Privacy Policy

This Privacy Policy explains what personal information Hydronate LLC, a Wyoming limited liability company ("Hydronate," "we," "us," "our"), collects when you visit hydronate.com, buy from us, subscribe, or contact our support team — and what we do with it. Our mailing address is Hydronate LLC, 140 East Broadway Ave #25, Jackson, WY 83001.

It applies to this website, our checkout, our email and text messaging programs, our customer support channels, and the advertising we run on other platforms.

Our store runs on Shopify, and our checkout is hosted by Shopify. That means Shopify processes some of your information as our service provider, and some of it for its own purposes as an independent business. We explain that split in the section on Shopify below.

If anything in this policy conflicts with our Terms of Service, this Privacy Policy controls on questions about personal information.

Order and contact details. Your name, email address, phone number, shipping address, and billing address.

Payment details. Card number, expiration, and security code go directly to our payment processors through Shopify's checkout. We never see or store your full card number. What we can see is the card brand, the last four digits, the billing ZIP, and whether the charge succeeded.

Account and subscription details. Your login credentials, saved addresses, delivery frequency, flavor and quantity selections, and your subscription history.

Messages you send us. Anything you write in an email, a contact form, a support ticket, a text message, or a social media message — including anything you volunteer about your health, which we address separately below.

Reviews and content you post. The rating, photos, and text you submit, plus the display name you choose.

Survey and quiz responses. If you answer an on-site quiz or a post-purchase survey, we keep your answers and connect them to your order.

When you use the site, we and our analytics providers collect:

Device and connection data — IP address, browser type and version, operating system, device type, screen size, language, and general location inferred from your IP address (city or region level, not a street address).

Activity data — the pages you view, how long you stay, what you click, what you add to your cart, what you abandon, what you search for, the site you arrived from, and any campaign tags in the link you clicked.

Session recordings and heatmaps — we use a session-analytics tool that records how your cursor and taps move through a page so we can find broken layouts and confusing steps. These recordings capture your interactions with the page. We do not use this tool to collect payment card numbers or passwords, and we use what it records to fix the site rather than to build a profile of you as an individual.

Email and text engagement — whether a message was delivered, opened, and which links you clicked.

We use cookies, pixels, local storage, and software development kits. They fall into four buckets:

Strictly necessary. These keep your cart, your session, your login, and our fraud checks working. The site does not function without them.

Performance and analytics. These tell us which pages work and which ones lose people. This includes our session-recording and A/B-testing tools.

Personalization. These remember your flavor, quantity, and pricing selections between visits, and decide which version of a page or offer you see when we are testing.

Advertising. These are set by advertising platforms so they can show you our ads elsewhere and tell us which ads produced orders. Under several state privacy laws, letting these operate counts as "sharing" or "selling" your personal information — see the advertising section below.

You can clear or block cookies in your browser settings, and you can reset your mobile advertising identifier in your device settings. Blocking strictly necessary cookies will break checkout.

Shopify, as the platform running our store and checkout.

Payment processors and fraud services, which tell us whether a transaction cleared and whether it looks risky.

Shipping and fulfillment partners, which return tracking scans and delivery confirmations.

Advertising platforms, which report aggregate campaign performance and, in some cases, tell us that a person who saw an ad later ordered.

Referral and affiliate partners, when you arrive through their link or use their code.

Public sources, such as a social media profile you use to contact us.

To run your order. Take payment, check for fraud, pick and ship the package, send tracking, handle returns and exchanges, and process refunds.

To run your subscription. Charge the card on file on the schedule you chose, send you renewal notices, and let you skip, pause, change, or cancel.

To support you. Answer your emails and texts, look up your order, and follow up on a problem.

To operate and improve the site. Diagnose errors, measure page performance, run A/B tests on layout, copy, and offers, and decide what to build next.

To market to you. Send email and text messages you have opted into, show you ads on other platforms, and measure whether any of it worked.

To keep things secure. Detect fraudulent orders, abusive account behavior, coupon and referral abuse, and attacks on the site.

To meet legal obligations. Keep tax and transaction records, respond to lawful requests, and enforce our Terms of Service.

If you give us your email address at checkout, in a pop-up, or in a form, we may send you order updates and — where you have opted in, or where the law allows it for an existing customer — promotional email.

Every promotional email has an unsubscribe link at the bottom. Unsubscribing takes effect quickly, though a message already queued may still arrive.

Unsubscribing from promotional email does not stop transactional messages. You will still get order confirmations, shipping notices, subscription renewal reminders, refund confirmations, and account or security notices, because those are part of the service you bought.

We share personal information with companies that do work for us, and only what they need to do that work. By category, and naming the main ones:

Store, checkout, and payments — Shopify and its payment processors, which host the store, run checkout, and handle card data.

Subscription management — the platform that stores your delivery schedule and runs recurring charges.

Fulfillment and delivery — our warehouse partner and the carriers that deliver your package. They get your name, address, phone number, and what is in the box.

Order tracking — the service that powers our tracking page.

Email and text messaging — the platform that stores your contact details, preferences, and engagement history and sends the messages.

Analytics and testing — our web analytics, session-recording, and A/B-testing providers.

Advertising platforms — as described in the advertising section above.

Customer support — the helpdesk that stores our conversation with you.

Reviews — the platform that collects and displays reviews.

We also disclose information when you tell us to, to our professional advisers, in connection with a merger, acquisition, financing, or bankruptcy, and when we are legally required to — for example in response to a subpoena, a warrant, or a valid government request, or to investigate fraud or protect someone's safety.

Our service providers are under contract to use your information only to provide their service to us, not for their own purposes. Advertising platforms are the exception: they use data for their own purposes too, under their own privacy policies.

We do not sell your personal information for money.

We do not sell or share consumer health data.

We do not rent or sell our email or text list.

We do not use your personal information to set a different price for you than for anyone else. We do run A/B tests that show different prices or offers to randomly assigned groups of visitors, but the assignment is random — it is not based on who you are, what you earn, where you live, or what you have browsed.

We do not use automated decision-making that produces legal or similarly significant effects about you.

We do not knowingly collect personal information from children.

We keep personal information only as long as we have a reason to, and then we delete it or de-identify it.

Order and transaction records — at least seven years, because tax and accounting rules require it.

Account and subscription records — while your account is open, and then as needed to finish any open matter.

Support conversations — about three years, so we can see the history if you write in again.

Marketing contact records — until you unsubscribe, plus a permanent suppression record of the fact that you unsubscribed, so we do not accidentally re-add you.

Analytics, session recordings, and test data — generally up to about thirteen months.

Consumer health data — deleted on request, and otherwise no longer than we need it for the reason we collected it.

If you ask us to delete your information, we may keep the narrow slice the law requires us to keep — transaction records, suppression lists, and anything needed for an open legal matter — and we will tell you if that applies.

We serve the whole site over HTTPS, our checkout is PCI DSS compliant through Shopify, and we limit access to customer data to the people who need it to do their jobs.

No system is perfectly secure, and we cannot promise that yours will never be breached. Please use a strong, unique password, and do not email us passwords, full card numbers, or medical records.

If we discover a breach affecting your personal information, we will notify you and the relevant regulators as the law requires.

Email support@hydronate.com with the subject line "Privacy Request" and tell us which right you are exercising. You can also write to us at the mailing address at the bottom of this page.

To opt out of targeted advertising specifically, the fastest path is our opt-out page or enabling Global Privacy Control — neither requires you to contact us.

Verification. We will ask you to confirm details we already have on file, such as the email address on your order. For a deletion request we may ask for more. We do this so we do not hand your information to someone pretending to be you. If we cannot verify you, we will tell you why.

Authorized agents. Someone may make a request on your behalf if they give us written proof you authorized them. We may still verify your identity with you directly.

Timing. We acknowledge requests within 10 business days and respond within 45 days. If we need more time, we may extend once by another 45 days and will tell you before we do.

Appeals. If we deny your request, reply to our decision with the subject line "Privacy Appeal." We will respond within 45 days with our reasoning. If we deny the appeal, you may complain to your state attorney general.

If you visit our site with Global Privacy Control enabled in your browser or extension, we treat it as a valid request to opt out of the sale and sharing of personal information for that browser and device, automatically, without you having to do anything else. If we can match that browser to your account, we apply the opt-out to your account too.

Because the signal is stored per browser, you need it enabled in each browser and on each device. Clearing cookies may clear it.

We do not currently respond to older "Do Not Track" browser headers, because there is still no common standard for what they should mean.

Categories we collect. In the last twelve months we have collected these categories of personal information as defined by the CCPA: identifiers; customer records information; commercial information; internet or network activity; approximate geolocation; audio, electronic, or visual information (session recordings and support recordings); inferences; and, in limited circumstances described above, sensitive personal information consisting of health-related information you volunteer.

Sources, purposes, and recipients are described in the sections above on where information comes from, how we use it, and who we share it with.

Sale and sharing. We do not sell personal information for money. We do share identifiers and internet activity information with advertising platforms for cross-context behavioral advertising, which counts as "sharing" and may count as a "sale." Opt out at our opt-out page.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes that trigger the right to limit its use under the CCPA. We do not sell or share it.

Minors. We do not have actual knowledge that we sell or share the personal information of anyone under 16.

Retention is described in the retention section above.

Shine the Light. California Civil Code section 1798.83 lets California residents ask once a year for a list of third parties to whom we disclosed personal information for their own direct marketing in the prior year. We do not disclose personal information to third parties for their own direct marketing, so this list would be empty. Email support@hydronate.com with "Shine the Light Request" if you want that confirmed in writing.

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, and others as their laws take effect — have rights to access, correct, delete, port, and opt out of targeted advertising and sale, and to appeal a denial.

Use the same process described above. We apply these rights the same way for everyone who asks, regardless of which state you are in, because sorting people by state is more error-prone than simply honoring the request.

Washington and Nevada residents should also read the consumer health data section above, which grants additional rights.

Our store, checkout, and customer accounts run on Shopify. Two different things are happening there:

Shopify as our service provider. For most of what you do on our store, Shopify processes your information on our instructions, to provide the store to us. For that processing, we are responsible and this policy applies.

Shopify for its own purposes. Shopify also uses information about your interactions across the merchants on its platform to protect against fraud and to power certain features it offers merchants. For that processing, Shopify is responsible, not us, and its own policy governs. You can read the Shopify Consumer Privacy Policy and submit requests to Shopify directly through the Shopify Privacy Portal.

If you are not sure which one you need, write to us and we will point you to the right place.

A review you submit is public. Your display name, rating, text, photos, and the date show on the site, and search engines can index them.

Please do not include your full name, address, phone number, email, or details about a medical condition in a review. If you do, we may edit or remove it.

We may reuse your review in marketing, including on the site, in email, and in ads, as described in our Terms of Service. Ask us at support@hydronate.com and we will take a review down.

We link to other sites — published research, partners, social platforms, and our tracking provider. Once you follow a link, you are on someone else's site under someone else's privacy policy. We do not control what they collect and we are not responsible for it.

Social media buttons and embeds can let those platforms know you visited a page here, even if you do not click them.

Our products are for adults. The site is not directed to children, and you must be at least 18 to buy from us or hold an account — the same threshold as our Terms of Service.

We do not knowingly collect personal information from anyone under 18, and we do not knowingly sell or share the personal information of anyone under 16.

If you are a parent or guardian and believe your child gave us personal information, email support@hydronate.com and we will delete it.

We are based in the United States and we operate here. If you use the site from another country, your information will be transferred to and processed in the United States, where privacy laws differ from those where you live.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.

If you are in the EEA or UK, our legal bases are: performing our contract with you (orders, subscriptions, support); your consent (marketing email and texts, non-essential cookies); our legitimate interests (security, fraud prevention, improving the site); and compliance with legal obligations. You may withdraw consent at any time, and you may complain to your local data protection authority.

If you think we have mishandled your personal information, tell us first — email support@hydronate.com with the subject line "Privacy Complaint." We would rather fix it than have you find out from someone else.

You also have the right to complain to your state attorney general, or, outside the United States, to your local data protection authority. Contacting us first does not take that right away.

We will update this policy when our practices change or the law does. When we do, we will change the "last updated" date at the top of this page and post the new version here.

If a change materially affects how we use information we already hold about you, we will give you notice — by email or a notice on the site — before it takes effect, and where the law requires it, we will ask for your consent.

We do not backdate changes. The version posted when you gave us information is what governed that information at the time.

Email: support@hydronate.com — the fastest way to reach us, and the right address for any privacy request. We answer every privacy request that comes in by email.

Mail: Hydronate LLC, 140 East Broadway Ave #25, Jackson, WY 83001, United States

Useful subject lines: "Privacy Request" for access, deletion, or correction; "Health Data Request" for consumer health data; "Privacy Appeal" to appeal a denial; "Privacy Complaint" if we got something wrong.

For advertising opt-out, you do not need to email anyone — use our opt-out page or turn on Global Privacy Control.