterwards — answering questions, resolving complaints, honouring guarantees, and managing your account and any subscription.

Marketing — sending you emails and, where you have opted in, texts; building and excluding audiences on advertising platforms; personalising offers, product recommendations and site content; measuring which campaigns worked; and understanding the demographics and interests of the people who visit us.

Running and improving the Properties — debugging, load testing, A/B testing, internal research and analytics, and developing new products and features.

Protecting everyone — monitoring for security incidents, investigating misuse, defending our rights and property, verifying identities and requests, and pursuing those responsible for unlawful activity.

Complying with law — meeting tax, consumer protection, product safety and privacy obligations, and responding to lawful demands.

7. How long we keep it

We keep personal information for as long as the purpose that justified collecting it survives, and no longer, subject to whatever the law obliges us to retain.

Three things determine the actual period: how long the information remains useful for the purpose it was collected for; how sensitive it is, since more sensitive data is deleted sooner; and whether a legal, tax, contractual, regulatory or litigation-hold obligation requires us to preserve it. As a general guide, order and tax records are held for 7 years, marketing contact data until you unsubscribe plus 24 months of inactivity, and support correspondence for 36 months. When a period ends we delete the data or strip it of identifiers.

---

8. Who we pass it to

We do not rent out your inbox. We do disclose personal information to the following, for the purposes already described:

Fulfilment and logistics — the warehouses, print partners, suppliers and carriers who pick, pack and deliver what you ordered.

Payment and transaction support — processors, card networks, fraud and chargeback services, and the platforms that send your confirmations and shipping notifications.

Customer support providers — helpdesk, live chat, call and ticketing platforms, including those using automated or AI-assisted tools to draft or route responses.

Technology and infrastructure vendors — hosting, storage, security, email delivery, backup, development and testing services, some of which incorporate artificial intelligence features.

Marketing, advertising and analytics partners — social networks, search and display networks, affiliate programmes, review platforms, SMS and email service providers, attribution tools and data co-operatives.

Corporate affiliates — parents, subsidiaries and companies under common control, which may use it as described here.

Professional advisers — lawyers, accountants, auditors and insurers, under confidentiality.

Security and anti-fraud providers — where we believe someone is harming, or is about to harm, our rights, our property, another person or another person's property.

Government and law enforcement — in response to a subpoena, court order, warrant or other lawful demand, and where we otherwise consider disclosure necessary or legally permitted.

A buyer or successor — if we are acquired, merged, restructured, financed or wound up, personal information is among the assets that transfer, and the acquirer will be bound by this notice until it tells you otherwise.

---

9. Sale and sharing for advertising

This section exists because it triggers rights that the rest of this notice does not.

When we pass identifiers and behavioural data to advertising and social platforms so that they can show our products to you or to people like you, several state privacy laws classify that transfer as a "sale" of personal information, or as "sharing" for cross-context behavioural advertising, even though no money changes hands in the ordinary sense.

The categories involved are: persistent identifiers, including hashed email addresses, phone numbers, cookie IDs, mobile advertising IDs, IP addresses and account references; and activity data generated on our Properties, including pages and products viewed, cart contents and purchases. The recipients are the advertising, social and analytics companies described in section 8.

You can stop this at any time.

We do not sell or share the personal information of anyone we know to be under 16.

---

10. Cookies, pixels and similar technologies

Cookies are small files placed on your device; pixels, tags and SDKs do a comparable job from inside a page or an app. We use them in four ways:

Strictly necessary — logging you in, keeping your cart intact between pages, load balancing, and blocking fraudulent checkouts. The site does not work without these and they cannot be switched off from our end.

Preference — remembering your language, region, currency and whether you have already dismissed a banner.

Analytics — counting visits, measuring where people abandon, and telling us which pages earn their place.

Advertising — building audiences, suppressing ads from people who already bought, retargeting, and attributing sales to campaigns. These pass information to advertisers and social networks, and where you have previously identified yourself to us, an identifier in the cookie may join that session up with what we already hold.

Some tags on our pages belong to third parties rather than to us — embedded video, review widgets, chat, payment frames, ad networks. We do not control what they collect or how they use it.

Turning them off. Browsers accept cookies by default and every major browser lets you block or delete them, per site or wholesale. Doing so will break parts of the Properties. Note that disabling a cookie stops future collection through it but does not retroactively erase what was collected while it was active; to remove that, make a deletion request under section 11.

Do Not Track and Global Privacy Control. There is still no common standard for interpreting a Do Not Track header, so we do not act on it. We do act on Global Privacy Control signals, treating a GPC signal as a valid opt-out of the sale and sharing of personal information wherever the law requires us to. GPC works at the level of the individual browser or device that sends it, so it must be enabled on each one you use, and because it operates through cookies it will not carry over to data you gave us while signed in.

---

11. Your rights and how to use them

11.1 What you can ask for

Depending on where you live, some or all of the following apply. Where a right is not available to you by law, we may still honour a reasonable request voluntarily.

• Know and access — what we hold about you, where we got it, why we processed it, and who received it.
• A copy — your information delivered in a portable, machine-readable format.
• Correction — inaccurate or incomplete information put right.
• Deletion — your information erased, subject to the exceptions the law provides for records we must keep.
• Opt out of sale and sharing — as described in section 9.
• Opt out of targeted advertising — so that what you see from us is not selected on the basis of your activity across other sites.
• Opt out of profiling — where profiling would produce a legal or similarly significant effect on you.
• Withdraw consent — at any time, where consent was the basis for processing, without affecting what was lawfully done beforehand.
• Limit sensitive data — where such data has been collected despite section 5.
• Non-discrimination — we will not deny you goods, charge you differently, downgrade quality or penalise you for exercising any of this.
• Appeal — if we refuse a request, you may ask us to reconsider.
• Complain — to your state Attorney General, or to your supervisory authority if section 16 applies to you.

11.2 Making a request

Email info@byayra.com. We acknowledge within 10 business days and respond substantively within 45 days, extending once by a further 45 days where the request is complex, in which case we will tell you why.

We must be satisfied that you are who you say you are before we hand over or delete anything, so we will ask for details that let us match your request to our records, and we may ask for more where the information sought is sensitive. If we cannot verify you, we will refuse requests to know or delete, and we will say so.

An authorised agent may act for you. We will require written proof of their authority and, separately, will verify your identity with you directly.

11.3 Appealing

Write to info@byayra.com with the subject line "Privacy Request — Appeal", quoting the original request. We will review and give you a written decision with reasons within 45 days. If you remain dissatisfied, your state Attorney General will take the complaint.

---

12. Marketing emails and text messages

By joining a marketing list you agree that we and the vendors acting for us may contact you with promotional material by email, SMS, MMS, push notification or telephone, including through automated or programmable dialling and messaging systems. Consent is never a condition of purchase. Message and data rates set by your carrier are your responsibility, and message frequency varies.

We share mobile numbers and consent records only with the platform providers, aggregators and carriers who are technically required to deliver our messages, and only for that purpose. We do not sell, rent or otherwise pass your SMS opt-in or consent status to any third party for their own marketing.

To leave an email list, use the unsubscribe link at the foot of any message. To leave an SMS list, reply STOP, END, CANCEL, UNSUBSCRIBE or QUIT to any message from us; reply HELP for assistance. We act on these promptly, but campaigns already queued may still reach you for a short period afterwards. Unsubscribing from marketing does not stop transactional messages about an order you have placed.

Engagement actions and subscriptions on external platforms are controlled by those platforms; to undo them you have to use their tools, not ours.

13. Children and young people

Our Properties are built for adults. We do not direct them at children, we do not knowingly collect personal information from anyone under 18, and federal law imposes stricter obligations still for anyone under 13, which we take seriously.

If we learn that someone under 18 has given us personal information, we delete it and use it for nothing. A parent or guardian who believes their child has submitted information to us should write to info@byayra.com and we will remove it. We encourage parents and guardians to talk to their children about what it means to hand over personal information online.

14. How we protect it

We maintain administrative, technical and physical safeguards proportionate to the risk: encryption of data in transit, restricted and logged access on a need-to-know basis, vetting of vendors, and incident response procedures. Payment card data is handled by PCI-DSS compliant processors rather than stored on our systems.

No method of transmission or storage is perfectly secure, and we cannot guarantee that ours is. Choose a strong, unique password, do not reuse it elsewhere, and tell us at info@byayra.com if you believe your account has been compromised.

15. Where your information is processed

We operate the Properties from the United States. Personal information we collect is stored and processed in the United States, and in any other country where we, our affiliates or our vendors maintain facilities. Those countries may not offer protections equivalent to those of the country you are in.

Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on the current European Commission Standard Contractual Clauses, together with the UK Addendum where relevant, or on another lawful transfer mechanism. You may request a copy of the safeguards in place by writing to info@byayra.com.

---

16. Additional notice — U.S. state privacy laws

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland and other states with comprehensive privacy statutes hold the rights set out in section 11, exercisable as described there. The categories of personal information we collect, the sources they come from, the purposes we use them for, the categories of recipients and our retention approach are set out in sections 4 to 9 respectively, and that disclosure is intended to satisfy the notice-at-collection requirements of those laws.

California residents may additionally designate an authorised agent, may request the specific pieces of personal information we hold rather than merely the categories, and are entitled to the non-discrimination guarantee in section 11.1. Where we offer a financial incentive such as a discount for joining our list, participation is voluntary, you may withdraw at any time, and the value of the incentive is reasonably related to the value of the data you provide.

17. Changes to this notice

We revise this notice as our practices, our vendors and the law change. The current version always sits on this page with its effective date at the top, and information we hold is governed by the version in force when it was collected. Where a change materially affects your rights, we will give notice through the Properties or by email before it takes effect. Checking this page periodically is worthwhile.

18. How to reach us