Privacy Policy

1. Introduction

At GGG NATURAL (“we,” “us,” or “our”), we respect your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at gggnatural.com (the “Site”) or purchase our products.

By using the Site, you consent to the data practices described in this policy. If you do not agree with any part of this Privacy Policy, please do not use the Site or provide us with your personal information.

We may update this policy from time to time. Changes will be posted on this page with an updated “Last updated” date. We encourage you to review this page periodically.

2. Information We Collect

We collect information you voluntarily provide to us when you use the Site, place an order, subscribe to our newsletter, use The Herbalist, or contact us. The types of information we collect include:

Personal Information You Provide

• Contact Information: Your full name, email address, shipping address, and phone number.
• Order Information: Details about the products you purchase, your billing name and address, and the last four digits of your card. If you order a custom formula, this includes the answers you gave to build it (see “The Herbalist” below).
• Newsletter: If you subscribe, we store your email address and, where you give them, your name and phone number, along with the form you used to sign up.
• Communications: Information you provide when you contact us through email or other channels.

Payment Information

When you make a purchase, your payment information (including credit card numbers, billing address, and related transaction data) is collected and processed by Authorize.Net, our PCI-compliant payment gateway. GGG NATURAL does not store, retain, or have direct access to your full credit card number or security code; we keep only the last four digits and the transaction record. If you buy a subscription, Authorize.Net also runs the recurring billing. Authorize.Net handles all payment data in accordance with their own privacy and security policies.

Information Collected Automatically

When you visit the Site, we may automatically collect certain information about your device and browsing activity, including:

• Your IP address and approximate geographic location
• Browser type and version
• Operating system
• Server logs kept by our hosting provider

Pages viewed, time spent, and referring website are collected by Google Analytics only if you accept analytics cookies (see Section 4).

3. How We Use Your Information

We use the information we collect for the following purposes:

• Order Fulfillment: To process and ship your orders, including communicating with you about order status, delivery updates, and returns.
• Customer Support: To respond to your inquiries, questions, and requests.
• Site Improvement: To analyze usage patterns and improve the functionality, content, and user experience of the Site.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Fraud Prevention: To detect and prevent fraudulent transactions, unauthorized access, and other harmful activity.

We will not use your personal information for purposes other than those described in this policy without obtaining your consent.

4. Cookies & Tracking

The Site uses cookies and similar tracking technologies to enhance your browsing experience. Cookies are small text files stored on your device by your web browser.

Types of Cookies We Use

• Essential Cookies: Required for the Site to function properly. These enable shopping cart functionality, session management, and secure checkout. Without these cookies, certain features of the Site may not work.
• Analytics Cookies: We use Google Analytics 4 to understand how visitors use the Site. It is switched off until you choose “Accept” on the cookie banner; if you choose “Essential only,” no analytics cookies are set and analytics storage stays denied. We do not use advertising cookies, and advertising storage is denied.

Your Cookie Choices

Most web browsers allow you to control cookies through your browser settings. You can change your choice by clearing this site’s stored data in your browser, which shows the banner again. You can also block or delete cookies, but doing so may affect the functionality and usability of the Site.

5. Third-Party Services

We use third-party services to operate the Site and process transactions. These service providers have their own privacy policies governing the use of your information.

Authorize.Net

Authorize.Net is our payment processing partner. When you make a purchase, your payment information is transmitted directly to Authorize.Net over a secure, encrypted connection. GGG NATURAL does not store your full credit card numbers. Authorize.Net’s privacy policy is available at: Authorize.Net Privacy Policy.

Google Analytics

Google LLC provides Google Analytics 4. It loads and sets cookies only after you accept analytics on the cookie banner. Google’s privacy policy is available at: Google Privacy Policy.

Amazon SES

Order confirmations, shipping updates, and newsletter emails are sent through Amazon Simple Email Service (Amazon Web Services), which receives your email address and the message content.

Upstash

We keep a backup copy of order records and of the newsletter list with Upstash, a hosted data-storage provider. Our main order and customer records are kept in a hosted Postgres database.

Vercel

The Site is hosted by Vercel Inc. Vercel may collect standard server logs, including IP addresses and request metadata, as part of hosting and delivering the Site. Vercel’s privacy policy is available at: Vercel Privacy Policy.

hCaptcha

We use hCaptcha on our checkout page to protect against automated spam and abuse. The hCaptcha service collects hardware and software information, such as device and application data, and sends this data to hCaptcha for analysis. This data is collected and processed in accordance with hCaptcha’s privacy policy, available at: hCaptcha Privacy Policy.

The Herbalist — Automated (AI) Service

“The Herbalist” is an automated, AI-powered assistant, not a human and not a licensed professional. It provides general education about the botanicals we carry; it does not diagnose, treat, prescribe, or provide medical or veterinary advice. When you send a message, that message text is sent through our relay (relay.gagegreengroup.com) to an AI provider to generate a response. Depending on availability, that provider is DeepSeek, NVIDIA, OpenRouter, Groq, or Cerebras, each under its own privacy terms. We do not save your Herbalist conversation on our servers, and we do not use it to build a health profile about you. While you browse, the conversation is held only in your own browser’s session storage and is cleared when you close the tab. For abuse prevention we keep an in-memory request count by IP address and write only a shortened address (the first two parts) to logs; the relay receives a keyed hash of your address that lets it count requests but does not reveal the address.

One exception: custom formulas. When you order a custom formula, the answers you gave to build it (your goal, how long, what you have tried, what to avoid, preferences, notes, any pet or plant details, and the Herbalist conversation you brought with you, if any) are kept with your order so we can make and support your formula. They are stored with your order record and its backup, and are handled under the retention terms below.

Please do not enter sensitive personal or health information. If you choose to describe a health concern, you are voluntarily sharing that information, and it is processed solely to return general botanical education in that moment. Do not rely on the Herbalist for any medical, mental-health, or veterinary decision — consult a qualified professional.

Data Sharing

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We only share information with the service providers named above, as necessary to fulfill orders, process payments, send email, host the Site, run the Herbalist assistant, measure usage (with your consent), and protect against fraud.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Order Data: Information related to purchases is retained for accounting, tax, and business record-keeping purposes as required by applicable law (typically 3–7 years).
• Newsletter: We keep your subscription until you unsubscribe or ask us to delete it.
• Communications: Records of customer support communications may be retained for reference and quality improvement purposes.

When data is no longer needed, it is securely deleted or anonymized.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct any inaccurate or incomplete personal information.
• Deletion: Request that we delete your personal information, subject to legal retention requirements.
• Opt-Out: Opt out of any non-essential communications, such as marketing emails.

To exercise any of these rights, please contact us at info@gggnatural.com. You can ask for a copy of your information or ask us to delete it, and we will act on your request within 30 days. We may need to verify your identity before processing your request.

European Economic Area, UK & Switzerland (GDPR / UK GDPR)

If you are located in the EEA, the UK, or Switzerland, you have additional rights, including the rights of access, rectification, erasure (“right to be forgotten”), restriction and objection to processing, and data portability. Our lawful bases for processing are: performance of a contract (to fulfil your orders), your consent (for marketing and any optional features), and our legitimate interests (to operate, secure, and improve the Site). Where we process any health-adjacent information you voluntarily provide, we do so only with your consent and only to respond to you in that session. You may withdraw consent at any time, and you have the right to lodge a complaint with your local supervisory authority.

California (CCPA / CPRA)

California residents have the right to know what personal information we collect, to request deletion or correction, and to opt out of any “sale” or “sharing” of personal information — we do not sell or share your personal information. To the extent any information you provide is treated as “sensitive personal information,” we use it only for the purposes permitted by law and to provide the services you request. We do not discriminate against you for exercising your privacy rights.

8. Security

We take the security of your personal information seriously and implement reasonable administrative, technical, and physical safeguards to protect it.

• SSL Encryption: The Site uses SSL/TLS encryption to protect data transmitted between your browser and our servers.
• PCI Compliance: All payment transactions are processed through Authorize.Net, a PCI DSS Level 1 compliant payment gateway, ensuring that your payment information is handled according to the highest security standards.
• Access Controls: Access to personal information is restricted to authorized personnel who need it to perform their duties.

While we strive to protect your personal information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but will promptly notify you in the event of a data breach affecting your information, as required by applicable law.

9. Children’s Privacy

The Site and our products are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we discover that we have inadvertently collected personal information from a child under 18, we will promptly delete that information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make changes, we will revise the “Last updated” date at the top of this page.

Material changes will be communicated by posting a notice on the Site. We encourage you to review this page periodically to stay informed about how we protect your information.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: