Privacy Policy

Last updated: July 22, 2026

Herbal Roots (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit herbalrootsshop.com or related pages, create an order, join a waitlist, or otherwise contact us. By using the site, you agree to this policy.

This page is a practical policy for a U.S. small-batch herbal ecommerce shop. It is not legal advice. Have counsel review it before relying on it for compliance.

1. Who we are

Herbal Roots sells small-batch teas, tinctures, capsules, salves, and related products to customers in the United States. For privacy questions, contact us at the email listed in the Contact section below.

2. Information we collect

Depending on how you use the site, we may collect:

Contact & order details: name, email, shipping and billing address, phone number, and order contents.
Payment information: processed by our payment provider (e.g. Stripe). We do not store full card numbers on our servers.
Account / admin access: credentials or session data for staff tools.
Communications: waitlist requests, support emails, and messages you send us.
Device & usage data: IP address, browser type, pages viewed, referring URLs, and approximate location derived from IP (when logs or analytics are enabled).
Cookies & similar tech: see our Cookie Policy.

3. How we use information

Process, fulfill, and ship orders; provide receipts and updates.
Operate waitlists and notify you when items return to stock.
Respond to questions and provide customer support.
Improve the site, prevent fraud, and maintain security.
Comply with law, tax, and accounting requirements.
Send service messages; marketing only if you opt in or as allowed by law.

4. How we share information

We do not sell your personal information for money. We may share data with:

Service providers: hosting (e.g. Vercel), database, email delivery, payment processors, shipping carriers, and analytics tools that process data on our behalf.
Legal & safety: when required by law, court order, or to protect rights, safety, and security.
Business transfers: if we merge, sell, or reorganize, information may transfer under this policy or a successor notice.

5. U.S. state privacy rights (all 50 states + D.C.)

Privacy rights vary by state. Residents of states with comprehensive privacy laws (including, without limitation, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, as those laws apply over time) may have rights such as:

Right to know / access personal information we hold about you.
Right to correct inaccurate personal information.
Right to delete personal information, subject to legal exceptions.
Right to obtain a portable copy of certain information.
Right to opt out of “sale,” “sharing,” or targeted advertising, where those terms apply.
Right to limit use of sensitive personal information, where applicable.
Right to appeal a denied request, where state law provides an appeal process.
Right not to be discriminated against for exercising privacy rights.

California (CCPA/CPRA): We do not knowingly sell personal information. If we ever use cookies or partners that constitute a “sale” or “share” for cross-context behavioral advertising, we will provide a “Do Not Sell or Share My Personal Information” method and honor Global Privacy Control (GPC) signals where required.

How to exercise rights: Email us with the subject “Privacy Request,” your state of residence, and the request type. We will verify your identity as required and respond within the timelines set by applicable law (often 45 days, with possible extension). Authorized agents may submit requests where state law allows, with proof of authority.

Residents of states without a dedicated consumer privacy statute still have rights under federal law (e.g. CAN-SPAM for marketing email) and may contact us to access, correct, or delete information we control, subject to legal retention needs.

6. Children

Our site is not directed to children under 13 (or under 16 where a higher age applies). We do not knowingly collect personal information from children. If you believe a child provided information, contact us and we will delete it as required.

7. Retention & security

We keep personal information only as long as needed for the purposes above, including legal and tax retention. We use reasonable administrative, technical, and physical safeguards. No method of transmission or storage is 100% secure.

8. International visitors

We primarily serve the United States. If you access the site from elsewhere, your information may be processed in the U.S., where laws may differ from those in your country.

9. Changes

We may update this policy from time to time. The “Last updated” date will change when we post revisions. Continued use after changes means you accept the updated policy.

10. Contact

Privacy questions or requests: use the contact email published on this site or reply to any order email you receive from us. Include enough detail for us to locate your information.