VivaLeaf Privacy Policy
Effective Date: June 1, 2026

Personal Data Sold? No— VivaLeaf does not sell personal information

Data Shared With? Shopify, Wise/PayPal, shipping carriers, Herbalife (fulfillment only), Google Analytics

Cookie Consent. Required for non-essential/advertising cookies — opt-out available

Do Not Sell Link. Available at vivaleaf.us/do-not-sell

CCPA/CPRA Rights: Know, Delete, Correct, Opt-Out, Limit Sensitive Data

Data Retention: Active accounts + 3 years post-purchase; legal obligations vary

Contact: info@vivaleaf.us | +1 (650) 870-2068

This Privacy Policy describes how VivaLeaf (vivaleaf.us, "we," "us," or "our") collects, uses, shares, and protects your personal information when you visit, shop, or otherwise interact with our website and services (the "Services"). This policy applies to all visitors and customers located in the United States.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with these practices, please do not use our website or services.

1. Personal Information We Collect

We collect the following categories of personal information, consistent with California Civil Code § 1798.140 and applicable state privacy laws:

A. Information You Provide Directly

• Identifiers: Full name, email address, shipping address, billing address, phone
  number, and account credentials.
  
• Financial Information:
  Billing details provided at checkout. Note: raw payment card numbers are never stored by VivaLeaf — all payments are processed via PCI-DSS compliant third-party gateways (Stripe, PayPal).
  
• Commercial Information:
  Order history, product views, cart activity, and customer service
  communications.
  
  B. Information Collected Automatically
• Internet / Network Activity:
  IP address, browser type and version, device type, operating system, referring URLs, pages viewed, time spent on pages, and clickstream data.
  
• Cookie & Tracking Data:
  First-party and third-party cookies, web beacons, and similar technologies. See Section 5 (Cookies) for full details.
  
• Geolocation (general):
  Approximate location derived from IP address. We do not collect precise GPS data.
  

C. Sensitive Personal Information

We do not intentionally collect sensitive personal information such as Social Security numbers, biometric data, health data, or racial or ethnic origin data. If you voluntarily share such information in a customer service interaction, it will be used solely to resolve your inquiry.

2. How We Use Your Personal Information

We use your personal information only for the following legitimate business purposes:

• Order Fulfillment:
  Processing payments, coordinating shipment through Herbalife’s distribution network, providing tracking information, and handling returns and customer service inquiries.
  
• Account Management:
  Creating and maintaining your secure customer account on vivaleaf.us.
  
• Transactional Communications:
  Sending order confirmations, shipping updates, and return status notifications.
  
• Marketing Communications:
  Sending promotional content, product updates, and offers only with your explicit consent. You may opt out at any time by clicking “Unsubscribe” in any marketing email or emailing us at info@vivaleaf.us.
  
• Security & Fraud Prevention:
  Detecting, investigating, and preventing fraudulent transactions, unauthorized account access, and other unlawful activities.
  
• Legal Compliance:

Meeting obligations under applicable federal and state laws, including tax reporting, record-keeping, and responding to lawful government requests.

• Site Improvement:
  Analyzing aggregated, de-identified usage data to improve website performance, product offerings, and user experience.
  

We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects on you without
providing notice and an opt-out right.

3. Sharing Your Personal Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share data only in the following circumstances:

Service Providers (Data Processors)

We share necessary data with trusted service providers who process it
solely on our behalf:

• E-commerce Platform:
  Shopify, Inc. — hosts our storefront and associated customer data infrastructure.
  
• Payment Processors:
  Wise, Inc. and PayPal Holdings, Inc. — process payments securely under PCI-DSS standards.
  
• Fulfillment Partner:
  Herbalife Nutrition Ltd. receives your name, shipping address, and order details strictly to fulfill and ship your order. Herbalife does not use this data for independent marketing without your consent.
  
• Shipping Carriers:
  USPS, FedEx, and UPS — receive your name and delivery address to execute shipments.
  
• Analytics:
  Google Analytics (Google LLC) — receives anonymized/pseudonymous
  browsing activity data to help us understand site usage. You may opt out via Google’s opt-out tool at tools.google.com/dlpage/gaoptout.
  
  Legal Disclosures

We may disclose your information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect the rights, property, or safety of VivaLeaf, our customers, or the public.

Business Transfers

If VivaLeaf is involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

All third-party service providers are contractually required to process your data only for the purposes described and in compliance with applicable U.S. privacy laws.

4. Your U.S. Privacy Rights

Depending on your state of residence, you have the following rights under applicable state privacy laws (including California CCPA/CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and other
state frameworks):

• Right to Know / Access:
  Request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the third parties with whom it is shared.
  
• Right to Delete:
  Request deletion of your personal information, subject to exceptions
  required by law (e.g., completing a transaction, complying with a legal obligation).
  
• Right to Correct:
  Request correction of inaccurate personal information we hold about you.
  
• Right to Opt-Out of Sale or Sharing:
  Although we do not sell personal information, you have the right to direct us not to share your data for cross-context behavioral advertising. Use our “Do Not Sell or Share” link at vivaleaf.us/do-not-sell or email info@vivaleaf.us.
  
• Right to Limit Use of Sensitive Personal Information:

(California CPRA) You may request that we limit the use of sensitive personal information to what is necessary to perform our services.

• Right to Non-Discrimination:
  We will not discriminate against you for exercising any of your privacy rights. Exercising these rights will not affect the price or quality of products and services we offer.
  
  How to Submit a Request
  To exercise any of the above rights, contact us at:
• Email: info@vivaleaf.us (subject line: “Privacy Rights Request”)
  
• Phone: +1 (650) 870-2068
  
  We will verify your identity before processing your request and respond
  within 45 days as required by law (extendable by an additional 45 days with notice). Requests are free of charge, subject to applicable limitations.
  

5. Cookies & Tracking Technologies

We use cookies and similar tracking technologies on vivaleaf.us. Here is what we use and your choices:

Types of Cookies We Use

• Strictly Necessary Cookies:
  Required for the website to function (shopping cart, account login, checkout). These cannot be disabled.
  
• Performance / Analytics Cookies:
  Help us understand how visitors use our site (e.g., Google Analytics). These are enabled by default but can be opted out.
  
• Functional Cookies:
  Remember your preferences (language, currency). Optional.
  
• Advertising / Targeting Cookies:
  Used to serve relevant ads on third-party platforms. These require your consent and can be disabled at any time.
  
  
  Your Cookie Choices

You may manage cookie preferences at any time through:

• Cookie Consent Banner:
  Displayed on your first visit to vivaleaf.us.
  
• Browser Settings:
  Most browsers allow you to refuse or delete cookies. Refer to your browser’s help documentation.
  
• Opt-Out Tools:
  Google Analytics opt-out: tools.google.com/dlpage/gaoptout. For
  advertising cookies, visit optout.aboutads.info.
  
• Do Not Sell / Share Link:
  vivaleaf.us/do-not-sell disables sharing of your data for behavioral advertising.
  

Disabling certain cookies may affect website functionality. Strictly necessary cookies cannot be disabled as they are essential for providing the service.

6. Data Security & Retention

Security Measures

We implement industry-standard administrative, technical, and physical
safeguards to protect your personal information, including:

• SSL/TLS encryption for all data transmitted between your browser and our website
  
• PCI-DSS compliant payment processing — raw card data is never stored on our servers
  
• Access controls limiting data access to authorized personnel only
  
• Regular security assessments of our systems and third-party providers
  
  No method of internet transmission or electronic storage is 100% secure.
  While we take reasonable measures, we cannot guarantee absolute
  security.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy:

• Active account data:
  Retained while your account is active.
  
• Purchase & transaction records:
  Retained for 3 years following the date of purchase to support returns, warranty claims, and legal compliance.
  
• Tax and accounting records:
  Retained for 7 years as required by U.S. federal and state tax laws.
  
• Marketing data:
  Retained until you withdraw consent or request deletion.
  
• Legal holds:
  If data is subject to a legal proceeding, it will be retained until the matter is resolved.
  

Upon expiration of the applicable retention period, data is securely
deleted or anonymized.

7. Children’s Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at info@vivaleaf.us, and we
will delete it promptly, in compliance with the Children’s Online Privacy Protection Act (COPPA).

8. California-Specific Disclosures (CCPA / CPRA)

In the preceding 12 months, VivaLeaf has:

• Collected the following categories of personal information:
  Identifiers, commercial information, internet/network activity, and financial information (see Section 1).
  
• Disclosed for business purposes:
  Identifiers and commercial information with Shopify, Herbalife, payment processors, and shipping carriers.
  
• NOT sold personal information:
  VivaLeaf has not sold any personal information to third parties.
  
• NOT shared for cross-context behavioral advertising without consent:
  Users can opt out via vivaleaf.us/do-not-sell.
  
  California residents may submit a verifiable consumer request by contacting us at info@vivaleaf.us
  or calling +1 (650) 870-2068. We will not discriminate against you for exercising your CCPA/CPRA rights.

9. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our
business practices, technology, legal requirements, or regulatory guidance. When we make material changes, we will:

• Post the updated policy on this page with a revised “Effective Date”
  
• Notify registered customers via email for significant changes
  

We encourage you to review this policy regularly. Your continued use of our Services after the effective date of any update constitutes acceptance of the revised policy.