1. Overview & Scope
This Privacy Policy explains what information is collected when you visit the ELIM® One Grain storefront or purchase ELIM® One Grain Collagen Duo, how that information is used and protected, and the choices available to you. This policy applies to online interactions across our storefront and self-serve subscription portal.
2. Information Collected During Checkout
You can browse our storefront without creating an account or submitting personal details. When you initiate an order, checkout is hosted by Stripe, Inc. (PCI-DSS Level 1 certified), which collects the information required to process and ship your order:
- Contact & delivery details: your name, email address for order receipts and portal sign-in links, United States shipping and billing address, and telephone number for carrier delivery coordination.
- Order & subscription metadata: your selected supply tier (1, 2, or 3 months), treatment count, purchase mode (one-time or recurring), applied promotion codes, and payment status.
- Payment credentials: your payment card number, expiration date, CVV, or digital wallet token are entered directly on Stripe’s hosted checkout domain. Our storefront servers never receive, process, or store raw payment card numbers.
At the network edge, standard technical request metadata (such as IP address, TLS cipher, HTTP headers, and user-agent string) is processed transiently to deliver static assets and defend against automated abuse.
3. How We Use Your Information
We use checkout and technical information strictly to:
- Fulfill and ship your one-time or recurring orders to your designated United States address;
- Send transactional order confirmations, payment receipts, and subscription renewal notices through Stripe;
- Authenticate self-serve billing changes and cancellations via Manage subscription;
- Detect fraud, enforce cross-site request forgery (CSRF) protections, and maintain edge availability; and
- Comply with tax, accounting, consumer-protection, and legal obligations.
4. Service Providers & Data Sharing
We do not sell, rent, or trade your personal information, and we do not share customer lists with third-party data brokers or cross-context behavioral ad networks. We share data only with essential infrastructure and fulfillment partners acting on our instructions:
- Stripe, Inc.: payment processing, fraud screening, tax calculation, receipt delivery, and hosted Customer Portal authentication (Stripe Privacy Policy).
- Cloudflare, Inc.: global content delivery, TLS termination, DDoS mitigation, and serverless Worker execution.
- Fulfillment & shipping carriers: warehouse pick-and-pack operations and domestic United States postal/parcel carriers solely to deliver your physical order.
We may also disclose information when required by valid legal process or to protect the rights, safety, and security of customers and our service.
6. Data Retention & Security Measures
We protect storefront traffic and checkout workflows using HTTPS/TLS encryption, a strict Content-Security-Policy (CSP), constant-time HMAC-SHA256 webhook signature verification, and same-origin request validation. Our post-checkout confirmation endpoint strips personal contact and address fields, returning only non-identifying order summary attributes (`status`, supply months, and total amount) with `Cache-Control: no-store`.
Order and transaction records in Stripe are retained for the period required by applicable tax, financial reporting, and chargeback-resolution regulations, after which they are deleted or de-identified.
7. Your Privacy Choices & State Rights
Depending on your United States state of residence (including California, Virginia, Colorado, Connecticut, Texas, Oregon, and other states with consumer privacy statutes), you may have the right to request access to, correction of, or deletion of personal information we maintain about you, subject to statutory exceptions for completed transactions and tax records.
Subscribers can update billing details, shipping addresses, and active subscriptions directly at Manage subscription. For data access or deletion requests, contact us using the support email listed on your Stripe order receipt. We will verify your identity via the email address associated with your order and will never discriminate against you for exercising your privacy rights.
8. Children’s Privacy & Policy Updates
This storefront is intended for adults and is not directed to individuals under 16 years of age; we do not knowingly collect personal information from children. If we update this Privacy Policy, we will publish the revised text on this page and update the effective date at the top of the document.