Privacy policy

Last updated: May 21, 2026

This Privacy Policy describes how Hazel's Apothecary ("we," "us," "our"), operated by META STORES LLC, collects, uses, and shares personal information when you visit, use, or make a purchase from hazelsapothecary.com (the "Site"). For the purpose of applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the UK GDPR, META STORES LLC is the data controller of your personal information.

Information we collect

When you use the Site, we collect:

Information you provide directly:

  • Name, email address, billing address (collected at checkout)
  • Payment information (processed by Shopify Payments, Stripe, or PayPal — we do not store full card details on our servers)
  • Account information, if you create a Member Area account — username, password (stored in encrypted form), preferences, and settings
  • Any messages you send through our contact form or via email

Information collected automatically:

  • Device information (browser type, operating system, IP address, and other unique identifiers)
  • Usage information (pages visited, time spent, referring website, and how you interact with the Site)
  • Transaction and browsing activity (items you view, add to your cart, or purchase, and your past orders)
  • Cookies and similar tracking technologies (see Cookies and tracking below)

Information from third parties:

  • Shopify, our hosting and e-commerce platform
  • Payment processors, for transaction confirmation and fraud signals
  • Marketing platforms (e.g. Meta Ads, Google Analytics), if you arrived from one of our ads

How we use your information

We use the information collected to:

  • Process and deliver your orders (send you the ebook files by email)
  • Provide customer support and respond to your inquiries
  • Send transactional emails (order confirmation, password reset, refund updates)
  • Send marketing emails — only if you have opted in. You can unsubscribe at any time using the link in any email.
  • Detect, investigate, and prevent fraud or other malicious activity
  • Comply with our legal, tax, and accounting obligations
  • Improve our Site, products, and services

Cookies and tracking

We use cookies and similar technologies to:

  • Keep your cart and session state (essential cookies — these cannot be disabled)
  • Measure how visitors use our Site (analytics)
  • Show you relevant advertising on Meta, Google, and other platforms (marketing pixels)

You can manage your cookie preferences through your browser settings. EU and UK visitors will see a cookie banner on first visit allowing them to accept or reject non-essential cookies.

Sharing your information

We share your personal information only with:

  • Shopify, our e-commerce platform — for Site operation and order processing
  • Payment processors (Shopify Payments, Stripe, PayPal) — to process your payment
  • Email service providers (Shopify Email, Klaviyo, or similar) — to send order confirmations and marketing emails (if opted in)
  • Analytics and advertising partners (Google Analytics, Meta Ads, TikTok Ads) — to measure Site performance and show you relevant ads
  • Authorities or legal counsel — when required by law or to protect our rights

We do not sell your personal information for monetary consideration. Some sharing for targeted advertising may qualify as "sharing" or a "sale" under certain U.S. state laws — see Your rights below to opt out.

Third-party links

Our Site and our products may contain links to websites operated by third parties — for example, references, sources, or partners. We are not responsible for the privacy practices, security, or content of those sites. We encourage you to review the privacy policy of any third-party site before sharing your personal information with them.

Data retention

We retain your personal information for as long as needed to:

  • Provide our services to you
  • Comply with our legal, tax, and accounting obligations
  • Resolve disputes and enforce our agreements

Typical retention is 5 years from the date of your last order, after which we anonymize or delete your personal data.

Your rights

Depending on your country or state of residence, you may have the right to:

  • Access — request a copy of the personal information we hold about you
  • Correction — ask us to correct inaccurate or incomplete information
  • Deletion — ask us to delete your personal information ("right to be forgotten")
  • Portability — receive your information in a machine-readable format
  • Opt-out — opt out of marketing communications and the "sale" or "sharing" of personal information for targeted advertising
  • Withdrawal of consent — withdraw any consent you previously gave

To exercise any of these rights, email us at contact@metastoresllc.com. We will respond within 30 days.

Identity verification. Before responding to a rights request, we may need to verify that the request is genuinely coming from you. We will ask you to confirm certain details about your account or recent orders. This step protects your information from being disclosed to someone impersonating you.

Authorized agents. You may designate an authorized agent to submit rights requests on your behalf. We will ask the agent to provide written proof that you have authorized them to act for you, and we may also contact you directly to verify the request before acting on it.

Non-discrimination. We will not discriminate against you for exercising any of the rights described in this policy. Doing so will not affect the price, quality, or availability of our products or services.

Global Privacy Control (GPC). If you visit our Site with the Global Privacy Control browser signal enabled, we will treat it as a valid opt-out request from the "sale" or "sharing" of your personal information for targeted advertising, for the browser and device sending the signal, where applicable law requires us to do so (including California, Colorado, and Connecticut). You can learn more at globalprivacycontrol.org. We do not currently respond to other "Do Not Track" signals from browsers.

EU and UK residents (GDPR): In addition to the rights above, you have the right to:

  • Object to our processing of your personal information for specific purposes, including direct marketing
  • Restrict our processing of your personal information in certain circumstances (for example, while we verify a correction request)
  • Lodge a complaint with your local data protection authority. For the EEA, a list of supervisory authorities is available here.

California residents (CCPA/CPRA): You have the right to know, delete, correct, and opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights.

Other U.S. state residents (Virginia, Colorado, Connecticut, Utah, and others with similar privacy laws): You have similar rights — please contact us to exercise them.

Children

Our Site is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will delete it.

International data transfers

We are based in New Mexico, United States. If you are visiting from outside the United States, your information may be transferred to, stored, and processed in the United States, which may have different data protection rules than your country.

For transfers from the European Economic Area or the United Kingdom to countries that have not been recognized as providing an adequate level of data protection, we rely on the European Commission's Standard Contractual Clauses (and the equivalent UK transfer mechanism) as the legal basis for the transfer.

Security

We take reasonable technical and organizational measures to protect your personal information. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. We recommend that you do not use unsecured channels to send us sensitive or confidential information.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the policy will reflect the latest version. We encourage you to review this policy periodically.

Contact us

If you have questions about this Privacy Policy or how we handle your information, or if you would like to exercise any of the rights described above, please email contact@metastoresllc.com.

META STORES LLC is the data controller responsible for your personal information.

Hazel's Apothecary is operated by META STORES LLC, 8206 Louisiana Blvd NE, Ste A 3254, Albuquerque, NM 87113, United States.