Privacy policy
# Privacy Policy
**Effective date: September 7, 2026**
This policy explains what personal information Nootrify Supplements Inc. ("Nootrify", "we", "us", "our") collects when you visit nootrify.com (the "Site"), buy our products, subscribe, contact us, or interact with our emails and ads. It explains why we collect it, who we share it with, and the choices you have.
We wrote this to be read. If anything is unclear, email us at shop@nootrify.com with "Privacy" in the subject line.
---
## 1. Who we are and how to reach us
**Legal entity:** Nootrify Supplements Inc.
**Mailing address:** 497-1733 H St Suite 450, Blaine, WA 98230
**Email:** shop@nootrify.com
We are a Canadian company selling to customers primarily in the United States. We are responsible for the personal information we collect. Privacy requests, questions, and complaints go to the email above with "Privacy Request" in the subject line.
---
## 2. Who this policy covers
This policy applies to anyone who visits the Site, buys from us, subscribes, creates an account, joins our email list, leaves a review, or contacts us. It does not cover employees, contractors, or job applicants.
Our Terms of Service govern your use of the Site and should be read with this policy.
---
## 3. What we collect
### 3.1 Information you give us
**When you order or create an account**
- Name, email address, phone number
- Shipping and billing addresses
- Account password (stored in encrypted form by Shopify; we never see it)
- Products purchased, order dates, amounts, and subscription plan details
**Payment information**
Payment is handled by Shopify Payments, Shop Pay, and any other payment methods shown at checkout. We receive the last four digits of your card, card type, and transaction status. We never receive or store your full card number or CVV.
**When you contact us**
- Anything you include in an email, form, or social media message, including support requests and feedback
**When you subscribe to marketing**
- Your email marketing opt-in status and preferences
**When you leave a review**
- Your name (or the display name you choose), review text, star rating, and any photo or video you upload
- Reviews are collected through Judge.me and are displayed publicly on the Site
**Health information**
We do not ask for health information. If you voluntarily share it with us (for example, in a support email about a medication), we use it only to respond to you and do not use it for marketing.
### 3.2 Information collected automatically
When you use the Site, we and the service providers listed in Section 5 collect:
- IP address and approximate location (city, region, country)
- Device type, operating system, browser, screen size, and language
- Pages viewed, products viewed, items added to cart, time on page, clicks, scrolls, and mouse movement
- Referring website, search terms, and the ad or email that brought you to us
- Session recordings and heatmaps (see Section 5.3)
- Cookie identifiers and similar tracking identifiers
### 3.3 Information from other sources
- **Shopify** provides fraud and risk signals on orders
- **Our fulfillment partner and shipping carriers** provide tracking and delivery status
- **Meta, Google, and Microsoft** provide aggregated ad performance data and, where you have consented on their platforms, may match your activity on our Site to your account on theirs
- **Klaviyo** provides email engagement data (opens, clicks) and predictive metrics about your likely future activity
---
## 4. How we use your information
| Purpose | Examples |
|---|---|
| **Fulfilling your order** | Processing payment, shipping through our fulfillment partner, sending order and shipping updates, handling refunds |
| **Running your subscription** | Billing on your renewal date, sending renewal reminders, letting you pause, skip, change, or cancel |
| **Customer support** | Answering your questions, resolving problems with an order |
| **Reviews** | Inviting you to review a product after delivery, publishing reviews you submit |
| **Marketing** | Sending emails about products, content, and offers; showing you ads on Meta, Google, and Microsoft platforms; measuring whether those ads work |
| **Improving the Site** | Understanding how people use the Site, finding and fixing bugs, testing changes, and improving speed |
| **Security and fraud prevention** | Detecting fraudulent orders, protecting accounts, preventing abuse of promotions |
| **Legal compliance** | Keeping tax and accounting records, responding to lawful requests, enforcing our Terms |
### 4.1 Automated tools and artificial intelligence
We use automated tools, including artificial intelligence (AI), to help us run the business. This includes:
- **AI assistants** that we use internally to analyze orders, answer customer questions, draft communications, and review Site performance. When we use these tools, order and customer information may be processed by the AI provider (for example, Anthropic) under contract terms that prohibit the provider from using your information to train their models or for any purpose other than providing the service to us.
- **AI features built into our service providers.** Klaviyo uses automated processing to predict when to send emails and how likely a customer is to order again. Shopify uses automated fraud analysis on every order. Microsoft Clarity uses automated processing to summarize session recordings.
We do not use AI or automated processing to make decisions that have legal or similarly significant effects on you, such as denying you the ability to purchase.
---
## 5. Cookies, analytics, and advertising
We use cookies, pixels, and similar technologies. Here is what each one does and who runs it.
### 5.1 Essential (always on)
**Shopify.** Runs the Site, cart, checkout, and account login. Shopify sets cookies required for the store to function and for basic, aggregated store analytics. Shopify's privacy policy: https://www.shopify.com/legal/privacy
**Seal Subscriptions.** Manages your subscription. Sets cookies needed to display subscription options and your subscription portal.
**BOGOS.** Applies free gift offers to your cart.
**Bundler.** Displays bundle pricing at checkout.
**Shop Pay.** Shopify's accelerated checkout. If you use it, Shopify stores your payment details under its own privacy policy.
**Google reCAPTCHA.** Protects our forms from bots. Google collects hardware and software information to do this. Google's privacy policy: https://policies.google.com/privacy
### 5.2 Analytics
**Shopify Analytics.** Shopify's built-in store analytics measure pages viewed, traffic sources, and conversion rates. This data stays inside Shopify.
**Klaviyo.** Tracks which pages and products you view on the Site if you have clicked a link in one of our emails or signed up for our list, so we can send you relevant emails (for example, an abandoned cart reminder). Klaviyo's privacy policy: https://www.klaviyo.com/legal/privacy/privacy-notice
### 5.3 Session replay and heatmaps
We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the [Microsoft Privacy Statement](https://www.microsoft.com/privacy/privacystatement).
What a session recording captures: your mouse movements, clicks, scrolls, and the pages you view, replayed as a video. Clarity masks text you type into form fields by default, and we do not record checkout pages. Recordings are stored by Microsoft and are accessible only to Nootrify staff.
Clarity runs on every visit to the Site and is not controlled by the cookie preferences banner or the Global Privacy Control signal. To stop Clarity from recording your visits, block the domain clarity.ms in your browser or with a content-blocking extension, or opt out of Microsoft's data collection at https://account.microsoft.com/privacy/ad-settings. We do not sell or share Clarity data with anyone other than Microsoft, which processes it as our service provider.
### 5.4 Advertising
**Meta Pixel and Conversions API (Facebook and Instagram).** Tells Meta when you visit the Site, view a product, add to cart, or purchase, so we can measure our ads and show ads to people who visited the Site or who are similar to our customers. Some of this data is sent from our servers to Meta (the Conversions API) rather than from your browser, which means browser-level cookie blocking does not stop it; the opt-out methods in Section 5.5 do. Meta's privacy policy: https://www.facebook.com/privacy/policy
**Google Ads.** When we run Google Ads, a conversion tag tells Google when a visitor who clicked one of our ads makes a purchase, and lets Google show our ads to people who visited the Site. Google's advertising privacy information: https://policies.google.com/technologies/ads
**Google & YouTube channel (Google Merchant Center).** Lets our products appear in Google Shopping and YouTube product listings, and sends a conversion signal to Google when you view a product or make a purchase so we can measure those listings. Google may use this data to show you our products across Google services. Manage Google ad settings: https://adssettings.google.com
**Microsoft Advertising.** Covered by the Microsoft Clarity disclosure in Section 5.3. Used to measure ads on Bing and Microsoft platforms.
**YouTube.** Some pages embed YouTube videos. When a video loads, YouTube (Google) sets cookies and records that you viewed it. If you arrived from a YouTube video or product shelf, YouTube also records that referral.
### 5.5 Your cookie choices
- Use the cookie preferences banner on the Site, where offered, to turn off the advertising and marketing cookies set by Meta, Google, Klaviyo, and BOGOS
- We honor the Global Privacy Control browser signal as a request to opt out of the sharing of your information with Meta, Google, and Microsoft Advertising for targeted advertising
- Microsoft Clarity session recording and Judge.me are not affected by the banner or the GPC signal; see Section 5.3 for how to block Clarity
- Block or delete cookies in your browser settings (the cart and checkout may stop working)
- Opt out of interest-based ads from participating companies at https://optout.aboutads.info and https://optout.networkadvertising.org
- Adjust ad settings directly on Meta, Google, and Microsoft using the links above
---
## 6. Who we share information with
We share personal information only with the service providers we need to run the business, with the ad platforms described in Section 5, and when the law requires it. Here is the full list.
| Recipient | What they do for us | What they receive |
|---|---|---|
| **Shopify Inc.** | Runs the Site, checkout, payments, and customer accounts | Everything in Section 3.1 |
| **Seal Subscriptions** | Manages subscription billing and your subscription portal | Name, email, order and subscription details |
| **BOGOS (Secomapp)** | Adds free gift offers to the cart | Cart contents, order details |
| **Judge.me** | Collects and displays product reviews, sends review request emails | Name, email, order details, review content |
| **Klaviyo** | Sends our emails, tracks email engagement, on-site activity, and predictive analytics | Name, email, phone, order history, browsing activity on the Site |
| **Fulfillment Plus (New York)** | Picks, packs, and ships your order | Name, shipping address, phone, order contents |
| **Bundler** | Manages product bundles at checkout | Cart contents, order details |
| **Shipping carriers (USPS, UPS, and others)** | Deliver your order | Name, address, phone |
| **Microsoft** | Clarity session replay, Microsoft Advertising | Section 5.3 and 5.4 |
| **Meta Platforms** | Advertising and measurement | Section 5.4 |
| **Google** | Google Ads, Merchant Center and YouTube product listings, reCAPTCHA, YouTube embeds | Section 5.1 and 5.4 |
| **AI assistant providers (Anthropic and similar)** | Internal analysis and support tooling | Order and customer records as needed for the task (Section 4.1) |
| **Professional advisors** | Accounting, legal, tax | Records as needed |
| **Law enforcement and regulators** | When legally required | As required by the request |
| **A buyer of our business** | If Nootrify is sold or merged, customer records transfer with it | Everything in Section 3 |
We require every service provider to protect your information and to use it only to provide services to us.
### 6.1 "Sale" and "sharing" under US state privacy laws
We do not sell your personal information for money. However, when we use the Meta, Google, and Microsoft advertising tools described in Section 5.4, those companies receive information about your activity on the Site and may use it for their own advertising purposes. Under the California Consumer Privacy Act and similar state laws, this counts as "sharing" personal information for cross-context behavioral advertising, or as a "sale" or "targeted advertising" in some states.
The categories involved are: identifiers (cookie IDs, IP address, hashed email), internet activity (pages viewed, products viewed, purchases), and commercial information (what you bought).
**You can opt out** using any of the methods in Section 5.5, or by emailing shop@nootrify.com with "Do Not Sell or Share" in the subject line. We do not knowingly sell or share the personal information of anyone under 16.
---
## 7. Where your information is stored
Nootrify is a Canadian company. Shopify stores customer data in the United States and Canada. Our other service providers are located primarily in the United States. If you are outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from your own. We rely on contractual protections with each provider to keep your information safe.
---
## 8. How long we keep it
| Information | Retention |
|---|---|
| Order and payment records | 7 years after the order, for tax and accounting requirements |
| Account information | Until you ask us to delete it, or 3 years after your last order |
| Subscription records | Duration of the subscription plus 7 years |
| Support emails | 3 years after the last message |
| Marketing list membership | Until you unsubscribe, plus a suppression record so we do not email you again |
| Reviews | Until you ask us to remove them |
| Session recordings (Clarity) | 30 days, then deleted by Microsoft |
| Ad platform and analytics data | Per each provider's retention settings, typically 2 to 26 months |
When we no longer need it, we delete it or anonymize it.
---
## 9. Your rights
### 9.1 If you live in the United States
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws have the right to:
- **Know** what personal information we have collected about you and how we use and share it
- **Access** a copy of your personal information in a portable format
- **Correct** inaccurate personal information
- **Delete** your personal information, subject to exceptions (for example, we must keep order records for tax purposes)
- **Opt out** of the sale or sharing of your personal information and of targeted advertising (see Section 6.1)
- **Opt out** of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not do this)
- **Not be discriminated against** for exercising any of these rights
- **Appeal** if we decline your request, by replying to our response email
**California residents.** In the past 12 months we have collected the following categories of personal information as defined by the CCPA: identifiers, customer records, commercial information, internet activity, approximate geolocation, and inferences (for example, likelihood of reordering). We collect them from the sources in Section 3, use them for the purposes in Section 4, and disclose them to the recipients in Section 6. We do not collect sensitive personal information as defined by the CCPA except payment card details handled by our payment processor. You may designate an authorized agent to make a request on your behalf; we will ask the agent for proof of your written permission and may ask you to verify your identity directly.
**How to make a request.** Email shop@nootrify.com with "Privacy Request" in the subject line and tell us which right you are exercising. We will verify your identity by matching the email address and, if needed, recent order details. We respond within 45 days. If you have an account, you can also update your name, addresses, and email by logging in.
### 9.2 If you live in Canada
Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, you may access the personal information we hold about you, request corrections, withdraw consent (subject to legal and contractual limits), and challenge our compliance with this policy. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
### 9.3 If you live in the EEA or United Kingdom
We process your information on the following legal bases: performance of a contract (orders and subscriptions), consent (marketing and non-essential cookies), legitimate interests (fraud prevention, Site improvement, and security), and legal obligation (tax records). You have the rights to access, rectify, erase, restrict, port, and object, and to withdraw consent at any time. You may lodge a complaint with your local supervisory authority.
### 9.4 Marketing choices
- **Email:** click "unsubscribe" at the bottom of any marketing email, or email us
- **Ads:** see Section 5.5
Opting out of marketing does not stop transactional messages such as order confirmations, shipping updates, subscription renewal notices, and legal notices.
---
## 10. Security
We protect your information with encryption in transit (TLS), Shopify's PCI DSS Level 1 certified checkout, access controls limiting staff access to customer data, and two-factor authentication on our administrative accounts. No system is perfectly secure. Keep your account password private and tell us immediately if you suspect unauthorized access.
---
## 11. Children
Our products are for adults. The Site is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, email shop@nootrify.com and we will delete it.
---
## 12. Links to other sites
The Site links to other websites, including YouTube, Instagram, and our service providers. Their privacy practices are their own. Review their policies before sharing information with them.
---
## 13. Changes to this policy
When we change this policy, we will post the new version here and update the effective date. If the change is material, we will also email customers or post a notice on the Site before it takes effect.
---
## 14. Complaints
Contact us first at shop@nootrify.com with "Privacy Complaint" in the subject line. We will respond within 30 days. If you are not satisfied, you may contact the privacy regulator in your jurisdiction: the Office of the Privacy Commissioner of Canada, your US state attorney general, or the California Privacy Protection Agency.