Privacy Policy
Effective July 31, 2026
This Privacy Policy explains what information we collect, how we use it, and the choices you have. We do not sell your personal information.
1. Information we collect
Account and order information you provide: name, email, shipping/billing address, and order history.
Payment information is collected and processed by our payment providers; we store only gateway tokens and never your full card number.
Usage data such as device, browser, and pages viewed, collected to operate and improve the site.
2. How we use information
To process and ship orders, provide support, manage memberships, prevent fraud, and comply with legal obligations.
To send transactional email (order confirmations, shipping updates) and, where you opt in, occasional research updates.
3. How we share information
With service providers who help us operate — payment processors, shipping and fulfillment, our email service provider, our customer-relationship-management (CRM) system, and hosting — under contract and only as needed.
When required by law, to enforce our terms, or to protect rights and safety. We do not sell personal information for advertising.
4. Data retention and security
We retain information as long as needed for the purposes above and to meet legal requirements. We use administrative and technical safeguards, including encryption in transit and tokenized payments.
When we honor a deletion request, some records are kept under legal exceptions: completed order records are retained as financial/tax records but stripped of identifying details (anonymized); records needed to defend a payment dispute are kept for that purpose; and if you have opted out of marketing, we keep a suppression record of your email so we do not contact you again.
5. Your choices and rights
You may access, correct, or request deletion of your personal data, and opt out of marketing email at any time. To exercise these rights, contact support; we may first verify that you control the email address on the account.
We acknowledge requests within 72 hours and complete verified access or deletion requests within 30 days (this may be extended for complex requests, with notice). Deletion propagates across our app database, CRM, and email systems, subject to the legal retention exceptions described above.
6. Cookies
We use essential cookies to operate the site (sessions, cart) and limited analytics. You can control cookies through your browser settings.
7. Children
The site is intended for users 18 and older. We do not knowingly collect information from anyone under 18.
8. Changes and contact
We may update this policy; material changes will be posted here. Contact support with any privacy questions.
This document is provided for general information and is not legal advice. Have counsel review before relying on it.
