Privacy Policy

What We Collect

When you place an order

Our checkout is powered by Stripe. When you purchase, Stripe collects your name, shipping address, email address, and payment details. We never see or store your full card number: Stripe handles all payment security. We retain your name, shipping address, and order details to fulfill and confirm your order.

When you contact us or sign up for email

Our contact and wholesale inquiry form collects your name and email address. You can also join our email list through the newsletter signup on the site, or through an exit-intent popup that offers a 10% first-order discount code in exchange for your email. Depending on the form, we may collect your name, your email address, or both.

Subscriber details (name and email when provided) are stored in Google Sheets, which we use as our email list database. We use Resend to send newsletters, welcome messages, and order-related emails.

Abandoned cart emails

We have built an abandoned cart email feature that may remind you about items left in your cart if you provided an email address during checkout or signup. This feature is not active yet. When we turn it on, those messages will use the same email tools described on this page, and every message will include an unsubscribe link.

Automatically collected data

If you accept cookies through our cookie consent banner, we use Microsoft Clarity and Smartlook for heatmaps and session recordings so we can understand how visitors use the site. These tools may collect your IP address, browser type, pages visited, referring URLs, and how you interact with the page. This data is used to improve our website. We do not sell this data. If you reject cookies, Clarity and Smartlook are not loaded.

Cookies

When you first visit, we show a cookie consent banner. Analytics tools only run after you choose Accept. If you choose Reject, we do not load Microsoft Clarity or Smartlook.

Our site uses cookies for two purposes:

• Analytics cookies (Microsoft Clarity and Smartlook): Track visit patterns, heatmaps, and session behavior so we can improve the site. These run only after you accept cookies.
• Functional cookies (Stripe): Required for checkout to work. These cannot be disabled if you wish to make a purchase.

You can also disable or delete cookies in your browser settings. Disabling functional cookies may prevent checkout from working correctly.

How We Use Your Information

• To process and fulfill your orders
• To send order confirmations and shipping updates
• To respond to your messages or wholesale inquiries
• To send newsletters, welcome offers, and product updates (only if you opted in)
• To send abandoned cart reminders once that feature is active (only if we have your email)
• To improve our website using analytics and session insights after cookie consent
• To comply with legal obligations

We do not sell, rent, or trade your personal information with third parties for their marketing purposes.

Who We Share Data With

We share your data only with services that help us run our store:

• Stripe: payment processing. PCI-DSS compliant. See stripe.com/privacy.
• Google Sheets: storage for our email subscriber list (name and email when provided).
• Microsoft Clarity: website analytics, heatmaps, and session insights, only after cookie consent. See clarity.microsoft.com.
• Smartlook: website analytics and session recording, only after cookie consent. See smartlook.com/privacy.
• Resend: newsletter, welcome, abandoned cart (when active), and transactional email.
• Shipping carriers: your name and address are shared with our carrier to deliver your order.

We may also disclose information if required by law.

Unsubscribing

Every marketing email we send includes an unsubscribe link. That link uses a secure, HMAC-verified token tied to your email address so only a valid link can update your subscription status. When you unsubscribe, we mark your address as unsubscribed in our Google Sheets subscriber list and stop sending marketing emails. This process is designed to meet CAN-SPAM requirements. You can also email us at info@tomyamyadomherbals.com and we will remove you.

Your Rights

Depending on where you live, you may have the right to request a copy of your data, correct inaccurate data, request deletion of your data, and opt out of marketing emails at any time.

California residents (CCPA): You have the right to know what personal information we collect and to request deletion. We do not sell personal information.

EU/EEA residents (GDPR): You have the right to access, rectify, erase, and port your data, and to object to or restrict processing.

To exercise any of these rights, email us at info@tomyamyadomherbals.com. We will respond within 30 days.

Data Retention

We retain order records for as long as required by applicable tax and accounting laws (typically 7 years). Newsletter subscriber data is retained in Google Sheets until you unsubscribe. Contact form data is retained only as long as necessary to respond to your inquiry. Analytics and session recording data is retained according to each provider’s settings and only collected after cookie consent.

Security

Payment data is handled entirely by Stripe and never stored on our servers. Unsubscribe links are protected with HMAC verification so they cannot be forged. We use industry-standard practices to protect the information we do hold.

Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top will reflect any changes.

Contact

Questions about this policy? Email us at info@tomyamyadomherbals.com.