Privacy policy
Last updated: September 3, 2026
Get Good Grove is run by Veylor Commerce LLC, a Wyoming limited liability company. This covers getgoodgrove.com and our order, subscription, and support channels.
We sell to the United States (all 50 states and DC), Canada, the United Kingdom, and Australia — not to US territories, not to APO/FPO/DPO addresses, and nowhere else, including the EU, the EEA, and Switzerland. Your rights come from the law where you live, and some of those laws only apply above a revenue or data threshold. We do not use threshold arguments to refuse a request.
What we collect
Your name, shipping and billing address, email, and phone number. Your order and subscription history: what you bought, what it cost, renewal dates, refunds, guarantee claims, discount codes. Card details go to our processor — we get a token, the brand, the last four digits, and the expiry, never the full number.
From your browser: IP address, cookie, device and advertising IDs, pages and products viewed, cart events, the ad that brought you, email opens and clicks, text delivery events. Coarse location — country, state, city — from your IP and the address you type. And whatever you write to us. We buy no marketing lists, and we ask for no date of birth, government ID, or biometric data.
Why we have it
To fill your order, including putting your name, address, and the parcel's contents and value on the customs declaration for a shipment to Canada, the UK, or Australia.
To run your subscription: charging the card you saved, emailing a reminder 7 days before every charge, and processing skips, pauses, and cancellations. Billing follows a delivery cadence, not a calendar period: a four-week cadence bills about thirteen times a year, not twelve. Full yearly costs are in our Subscription and Cancellation Policy.
To answer your messages, send the email and texts you asked for, and measure which ads produce sales. To screen orders for card fraud and to enforce our 90-day money-back guarantee limit of one first order per customer and household. To keep tax records and answer lawful demands.
Fraud and guarantee screening runs partly on an automated score, never the last word: if an order or claim is refused, email us and a person will look again.
Who gets it
Shopify hosts the store, checkout, your account, and your order history; Shopify is Canadian, and some processing happens there. Shopify Payments, with Stripe underneath, handles authorisation, refunds, and recurring charges, and Shop Pay and the Shop app hold what they need for checkout or tracking. Loop Subscriptions runs your renewal schedule; Klaviyo sends our email and texts; Meta Platforms receives the advertising data below. Our fulfilment and shipping partners sit outside the United States and get your name, address, phone, email, and order contents; customs authorities get the declaration on every parcel crossing a border.
Every provider — those, plus our analytics, support, and fraud tooling — is contractually bound to use your information only for that job, never to resell it, and to secure it. Nobody gets it to train artificial-intelligence models, and nothing goes to anyone for their own direct marketing. Otherwise: our lawyers and accountants, authorities where we are compelled, and a buyer if the business is sold, with notice. Email us with "Third Party List" in the subject and we will name the third parties that received yours.
Advertising counts as a sale, and you can switch it off
We do not sell your information for money. We do share it with advertising platforms in a way most US state laws call a "sale" or a "share", and we would rather say so than argue the label.
The Meta Pixel runs on the site, and we send matching conversion events to Meta server-side: your email and phone through a one-way hash, cookie and advertising IDs, IP address, what you viewed and added to cart, and the fact and value of your purchase. Meta measures our ads, suppresses existing customers, builds lookalike audiences, and uses the data under its own policy. Other advertising and analytics providers get comparable tags. Those are the only categories shared in the past twelve months: identifiers, purchase and browsing activity, coarse location, and inferences from them. Never sensitive information, never anyone we know to be under sixteen.
Three ways to stop it: the Your Privacy Choices link in the footer of every page, one toggle and no account needed; a Global Privacy Control signal, which we honour from every visitor in every state and country we sell into, required or not; or an email headed "Opt Out of Sale and Sharing", which attaches the opt-out to your customer record rather than one browser and is processed within 15 business days. GPC is browser-bound, so your laptop's signal does not opt out your phone.
Opting out changes nothing about your price or delivery, and we will not treat you differently for exercising a privacy right: the 20% Subscribe and Save discount buys a recurring-purchase commitment, not your data.
In the UK and Quebec the default is reversed: PECR and section 8.1 of Law 25 require consent first, so analytics and advertising tags stay off until you switch them on, and withdrawing is as easy as agreeing. Cart and checkout cookies run either way. Apart from GPC we ignore "Do Not Track".
Health information
We sell a supplement, so a purchase record sits close to health information. We ask nothing about symptoms or conditions, run no quiz, build no health-based audiences, and geofence no clinic or pharmacy. Health information you volunteer to support is used only to answer you and never added to a marketing audience. Washington and Nevada residents may withdraw consent for anything that might count as consumer health data, ask what we hold and who received it, or ask us to delete it — email us with "Health Data" in the subject; we answer within 45 days. We do not sell consumer health data.
Email and text messages
Every marketing email carries an unsubscribe link and we honour it immediately. Order and subscription emails are not marketing and continue.
Marketing texts need your express consent, and agreeing is never a condition of buying anything. Reply STOP to stop, HELP for help — but any clear expression of the wish to stop counts, by text or by email, and we act within five business days, usually within seconds. Up to 6 marketing messages a month. Message and data rates may apply. This runs under the TCPA and FCC rules in the US, CASL to a Canadian number, PECR to a UK number, and the Spam Act 2003 to an Australian one — each needing consent first, accurate identification of us, and a working opt-out; the law caps that at 10 business days in Canada, immediate in the UK, and 5 working days in Australia, and our five sits inside all of them.
Your number and consent record are never sold or passed on for anyone else's marketing, though the number on your record is matched in hashed form to advertising platforms as above. Opt out and we keep a minimal suppression record indefinitely, which a deletion request does not remove.
How long we keep things
- Orders, payments, refunds, guarantee and return records — 7 years from the order date
- Subscription and billing history, with the checkout consent behind it — 7 years from the final charge
- Email and text consent records — 5 years from opt-out or the last message; chargeback and fraud evidence — 5 years
- Support correspondence — 3 years from your last message
- Marketing profiles — until you opt out, or 36 months with no engagement
- Advertising and analytics identifiers — 24 months; server and security logs — 12 months
- Suppression records, and records of privacy requests — indefinitely, in minimal form
Security
TLS in transit, encryption at rest, multi-factor authentication on admin accounts, least-privilege access, vendor review before we integrate anything, and access revoked when someone leaves. Card data stays with PCI-DSS compliant processors and is never stored on our systems. If an incident affects your information we notify you and the regulator on your law's clock: your state's deadline in the US, the ICO within 72 hours in the UK, the OPC (and the CAI for Quebec residents) as soon as feasible where there is a real risk of significant harm, and in Australia an assessment within 30 days with notice to the OAIC where serious harm is likely.
Children
This is an 18-and-over store. We do not knowingly collect information from anyone under 18, delete it promptly if we learn we have, and never target advertising at anyone we know to be a minor. Parents and guardians: email us and we will delete.
Your rights
Wherever you live, you can ask what we hold and for a copy, ask us to correct or delete it, ask for it in a portable format, switch off the advertising sharing, limit our use of sensitive information, withdraw consent, and appeal a refusal — in every US state, including states whose own law gives less. Deletion has limits: we keep what tax law, an open dispute, an active subscription, fraud prevention, or a suppression record requires, and we tell you what we kept.
United Kingdom (UK GDPR, Data Protection Act 2018). Those rights, plus restriction of processing and an absolute right to object to direct marketing, honoured on receipt. Our bases: contract for the order and subscription, legal obligation for tax and customs records, legitimate interests for fraud screening and security, consent for marketing and the advertising tags. Transfers to the US run on the UK Extension to the EU-U.S. Data Privacy Framework, or the International Data Transfer Agreement. We answer within one month, extendable by two months for a complex request if we say so inside the first month. Complain to us — section 164A gives you that right and we acknowledge within 30 days — then to the Information Commissioner's Office, ico.org.uk.
Canada (PIPEDA, and Law 25 in Quebec). Those rights, plus a right to know what we used your information for and who received it, and to withdraw consent within legal and contractual limits we will explain rather than assert. Quebec adds deletion and de-indexing where the Act allows, a portable copy of what you gave us, and the right to make representations on a decision made solely by automated processing. While your information sits in the US it is subject to US law, including access by US courts. We answer within 30 days. Our privacy officer is reachable at hello@getgoodgrove.com with "Privacy Officer" in the subject. Complain to us, then to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca). Ask and we will write to you in French.
Australia (Privacy Act 1988 and the Australian Privacy Principles). Ask for access (APP 12) and correction (APP 13). Tell us to stop direct marketing and to say where we got your information (APP 7); we act on receipt. Deal with us anonymously or pseudonymously where practicable. We answer within 30 days. There is no general right to erasure; APP 11.2 instead makes us destroy or de-identify what we no longer need. Your information goes overseas under APP 8 and we stay accountable for it. Complain to us and give us 30 days, then take it to the Office of the Australian Information Commissioner, oaic.gov.au.
How to make a request
Email hello@getgoodgrove.com with the request in the subject line — "Privacy Request — Access", "— Correct", "— Delete", or "Opt Out of Sale and Sharing" — and tell us which state, province, or country you live in, with the email address and order number you used. The Your Privacy Choices page at getgoodgrove.com/pages/your-privacy-choices is the second route and needs no email for the advertising opt-out.
We confirm receipt within 10 business days and answer within 45 days, with one 45-day extension for a complex request we flag first. Opt-outs go through within 15 business days. Outside the US your own deadline governs: one month in the UK, 30 days in Canada, Quebec, and Australia. Requests are free unless manifestly excessive. If we deny you and your state gives an appeal, reply within 30 days with "Appeal" in the subject; someone uninvolved in the first decision answers within 45 days.
We verify you by matching the email on file plus one detail only the buyer would know, and a second for deletions. An opt-out needs none. Someone else may act for you with a signed power of attorney or your written permission.
You can complain to your state attorney general, or in California to the California Privacy Protection Agency. California users are also entitled to this notice: Complaint Assistance Unit, California Department of Consumer Affairs, 1625 North Market Blvd., Suite N-112, Sacramento, CA 95834, (800) 952-5210.
Disputes, and changes to this policy
Disputes about this policy run under the dispute provisions of our Terms of Service — individual arbitration under Wyoming law, with a free 30-day opt-out — except that consumers in the UK, Canada, and Australia keep the mandatory rights and the courts of their own country.
When this policy changes, the date at the top moves. A change that narrows your rights, widens what we collect, or adds a new kind of recipient gets 30 days' notice by banner and email; typo fixes and vendor swaps go live on the page.
Contact us
Veylor Commerce LLC, operator of Get Good Grove. Email hello@getgoodgrove.com, seven days a week, usually within a few hours and always within one day. No phone line for privacy matters, nothing to post.
These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease. Not for use by anyone under 18, pregnant, nursing, or with a known medical condition; talk to your healthcare provider before starting any supplement, especially if you take medication including blood thinners.