Privacy Policy

Last updated: [date]

DRAFT. Not yet reviewed by a lawyer. This text is a starting point written for Riparia Herbal Co. It must be reviewed by a qualified attorney before the site takes real orders. Highlighted items in [brackets] need the owner's details.

Riparia Herbal Co. is a trade name of [LLC legal name], a [state] limited liability company ("we", "us"). This policy explains what we collect when you use this website and order a sample kit, why, who handles it for us, and your choices.

What we collect

Your order answers. The kit you pick, the symptoms you choose, your starting (baseline) score for each symptom from 0 to 10, and any food you tell us you can't tolerate.
Your health-check answers. Whether you take certain medicines (such as antidepressants or blood thinners), have certain conditions or allergies, are over 60 with new symptoms, are pregnant or nursing, or are under 18. We do not store answers to the "see a doctor first" questions (weight loss, vomiting, swallowing, bleeding); if you tick one, the page stops you and nothing is sent to us.
Checkout details. Your email, name and shipping address, which you enter on Stripe's secure checkout page. Stripe handles your card or wallet details; we never see or store your full card number.
Kit requests. While online checkout isn't open yet, you leave your email and phone number instead, and we save them with your order answers so we can contact you to complete your order.
Site usage. Basic, cookieless visit statistics (pages viewed, referring site, device type, country) through Vercel Web Analytics. We don't use advertising cookies or tracking pixels.

Your symptoms, baseline scores and health-check answers are health-related information. We treat them with extra care, as described below.

Why we collect it

To check your kit against your answers and tell you which product to skip or ask your doctor about.
To fulfil and ship your order and send your receipt and shipping updates.
To run your trial: your weekly check-in asks about the symptoms you picked and compares them with your starting score, and your end-of-trial summary uses those scores.
To answer your questions and keep records we're required to keep (for example, for tax and accounting).

We do not sell your information. We do not use your health-related information for advertising, and we never share it with advertising platforms.

Who processes it for us

Stripe processes payments and collects your email, name and shipping address at checkout. Stripe also sends your receipt. Stripe receives your order number, not your symptoms or health-check answers. See Stripe's privacy policy.
Google (Google Sheets and Gmail) stores kit requests, including your order answers, health-check answers, email and phone number, while online checkout isn't open yet, and sends us a notification email with your contact details.
Supabase hosts our order database, where your order answers, health-check answers and checkout details are stored.
Vercel hosts this website and provides cookieless visit statistics.
Our email provider ([Resend, once check-in emails start]) sends your weekly check-in and summary emails. It receives your email address and the symptom names needed for your check-in.

These providers process data only to provide their service to us. We may also disclose information if the law requires it.

How long we keep it

We keep order records for [e.g. 3 years] after your trial ends, or longer if the law requires it for tax or accounting records. You can ask us to delete your health-related answers sooner (see below).

Your choices and how to request deletion

To see, correct or delete your information, email [contact email] from the address you used at checkout and include your order number (it starts with "PP-"). We'll confirm and act on your request within [30] days.
Once we delete your answers we can't run check-ins or send a summary for that trial. We may keep basic payment and shipping records we're legally required to keep.
You can unsubscribe from check-in emails at any time using the link in any email.

Security

Our order records are not publicly accessible; only our own server code can read or write it, and all traffic uses HTTPS. No system is perfectly secure, and we'll tell you if a breach affects your information as the law requires.

Children

Our kits are for adults. We don't knowingly sell to or collect information from anyone under 18.

Changes

If we change this policy we'll update the date at the top. For significant changes, we'll tell customers by email.

Contact

[LLC legal name], [mailing address]. Email: [contact email].