Privacy Policy

What we collect

We collect the information you give us when you submit a consultation request, place a reservation, or take our recovery quiz: name, email, phone number, delivery address, and the systems you're interested in. We also collect basic browsing analytics so we can improve the site.

How we use it

• Reach out to confirm your reservation or consultation.
• Coordinate white-glove delivery and installation.
• Send you the recovery protocol you requested.
• Improve our recommendations and product selection.

Cookies & tracking

We use a small number of cookies and similar technologies:

• Strictly necessary — authentication session, cart contents, and CSRF protection. These are first-party and cannot be turned off without breaking the site.
• Analytics — aggregated, IP-truncated usage data that helps us improve the catalog and checkout. No cross-site advertising profiles are built.
• Preferences — the consult region, viewed-products list, and saved configurations stored in your browser's local storage.

We do not use third-party advertising cookies or data brokers. You can clear all site data from your browser at any time.

Third parties who process data for us

• Hosting & database: Supabase (PostgreSQL, auth, edge functions).
• Payment processing: card details submitted at checkout are transmitted over a 256-bit SSL/TLS connection to our payment processor for authorization, and Affirm / Klarna / Bread Pay handle financing applications. We retain only the card brand, last four digits, and billing address with your order — never the full card number or CVV.
• Logistics partners: the LTL or white-glove freight carrier assigned to your order, and the system manufacturer fulfilling your shipment. The specific carrier is shared during scheduling.
• Email delivery: our transactional email provider (used only for order, warranty, and consultation messages you've requested).
• AI assistants: the on-site consultation chat is powered by a third-party LLM gateway. Chat transcripts are stored to improve responses and are not sold.

Each processor is bound by contract to use your information only to deliver the service we requested.

Who we share it with

We share order details with the manufacturer of the system you reserve and with the freight carrier handling delivery. We may disclose information in response to a valid legal request, to enforce our Terms, or to prevent fraud. We do not sell personal information as defined by the CCPA, and we do not share it for cross-context behavioral advertising.

Data retention

• Order and tax records: 7 years (federal and state retention requirements).
• Warranty registrations: term of the warranty plus 1 year.
• Marketing contacts: 24 months from last engagement, then deleted.
• Support tickets and chat transcripts: 3 years.
• Anonymous analytics: 24 months.

Your rights

Residents of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, and the EU/UK (GDPR) have the right to:

• Know what personal information we have collected about you
• Receive a portable copy of that information
• Correct inaccurate information
• Request deletion (subject to legal retention requirements)
• Opt out of any "sale" or "sharing" — we do neither, but the opt-out is honored as a no-op
• Not face discrimination for exercising these rights

To exercise any of these rights, email privacy@aurawellnesshq.com from the email address associated with your account. We respond within 30 days (CCPA: 45 days, extendable once).

Children's privacy

Aura Wellness HQ is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us information, email privacy@aurawellnesshq.com and we will delete it.

Security

All traffic is encrypted in transit via TLS 1.2+. Data at rest is encrypted by our hosting provider. Payment card numbers never touch our servers — they are tokenized at the payment processor (PCI-DSS Level 1). Access to production data is limited to authorized staff and audited.

International transfers

Our infrastructure is hosted in the United States. If you access the site from outside the US, your information will be transferred to, stored, and processed here under US law.

Your choices

You can unsubscribe from marketing emails at any time using the link in any email footer. Transactional messages (order confirmations, shipping notices, warranty correspondence) are sent for as long as your relationship with us is active.

Changes to this policy

We may update this policy as our practices evolve. Material changes will be announced with at least 30 days' notice via email (if we have your address) and a banner on the site. The "Last updated" date at the top reflects the current version.

Contact

Privacy questions and rights requests: privacy@aurawellnesshq.com.
Postal mail:
Aura Wellness HQ LLC — Attn: Privacy Officer
159 N Wolcott St 415, Casper, WY 82001, US