Privacy Policy

Chaé Organics LLC, 23300 US Highway 160, Walsenburg, Colorado 81089, is the controller of personal information collected through chaeorganics.com.

This policy covers the Site, our online store, and the emails we send. It doesn't cover third-party sites we link to, or information you give us offline.

Information you give us

• Order information — name, billing and shipping address, email, phone, order contents.
• Account information — name, email, password, saved addresses, order history, subscription and rewards status.
• Payment information — handled by our payment processors. We receive confirmation, card type and last four digits, and a secure token; we never receive or store your full card number.
• Communications — messages you send us and their attachments.
• Reviews and content — product reviews, ratings and photos you submit.
• Marketing preferences — your subscription status and how you interact with our emails.

Collected automatically

• Device and usage data — IP address, browser, operating system, referring page, pages viewed, time on site, clicks.
• Server logs — standard hosting logs recording requests to the Site.
• Cookies and similar technologies — see section 5.

From third parties

• Social sign-in — if you log in with Facebook or Google, we receive your name, email and profile identifier.
• Payment and fraud signals — our processors tell us whether a payment succeeded and may flag suspected fraud.
• Advertising and analytics partners — aggregated measurement about how our ads perform.

Where the GDPR or UK GDPR applies, we rely on:

• Contract — to take payment, fulfil and deliver your order, and run your account.
• Legitimate interests — to secure the Site, prevent fraud, understand how the store is used, and improve our products, balanced against your rights.
• Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation — to keep tax and transaction records.

We use cookies and similar technologies for four things:

• Strictly necessary — your cart, logged-in session, checkout, and bot protection. The Site can't work without these.
• Preferences — remembering choices like your region or dismissed banners.
• Analytics — Google Analytics 4 and Google Tag Manager.
• Advertising — Meta advertising pixels, to measure ad performance and show you Chaé ads on Meta platforms.

You can block or delete cookies in your browser settings, use Google's Analytics opt-out add-on, or adjust your Meta ad preferences. Blocking strictly necessary cookies will break checkout.

We honor Global Privacy Control browser signals as an opt-out of sale or sharing where law requires.

We don't sell your personal information for money. We share it with service providers who process it on our behalf, under contract:

We also disclose information where legally required, to enforce our terms, or in connection with a merger or sale of the business — in which case we'll tell you.

We're based in the United States, and our service providers are largely US-based. If you're in the EEA, UK or Switzerland, your information will be transferred to and processed in the United States, which has different data protection laws.

Where we make those transfers we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and, where applicable, our providers' certification under the EU–US Data Privacy Framework. You can ask us for details.

• Order and transaction records — at least 7 years, for tax and accounting.
• Account information — while your account is open, then up to 24 months of inactivity.
• Marketing lists — until you unsubscribe, then a suppression record so we don't re-add you.
• Support messages — up to 3 years.
• Analytics data — up to 14 months.
• Published reviews — kept while displayed; you can ask us to remove yours.

We protect the Site with TLS encryption, a web application firewall, bot protection on forms and login, and access controls limiting who on our team can see customer data. Payment card data is tokenized by our processors and never stored on our systems.

No method of transmission or storage is completely secure. If a breach affects your information, we'll notify you and the relevant regulator as law requires.

Depending on your state — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana — you may have the right to:

• know what personal information we collect, use and disclose;
• access a copy of it;
• correct inaccurate information;
• delete it, subject to legal exceptions;
• opt out of sale, sharing, or targeted advertising;
• opt out of profiling with legal or similarly significant effects; and
• not be discriminated against for exercising these rights.

We don't knowingly sell personal information for money, and we don't use or disclose sensitive personal information for purposes requiring a right to limit. We do share data with advertising partners for targeted advertising, and you can opt out by emailing us, by enabling Global Privacy Control in your browser, or by declining advertising cookies.

Californians may also designate an authorized agent to make a request. We'll verify the request before acting on it.

If you're in the EEA, UK or Switzerland, you have the right to:

• Access — get a copy of your personal data. This is free. We may charge a reasonable fee only for manifestly unfounded, excessive or repetitive requests.
• Rectification — have inaccurate data corrected or incomplete data completed.
• Erasure — have your data deleted where the conditions are met.
• Restriction — limit how we process your data in certain circumstances.
• Object — object to processing based on legitimate interests, and to direct marketing at any time.
• Portability — receive data you gave us in a machine-readable format.
• Withdraw consent — at any time, without affecting processing already carried out.
• Complain — to your local supervisory authority, or the UK Information Commissioner's Office.

We respond within one month, extendable by two further months for complex requests, and we'll tell you if we need the extension.

Email customercare@chaeorganics.com or write to us at the address below. Tell us what you'd like to do and which email address your account uses. We'll verify your identity before acting — usually by confirming details we already hold. We won't charge you, and we won't treat you differently for asking.

We send marketing email only to people who've opted in. Every marketing email has an unsubscribe link, and you can also manage preferences in your account or email us. Unsubscribing from marketing doesn't stop transactional messages like order confirmations and shipping notices.

The Site isn't directed at children under 16, and we don't knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it.

We may update this policy. We'll change the effective date above and, where changes are material, give notice on the Site or by email.