Privacy Policy

Information you provide. When you create an account or place an order, we collect your name, email address, an access code, and a password (stored only as a securely hashed value). When you place an order we collect the items and order details. If you contact us, we collect the contents of your message.

Age verification.To confirm you meet our minimum age requirement, we ask for your date of birth at entry. We use it only to check that you are old enough and retain only the fact and time that age was confirmed — we do not store your date of birth.

Information collected automatically. Like most websites, we and our infrastructure providers may collect limited technical data such as IP address, browser/device type, and log information, and we set essential cookies (see Section 5).

We do not intentionally collect sensitive categories of personal information, and we ask that you not submit health, financial-account, or government-ID information through the site.

We use personal information to create and manage your account; process, confirm, and fulfill orders; arrange payment and shipping; communicate with you about your orders and account; provide customer support; maintain the security and integrity of the site; and comply with legal obligations.

We share personal information only as needed to operate the business:

Service providers. We use third parties to run the site, including hosting and database services (Vercel, Supabase), transactional email (Resend), and cryptocurrency payment processing (NOWPayments). These providers process data on our behalf under their own terms and privacy policies.

Legal and safety. We may disclose information if required by law, subpoena, or legal process, or to protect our rights, users, or the public.

Business transfers. Information may be transferred in connection with a merger, acquisition, financing, or sale of assets.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We use a small number of essential cookies: an age-verification cookie that remembers you have confirmed you are 21 or older, and a session cookie that keeps you logged in. These are necessary for the site to function. We do not currently use third-party advertising or analytics cookies. You can control cookies through your browser settings, though disabling essential cookies may break site functionality.

We keep personal information only as long as needed for the purposes described above, then delete or de-identify it. Our general schedule:

• Account information (name, email, access code, hashed password): kept while your account is active. Deleted or de-identified within 30 days of a verified deletion request, and accounts inactive for 24 months are reviewed for closure.

• Order and transaction records: retained as required to meet tax, accounting, and legal recordkeeping obligations (generally up to 4 years), after which they are deleted or anonymized.

• Age-verification and terms-acceptance records: kept for the life of the related account or order as proof of consent.

• Support and privacy-request records: kept up to 24 months to document handling, then deleted.

We may retain limited information longer where required by law or to resolve a dispute.

We take reasonable measures to protect personal information, including hashing passwords, restricting database access to server-side credentials, and enabling row-level security. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to: know what personal information we collect and how we use and share it; request access to or a copy of that information; request correction of inaccurate information; request deletion of your information; and not be discriminated against for exercising your rights. Because we do not sell or share personal information for advertising, no opt-out of sale is necessary.

The easiest way to exercise your access and deletion rights is from the Privacy & Data section of your client portal, which lets you request a copy of your data or request account deletion directly. You may also contact us using the details in Section 10. We respond within the timeframe required by law (up to 45 days for CCPA requests) and will verify your identity by confirming information associated with your account before acting on the request.

This site is intended only for adults 21 years of age or older. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.

The site may link to third-party websites. We are not responsible for the privacy practices of those sites; review their policies before providing information.

We may update this Policy from time to time. Changes are effective when posted, and we will update the “Last updated” date above. For questions or to exercise your privacy rights, contact us at privacy@savage-protocols.com.