Privacy Policy

Last updated: July 16, 2026
Effective: July 16, 2026

This Privacy Policy explains how Mellifera LLC (“Mellifera,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you visit mellifera.com, shop with us, create or use an account, join Mellifera VIP, subscribe to communications, contact us, submit a review, or otherwise interact with our services (collectively, the “services”).

1. Who Is Responsible for Your Information

Mellifera LLC is the business or controller responsible for the personal information described in this Policy, except where a third party is noted to act independently.

Mellifera LLC
805 West Shore Rd, #9239
Warwick, RI 02889, United States

Privacy email: privacy@mellifera.com

Customer support: support@mellifera.com

Contact form: https://www.mellifera.com/contact

2. Scope

This Policy applies to our services. It does not govern a third party’s independent website, service, or processing. For example, Stripe may act independently for fraud prevention, legal compliance, and payment-network obligations. This policy identify important third parties below.

Third-party sites and services. Our services may contain links to, or tools provided by, third parties such as payment processors, shipping carriers, and social-media platforms. These third parties operate under their own privacy policies and terms. We do not control, and are not responsible for, the privacy practices or content of any third-party site or service, including information you choose to provide directly to them. We encourage you to review the privacy policy of any third party before using its site or service or providing it with your information.

We are based in the United States. Our checkout and fulfillment services are only for United States shipping at this time. We do not currently offer any services outside the United States. We will update this Policy before offering any services in additional countries.

3. Personal Information We Collect

The information we collect depends on how you interact with us.

A. Identifiers and contact information

Name, email address, telephone number, billing and shipping address, account and customer IDs, online identifiers, cookie IDs, IP address, and similar identifiers.

B. Account and authentication information

Account login information, encrypted or hashed authentication credentials and session tokens, account preferences, address book, wishlists, saved kits, customer group, login and security events, and communications preferences. We do not receive your plaintext password from BigCommerce after authentication.

C. Order, transaction, and fulfillment information

Products viewed, saved, placed in a cart, purchased, returned, or reviewed; order number; price, discounts, tax, shipping method, delivery and tracking status; gift and promotion activity; customer-service history; consent or acknowledgement records; and fraud or risk signals.

D. Payment and VIP Membership information

Selected plan, price and cadence, start and renewal dates, status, pause and cancellation history, payment success or failure, grace period, gift eligibility and claims, Stripe customer, subscription, checkout, invoice, charge, refund, and portal identifiers, and limited payment-method details such as brand and last four digits where provided by Stripe.

Stripe collects payment-card, bank, billing, device, and fraud-prevention information directly. We do not store full card numbers or card security codes in its own databases.

E. Communications and support information

The content of messages you send, topic, order number, attachments, contact-form fields, email delivery and response data, and records of our response. If you use the contact form, we currently send the message to our email provider and, for some topics, Slack; we also create or update a Klaviyo CRM profile and a “Contacted Support” event even if you did not subscribe to marketing. A marketing subscription is recorded only when you separately opt in.

F. Reviews and user content

Rating, review title and text, name or display name, email, order and product identifiers used to verify a purchase, review status, photographs you upload, moderation records, store replies, and any permissions or disclosures associated with the content. Approved content and a privacy-reduced display name may be public.

Email address, name where provided, subscription and suppression status, signup source, consent record, campaign delivery, bounce and complaint information, and, where permitted, opens, clicks, product views, cart events, purchase history, profile attributes, segments, and inferred interests.

H. Device, browsing, and usage information

Device and browser type, operating system, language, approximate location derived from IP, pages and products viewed, links and buttons used, referring URL, timestamps, session and visitor IDs, cart activity, and performance and diagnostic information. Optional analytics and marketing technologies are subject to the choices described in our Cookie Policy.

I. Security and anti-abuse information

IP address, user agent, session/request identifiers, CAPTCHA token and score, rate-limit records, authentication and access logs, suspected fraud or misuse indicators, and webhook or system-event records. Google reCAPTCHA may collect device, browser, interaction, cookie, and network information on protected forms.

J. Inferences and profiles

We or our providers may derive customer status, likely interests, product affinities, campaign segments, browse or cart abandonment, and similar inferences from account, shopping, and browsing activity. We do not use these profiles to make solely automated decisions that produce legal or similarly significant effects.

4. How We Collect Information

Information is collected by us through the following methods:

directly from you, including at checkout, account registration, VIP enrollment, newsletter signup, contact, and review submission;
automatically from your browser or device, subject to applicable consent and opt-out choices;
from our service providers and platforms, including BigCommerce, Stripe, Klaviyo, Fera, Vercel, shipping and fulfillment providers, and fraud and security services;
from carriers, payment networks, banks, customs authorities, and similar transaction participants;
from integrations you authorize or that operate for us, including connected ecommerce and automation services; and
from public sources and professional advisers where lawful and applicable.

5. Why We Use Information

We use personal information for the purposes below. Where EU or UK data-protection law applies, the table also identifies the legal basis we ordinarily rely on. The proper basis depends on context; we do not treat a use as contractually necessary merely because it appears in our Terms.

Purpose	Examples	EU/UK legal basis, where applicable
Provide the Services	Create and authenticate accounts; maintain carts, wishlists, saved kits, and addresses; process orders; provide requested account features	Performance of a contract or steps requested before a contract
Administer VIP	Enroll and bill members; activate benefits; manage renewals, pauses, cancellations, payment failures, notices, gifts, and support	Contract; legal obligation for required notices and records
Process payment	Route payment to Stripe; prevent duplicate billing; handle refunds, disputes, and accounting	Contract; legal obligation; legitimate interests in fraud prevention and financial administration
Fulfill and support orders	Pick, pack, ship, track, communicate about delivery, process returns, and answer questions	Contract; legal obligation; legitimate interests for service improvement and dispute handling
Send service messages	Account, order, security, payment, renewal, pause, cancellation, review, and support messages	Contract; legal obligation; legitimate interests depending on the message
Send marketing	Newsletters, offers, product announcements, campaigns, and promotional review invitations	Consent as our conservative default; a documented statutory exception only where it clearly applies
Personalize and measure marketing	Link browsing and purchase history to a profile; product-view and cart events; segments; browse/cart-abandonment campaigns	Consent as our conservative default
Analytics and site improvement	Understand use, diagnose performance, measure features, and improve navigation and products	Consent for nonessential analytics; narrowly scoped legitimate interests only where law permits without consent
Reviews and user content	Verify purchases, accept and moderate submissions, publish approved reviews and photos, prevent duplicates, and respond	Contract or legitimate interests; consent or separate permission for materially different promotional reuse
Support and CRM	Route a contact request, reply, maintain service history, and understand recurring support issues	Contract or steps requested by you; legitimate interests in customer service and quality
Security and legal compliance	Authentication, CAPTCHA, rate limiting, fraud detection, audits, incident response, tax/accounting, legal claims, and regulatory response	Legal obligation; legitimate interests in security, fraud prevention, and legal protection
Corporate transactions	Due diligence and transfer associated with financing, merger, acquisition, reorganization, or sale	Legitimate interests; legal obligation; consent where required

We keep marketing consent separate from account creation, checkout, support, and VIP. Withdrawing marketing or cookie consent does not affect processing already lawfully completed or processing needed to provide a requested service.

6. When We Disclose Personal Information

We disclose personal information only for legitimate business and legal purposes, including to:

Service providers and processors

BigCommerce for storefront, checkout, customer accounts, orders, carts, wishlists, and newsletter subscriber records;
Stripe for Checkout, Billing, payment processing, fraud prevention, subscriptions, invoices, refunds, and the customer portal;
Klaviyo for customer relationship management, newsletter and campaign delivery, consent and suppression records, and consented onsite behavior and profiling;
Fera Reviews for verified-purchase review invitations, collection, moderation, display, and hosting of uploaded review photos;
Neon (a Databricks company) for the database holding customer-linked operational records, including VIP, Stripe mapping and event history, saved-kit and cart data, and audit records;
Vercel and Vercel Blob for hosting, serverless processing, content delivery, logs, analytics, performance information, and site assets;
Postmark (an ActiveCampaign company) for transactional and support email, delivery, bounce, and suppression information;
Google Analytics for consented site measurement;
Google reCAPTCHA for abuse and fraud prevention on protected forms;
ShipStation, Intuitive Shipping, shipping carriers, postal operators, customs authorities, and insurers to quote, fulfill, track, clear, and protect shipments;
Slack to route some contact and operational alerts to authorized Mellifera staff;
Plasmic for site and editorial content management;
Zapier or similar automation providers where an active workflow transfers data between approved systems; and
other security, IT, professional, tax, legal, and operational providers we engage to operate, secure, and support the Services.

Independent recipients

We may disclose information to payment networks, issuing and acquiring banks, wallet providers, carriers, postal services, customs and tax authorities, insurers, regulators, courts, law enforcement, advisers, and other parties when needed to complete a transaction, protect rights and safety, comply with law, or establish or defend legal claims.

Corporate transactions

Information may be reviewed or transferred in a merger, acquisition, financing, restructuring, bankruptcy, or sale of all or part of the business, subject to confidentiality and applicable law.

At your direction or with your permission

We also disclose information when you direct us to do so, such as publishing an approved review or sharing a wishlist through a link.

We do not sell personal information for money and do not currently use targeted-advertising, remarketing, Google Signals, or advertising-audience features. We use ordinary site measurement as described in our Cookie Policy.

Mellifera currently does not meet CCPA business thresholds. If our operations, advertising practices, or legal obligations change, we will update this Policy and provide any required sale/sharing opt-out controls, including Global Privacy Control handling where applicable. We do not knowingly sell or share information of minors under 16.

8. Cookies and Similar Technologies

We use cookies, pixels, scripts, local and session storage, and similar technologies. Some are required for security, authentication, cart and checkout operation, preference storage, and consent choices. Others support analytics, functionality, personalization, or marketing.

Where consent is required, we do not activate optional analytics or marketing technologies until you choose the relevant category. You can reject optional technologies as easily as accepting them and later change your choice through the persistent Cookie Preferences link located at the bottom of every webpage.

Our separate Cookie Policy lists known technologies, providers, purposes, categories, and durations. It also explains that Google Analytics, Klaviyo, Stripe, reCAPTCHA, and hosted checkout pages may collect device or network information in different contexts.

Browser “Do Not Track” is not a uniform legal or technical standard, so the site may not respond to legacy DNT signals. If Mellifera becomes subject to a legal obligation to honor Global Privacy Control, we will update these controls and this Policy.

9. Email and Text Communications

Newsletter signup is optional. Each commercial email provides an unsubscribe method. We use a minimal suppression record after an opt-out so the address is not accidentally re-added. An unsubscribe stops marketing; it does not necessarily delete an account, orders, support, or legal records, and it does not stop necessary service messages.

We use email open and click tracking. Where tracking pixels require consent, we will disable or condition it on the required consent in those jurisdictions.

We do not currently offer marketing SMS. Before launching SMS, we will provide a separate text-message disclosure and consent that is not a condition of purchase, support STOP and other reasonable revocation methods, and update this Policy.

10. Reviews and Public Content

When you submit a review, we send the rating, text, name, email, order and product identifiers, and uploaded photographs to Fera. Fera hosts review photographs. Approved reviews may display publicly with a shortened or generated display name and verified-purchase status. We do not publish your email or full order identifier.

The review form will provide a just-in-time notice and a limited content license. Additional affirmative permission is required before using a photograph or review in materially different paid advertising or promotional creative unless the submission notice clearly covered that use. You may request removal, but complete deletion may be limited by legal requirements, archived pages, third-party caches, or backup cycles.

11. Retention

We retain information only for specified operational, legal, security, and accountability needs.

Category	Proposed period or criterion
Active account and profile	While active; delete or de-identify within 30–90 days after a verified closure request, except records listed below
Orders, payments, refunds, tax, and accounting	7 years after the transaction or longer if law or an active dispute requires
VIP assent, billing, notices, and cancellation evidence	Life of Membership plus 6 years, but never less than California’s longer-of-three-years-or-one-year-after-termination minimum for auto-renewal consent evidence
Open Stripe checkout/enrollment attempts	Until completed or expired, then 30–90 days unless needed for duplicate-charge or fraud evidence
Stripe webhook event log and idempotency records	Retained on an ongoing basis as operational and audit records. Store event/object identifiers and processing status only — no card data, raw payloads, PII, or tokens (error details are scrubbed and truncated). Kept as long as needed for idempotency, fraud prevention, reconciliation, and audit.
Saved kits	Until deleted by the customer or account deletion, plus up to 1 day in database backups
Custom kit names/labels and bundle instances	Guest access ends when the 30-day cart session expires; backend rows are removed when the kit or cart is edited and, going forward, by a periodic cleanup sweep
Newsletter consent and suppression	Consent evidence while relied on plus 6 years; minimal suppression record as long as needed to honor opt-out
Klaviyo behavioral events	Retained on the customer's Klaviyo profile while it is active; Klaviyo does not auto-delete events on a fixed timer. Removed when we delete or suppress the profile — including on a valid data-rights request — and deleted by Klaviyo within 90 days if our agreement with Klaviyo ends.
Google Analytics user/event data	2 months unless a documented need approves 14 months; aggregate reports may persist
Support messages	3 years after closure, shorter for sensitive attachments unless needed for a dispute
Reviews and photos	Until removed, account/vendor termination, or no longer needed for publication; subject to complaint, legal, and backup handling
Transactional email content	Retained for 45 days; delivery, bounce, complaint, and suppression metadata may remain longer
Security and rate-limit logs	Rate-limit records (keyed by action + IP) are deleted after 7 days of inactivity by a daily cleanup job; security and application (runtime) logs are retained by our hosting provider (Vercel) for up to 30 days and are minimized to exclude passwords, tokens, full payloads, and unnecessary personal data, unless an incident requires longer
Privacy-rights request log	At least 24 months where California law applies
Cookie-consent evidence	While relied on plus 5–6 years, with periodic reconfirmation and immediate withdrawal records
Backups	Rolling expiry within 1 day (Neon point-in-time history window; no separate snapshot schedule); erased information is not restored to active systems after disaster recovery

Stripe and other independent recipients may retain information longer for tax, anti-money-laundering, fraud, network, and legal obligations. Klaviyo suppression is not deletion. We maintain deletion and suppression workflows rather than assuming that account deletion automatically erases every vendor record.

12. International Data Transfers

Mellifera is based in the United States, and many providers process information in the United States and other countries. Those countries may have different privacy laws.

Where the European Economic Area, United Kingdom, or Swiss transfer rules apply, we use an available lawful mechanism such as an adequacy decision, the EU–U.S. Data Privacy Framework for a currently certified recipient and covered data, the European Commission’s Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, and supplementary safeguards where required. You may request information about applicable safeguards by contacting us at privacy@mellifera.com.

We review onward transfers through provider subprocessors.

13. Security

We use administrative, technical, and physical measures designed to protect personal information, including access controls, encrypted transport, secret management, vendor review, logging, and payment-token separation. No system is perfectly secure. You should use a unique password and tell us promptly about suspected unauthorized access.

We do not store raw payment-card numbers or security codes. We also avoid storing raw passwords, authorization headers, full Stripe payloads, and unnecessary personal information in application logs.

14. Your Privacy Rights

Depending on where you live, you may have the right to:

know whether we process your personal information and obtain access;
receive information about categories, sources, purposes, recipients, and specific pieces of information;
correct inaccurate information;
delete information, subject to exceptions;
receive portable information in an applicable format;
restrict or object to certain processing;
opt out of sale, sharing, targeted advertising, or certain profiling;
limit certain uses of sensitive personal information where applicable;
withdraw consent at any time;
appeal a denied request where state law provides that right;
complain to a data-protection authority; and
receive equal service and pricing without unlawful discrimination for exercising a privacy right.

To exercise a right, use our Contact Form or email us at privacy@mellifera.com. If we later offer sale/sharing or targeted-advertising opt-outs, this Policy will identify the applicable method.

We will verify a request proportionately, using information associated with your account or transaction and avoiding collection of unnecessary identity documents. Authorized agents may submit requests as applicable. We may deny or limit a request where law permits, and we will explain the basis and appeal method.

Where a specific law sets a response period, we will follow it. EU/UK requests are generally handled within one month, subject to a lawful extension.

Complaints

Complaints should be sent to privacy@mellifera.com. We will acknowledge a UK data-protection complaint within 30 days where required, investigate it, keep you appropriately informed, and communicate the outcome. You may also complain to your local supervisory authority or attorney general.

15. Financial Incentives and Loyalty Offers

VIP benefits are provided in exchange for the paid Membership, not for permission to sell personal information. However, a coupon, discount, loyalty benefit, or welcome code conditioned on providing an email address or other personal information may be treated as a financial incentive under California law.

California

We do not provide financial incentives in exchange for the sale of your personal information. If we offer a discount, welcome code, or loyalty benefit in exchange for your email address or other personal information, and California's financial-incentive requirements apply to us, we will link to a Notice of Financial Incentive before you opt in. That notice will describe the material terms of the offer, the categories of personal information involved, how to opt in and how to withdraw, and a good-faith estimate of the value of the information to us and the method used to calculate it. You may withdraw from any financial incentive at any time.

EEA, United Kingdom, and Switzerland

These locations do not use California's specific “financial incentive” notice framework. However, marketing consent must be freely given, specific, informed, affirmative, and easy to withdraw. We will not make a purchase, account, VIP Membership, or core service conditional on agreeing to newsletter marketing. A welcome offer must be modest and genuinely optional, with the marketing choice separate from the Terms, Privacy Policy, and purchase flow.

Where we offer a code, we will clearly say what the person receives, how to unsubscribe, and where to find this Privacy Policy. We will use a separate, affirmative marketing-email choice; delivery of a requested code does not require the person to agree to ongoing marketing. Withdrawal stops future marketing; it does not ordinarily cancel a completed order, account, or VIP Membership. We use opt-in consent as the cross-border default for newsletter marketing rather than assuming a local “soft opt-in” exception applies.

16. Children

The services are intended for adults and are not directed to children under 13. You must be 18 to purchase or join VIP. We do not knowingly collect personal information from a child under 13 or knowingly sell/share information of a minor under 16. If you believe a child provided information, contact us at privacy@mellifera.com. A statement of intent does not replace age-appropriate design or consent if the actual audience changes.

17. Automated Decisions and Profiling

Klaviyo, analytics, fraud tools, and internal systems may create segments or scores. These ordinarily support marketing, security, or operations and do not make solely automated decisions with legal or similarly significant effects.

Before using an automated system to control eligibility, personalized pricing, fraud denial, account access, or another significant outcome, we will assess applicable rights, meaningful human review, explanation requirements, and whether a data-protection impact assessment is required.

18. Changes to This Policy

We maintain immutable versions of this Policy. We will post a revised version with its effective date and provide additional notice for material changes. If a new purpose or expanded use requires consent, continued use of the services is not consent; we will request a new affirmative choice before that processing begins.

19. Contact Us

Questions, requests, or complaints may be sent to: