Privacy policy

Last updated 6 November 2026

We collect only what we need to get your order to you, and we never sell it. This policy explains how we handle your personal information under the Protection of Personal Information Act (POPIA).

1. Who is responsible

The responsible party, and the information officer, is , trading as Aylah, at . Contact: or WhatsApp WhatsApp.

2. What we collect

Your name and WhatsApp number.
Your delivery address or chosen pick-up point.
Your order, payments and proof of payment. We see your bank's name and the reference, never your banking login.
The messages you send us.

This website keeps your bag on your own device so it's still there when you come back. To stop spam orders, our server keeps a one-way scrambled code made from your internet address, which can't be turned back into the address itself. We don't use advertising cookies. How we measure the website is explained in section 4.

3. Why we use it

To confirm, buy, pack and deliver your order, and to keep you updated.
To handle payments, refunds, returns and complaints.
To keep the records that tax law requires.
To send you new arrivals on WhatsApp, but only if you've agreed. Reply STOP at any time and we remove you.

4. Website analytics (PostHog)

We use PostHog to understand how people use this website, so we can fix what's slow or broken and stock what you're looking for. PostHog is an analytics service that works for us under a contract and may only use the information on our instructions.

Before you choose, we only count anonymous page visits and measure how fast pages load. Nothing is stored on your device and we can't tell one visit from the next.

If you say yes in the box at the bottom of the page, we also collect:

The pages you open, the pieces you look at, what you add to your bag or look, and whether you finish checking out. We collect the order's value, delivery and payment method, never your name, number or address.
Where you click and scroll (heatmaps), and errors the page runs into.
A recording of how you use the page, like a screen video. Everything you type into a field is hidden before it leaves your device, and so is your order number.
Your device type, browser, screen size, the website that sent you, and your approximate location (town or city), worked out from your internet address. We've set PostHog not to keep the internet address itself.
A random identifier stored on your device (a cookie and local storage) so we can recognise a return visit. It isn't linked to your name.

We use this only to improve the shop. It is never sold or used for advertising. We rely on your consent (POPIA section 11(1)(a)), so it's your choice and saying no doesn't affect your order in any way.

Where it's kept: PostHog stores the data on its EU cloud in Frankfurt, Germany. The EU's data-protection law (GDPR) gives protection at least as strong as POPIA, as section 72 requires for information sent outside South Africa.

How long: session recordings are deleted after 30 days and other analytics after 12 months at most.

Changing your mind: choose Analytics settings (also at the bottom of the shop page) and pick "No thanks". We stop collecting straight away and the identifier is removed from your device. Blocking cookies in your browser or turning on "Do Not Track" also stops it.

We share only what each one needs to do its job:

Couriers (PAXI and Pudo) receive your name, number and pick-up point or address.
WhatsApp (Meta) carries our messages.
Cloudflare hosts this website and our order records. Its servers may be outside South Africa, and it's bound by data-protection terms that meet POPIA's standard for cross-border transfers.
PostHog (EU cloud, Germany) receives website analytics as described in section 4, only if you said yes. It never receives your name, number, address or order details.
Our bank or card-payment provider processes your payment or refund.

We never sell or rent your information.

6. How long we keep it

We keep order and payment records for 5 years, as tax law requires, then delete them. Marketing consent lasts until you withdraw it. Website analytics are kept as set out in section 4.

7. Keeping it safe

Our order records sit behind a password-protected admin area over an encrypted connection, and only the owner has access. If we ever learn of a breach, we tell you and the Information Regulator as POPIA requires.

8. Your rights

You may ask what information we hold about you, ask us to correct or delete it, or object to how we use it. That includes website analytics: you can withdraw consent at any time under Analytics settings. Message us and we respond within 30 days. If you're unhappy with how we've handled your information, you can complain to the Information Regulator at inforegulator.org.za.

9. Under 18?

Please ask a parent or guardian to place your order.