Privacy Policy

1. Information We Collect

We collect information you provide directly and information gathered automatically as you use the platform.

a) Information You Provide

• Account Information: Name, email address, password, and profile details when you register.
• Health & Wellness Assessment Data: Mood, activity preferences, wellness goals, and symptom information you voluntarily enter during personalization assessments.
• Purchase Information: Billing address, shipping address, and order details. Payment card data is processed by our PCI-compliant payment processor and never stored on our servers.
• Communications: Messages you send us via email, contact forms, or customer support channels.
• Newsletter Signup: Email address if you subscribe to marketing communications.

b) Information Collected Automatically

• Usage Data: Pages visited, products viewed, time spent, click-through patterns, and search queries.
• Device & Technical Data: IP address, browser type and version, operating system, device identifiers, and time zone.
• Cookies & Tracking Technologies: Session cookies, persistent cookies, and similar technologies as described in Section 6.
• Location Data: General geographic location inferred from IP address (not precise GPS location unless explicitly granted).

2. How We Use Your Information

• Create and manage your account and process your purchases.
• Deliver AI-powered product recommendations personalized to your wellness preferences and goals.
• Process payments, fulfill orders, and arrange shipping and returns.
• Send transactional communications (order confirmations, shipping updates, password resets).
• Send marketing communications if you have opted in — you may opt out at any time.
• Improve and optimize our website, AI algorithms, and product catalog.
• Detect, investigate, and prevent fraudulent transactions, abuse, and security incidents.
• Comply with applicable legal obligations and respond to lawful governmental requests.
• Analyze aggregate, anonymized usage trends to improve the platform experience.

3. AI Personalization & Health Data

Our platform uses AI to personalize product recommendations based on your wellness profile. This includes processing data you enter in assessments (e.g., mood, activities, health goals).

• Voluntary Disclosure: All health and wellness data is self-reported and voluntary. You are never required to provide this information.
• Purpose Limitation: Health-related data is used exclusively to generate personalized product recommendations and is never sold to third parties or used for insurance, employment, or clinical purposes.
• Not Medical Records: Our platform is not a healthcare provider. Data entered is not subject to HIPAA protections unless otherwise stated, but we apply equivalent security standards to sensitive wellness information.
• Data Minimization: We collect only the information necessary to deliver the personalization features you choose to use.
• Deletion: You may delete your wellness profile and assessment history at any time from your account settings.

4. Information Sharing & Disclosure

We do not sell your personal information. We may share your data in the following limited circumstances:

• Service Providers: Trusted vendors who assist in operating the platform (payment processors, shipping carriers, cloud hosting, email delivery, analytics). These providers are contractually bound to protect your data and may not use it for their own purposes.
• Legal Requirements: When required by law, regulation, court order, or lawful governmental request.
• Safety & Fraud Prevention: To protect the rights, safety, and property of Canalytics Shop, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations and notice to you.
• With Your Consent: For any other purpose with your explicit consent.

5. Data Security

We implement industry-standard technical, administrative, and physical safeguards to protect your personal information, including:

• AES-256 encryption for sensitive data at rest.
• TLS 1.2+ encryption for all data in transit.
• Role-based access controls limiting data access to authorized personnel.
• Regular security audits and vulnerability assessments.
• Audit logging of access to sensitive records.

No method of transmission or storage is 100% secure. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance functionality and analyze usage.

• Essential Cookies: Required for core site functionality such as authentication and shopping cart persistence. These cannot be disabled.
• Performance Cookies: Help us understand how visitors interact with the site so we can improve it (e.g., page load analytics).
• Personalization Cookies: Store your preferences (such as dark mode or selected filters) to improve your experience on return visits.
• Marketing Cookies: Used to deliver relevant advertisements if you have opted in. You may opt out via your account settings or browser controls.

You can control cookies through your browser settings. Disabling certain cookies may affect site functionality.

7. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal obligations to retain certain records.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Opt-Out of Marketing: Unsubscribe from marketing emails at any time using the unsubscribe link or by contacting us.
• Opt-Out of Sale / Sharing (CCPA): California residents have the right to opt out of the sale or sharing of personal information. We do not sell personal information.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise your rights, contact us at privacy@canalyticsshop.com. We will respond within 30 days (or as required by applicable law).

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. We retain transaction records for seven (7) years for tax and legal compliance. Wellness assessment data is retained until you delete it or request account deletion. Anonymized, aggregated analytics data may be retained indefinitely as it cannot be linked to any individual.

9. Children's Privacy

Our services are not directed to individuals under the age of 21. We do not knowingly collect personal information from anyone under 21. If we become aware that we have collected personal data from a minor without appropriate consent, we will take steps to delete that information promptly. If you believe a minor has provided us with personal data, please contact us immediately.

10. CBD & Cannabis Legal Notice

Our products contain hemp-derived cannabidiol (CBD) and related compounds. The collection and use of your data in connection with these purchases is governed by this Privacy Policy. We do not disclose purchase history related to cannabis or CBD products to employers, insurers, law enforcement, or any third party except as required by lawful court order or subpoena. We comply with all applicable state and federal laws regarding the sale and marketing of hemp-derived products.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal information.

12. International Data Transfers

Canalytics Shop operates in the United States. If you are accessing our services from outside the U.S., your information may be transferred to, stored, and processed in the United States. By using our services, you consent to such transfer. We apply appropriate safeguards consistent with applicable data protection laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. When we do, we will revise the "Last Updated" date at the top of this page. If we make material changes, we will notify you by email or via a prominent notice on our website at least 30 days before the changes take effect. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: