# Privacy Policy
**Effective date:** June 7, 2026
**Last updated:** June 7, 2026
DRAEN LLC, doing business as Draen ("**Draen**," "**we**," "**us**," "**our**") respects your privacy. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit https://getdraen.com (the "**Site**"), purchase our products, sign up for our email or SMS programs, or otherwise interact with us (collectively, the "**Services**").
This Policy is incorporated into our [Terms of Service](/policies/terms-of-service). By using the Services, you agree to this Policy. If you do not agree, do not use the Services.
If you are a resident of a U.S. state with a comprehensive privacy law (California, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Iowa, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, and others as they take effect), see **Section 9** for your state-specific rights. If you are in the European Economic Area, United Kingdom, or Switzerland, see **Section 10**.
---
## 1. Information we collect
### 1.1 Information you provide directly
- **Identifiers**: name, email, postal address, phone number, account login credentials.
- **Order information**: items purchased, transaction amount, shipping and billing address, payment method (we do not store full card numbers — see Section 1.4).
- **Communications**: emails, SMS, chat messages, customer support inquiries, survey responses, reviews and testimonials, social media interactions with our accounts.
- **Marketing preferences**: subscription status, communication channel consents.
- **Health-adjacent information you choose to share** (for example, in support tickets, product reviews, or quiz responses): goals, lifestyle, age range. **We do not require, and you should not provide, sensitive health diagnoses.**
### 1.2 Information collected automatically
When you visit the Services, we and our service providers automatically collect:
- **Device & technical**: IP address, browser type and version, operating system, device identifiers, screen resolution, time zone, language preference.
- **Usage**: pages viewed, referring URLs, search terms, clicks, time on site, session length, scroll depth, conversion events.
- **Cookies, pixels, SDKs, local storage, and similar technologies** (see our [Cookie Policy](/policies/cookie-policy)).
- **Approximate location** derived from IP address.
We use first-party analytics (Meta Pixel and Shopify analytics, Shopify analytics) and advertising pixels (Meta Pixel, TikTok Pixel, Google Ads, Pinterest) including server-side conversions via the Meta Conversions API and Google Enhanced Conversions.
### 1.3 Information from other sources
- **Marketing partners**: list rentals, influencer referrals, affiliate networks, lookalike modeling vendors.
- **Social media**: when you interact with us on Facebook, Instagram, TikTok, Pinterest, YouTube, or other platforms.
- **Service providers**: Shopify Payments (Stripe), shipping carriers, fraud-prevention vendors, identity-verification vendors.
- **Publicly available sources**.
### 1.4 Sensitive information
We use Shopify Payments (Stripe) to process payments. Your full card number and CVV are submitted directly to the processor; we receive only a token, the last four digits, and the card brand. We do not knowingly collect Social Security numbers, precise geolocation, biometric data, or government ID numbers in the ordinary course of business.
### 1.5 Children
The Services are not directed to children under 18. We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where applicable). If we learn we have collected such information, we will delete it. Contact us at contact@getdraen.com if you believe we have inadvertently collected information from a child.
## 2. How we use your information
We use your information for the following purposes:
- **To provide the Services** — process orders, ship products, fulfill subscriptions, manage accounts, authenticate users, provide customer support, prevent and respond to fraud and abuse.
- **To communicate with you** — order confirmations, shipping updates, service announcements, replies to inquiries, recall notices, important policy updates.
- **For marketing and advertising** (with consent where required) — newsletters, promotions, product launches, abandoned-cart reminders, post-purchase flows, win-back campaigns, lookalike audiences, retargeting, influencer programs, surveys.
- **To personalize the Services** — show relevant products, recommend bundles, remember your preferences and cart, A/B testing.
- **For analytics and measurement** — understand site usage, conversion attribution, content performance, ad performance, cohort analysis, lifetime value modeling.
- **For security and integrity** — detect and prevent fraud, secure accounts, enforce our [Terms](/policies/terms-of-service), defend legal claims.
- **For legal and compliance** — comply with laws and regulations (including FDA adverse event reporting, FTC truth-in-advertising, tax, anti-money-laundering, sanctions screening), respond to lawful requests from authorities, protect rights, property, and safety.
- **For business operations** — accounting, audit, financial reporting, planning, mergers and acquisitions.
We rely on the following legal bases (where required by law): performance of a contract, your consent, our legitimate business interests, and compliance with legal obligations.
## 3. How we share your information
We do not sell personal information for money. We share information as follows:
### 3.1 Service providers
We share information with vendors who perform services on our behalf and are contractually bound to protect it: Shopify (e-commerce platform), Shopify Payments and Stripe (payment processing and fraud prevention), shipping carriers and fulfillment providers, customer support tools, review platforms, Meta Pixel and Shopify analytics (analytics and advertising measurement), Meta (advertising platform), cloud hosting providers, accounting and tax services, and outside legal counsel and auditors. We may add or change vendors over time and will update this section accordingly.
### 3.2 Advertising partners (cross-context behavioral advertising)
We share certain identifiers and event data (page views, add-to-cart, purchases) with advertising platforms to deliver relevant ads, measure ad performance, and build lookalike audiences. **Some of these activities qualify as "selling," "sharing," or "targeted advertising" under U.S. state privacy laws.** You can opt out — see **Section 9** for your state-specific rights and **Section 7** for our universal opt-out methods.
### 3.3 Business transfers
In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred to the acquiring or successor entity. We will notify you of any such transfer and any material changes to this Policy.
### 3.4 Legal and safety
We may disclose information when required by law, subpoena, court order, regulatory request, or to: protect the rights, property, or safety of DRAEN LLC, our customers, or others; enforce our Terms; investigate fraud or security incidents; or report adverse events to the FDA under the Dietary Supplement and Nonprescription Drug Consumer Protection Act.
### 3.5 With your consent
Otherwise, with your direction or consent (for example, when you choose to share a review publicly).
## 4. Cookies, pixels, and tracking
See our [Cookie Policy](/policies/cookie-policy) for a list of cookies and tracking technologies we use, the purposes, and how to manage them. We support the **Global Privacy Control (GPC)** signal as a valid opt-out of "sale" and "sharing" / targeted advertising in jurisdictions that recognize it.
## 5. Data retention
We retain personal information for as long as needed to: (a) provide the Services and fulfill the purposes described in this Policy; (b) comply with legal, tax, accounting, and regulatory obligations (generally 4–7 years for transaction records under tax law and the FDA's adverse event reporting rules); (c) resolve disputes and enforce agreements; (d) protect against fraud and abuse.
When personal information is no longer needed, we will delete, anonymize, or de-identify it.
## 6. Security
We use commercially reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS), encryption of payment data via Shopify Payments (Stripe) (PCI-DSS Level 1), access controls, and vendor due diligence. **No method of transmission or storage is 100% secure**, and we cannot guarantee absolute security. You are responsible for protecting your account credentials.
If we become aware of a security incident affecting your personal information, we will notify you and the appropriate regulators as required by law.
## 7. Your choices
- **Email**: every marketing email contains an unsubscribe link. Transactional emails (order confirmations, shipping, account, recall notices) will continue regardless.
- **SMS**: reply **STOP** to any marketing message to opt out, **HELP** for assistance. See our [SMS Terms](/policies/sms-terms).
- **Cookies and ad tracking**: adjust your browser settings, use the cookie banner on the Site, enable Global Privacy Control (GPC), or opt out through industry tools:
- Digital Advertising Alliance: https://optout.aboutads.info
- Network Advertising Initiative: https://optout.networkadvertising.org
- YourAdChoices: https://youradchoices.com
- Meta: https://www.facebook.com/help/568137493302217
- Google Ads Settings: https://adssettings.google.com
- **Account information**: edit your account dashboard or email contact@getdraen.com.
## 8. International data transfers
We are based in United States. If you access the Services from outside United States, you understand your information will be transferred to, stored, and processed in the United States and other countries where we or our service providers operate, **which may have data-protection laws that differ from those in your country**. Where required by law, we implement appropriate safeguards for international transfers (Standard Contractual Clauses, UK International Data Transfer Addendum, Swiss data-protection requirements, or other approved transfer mechanisms).
## 9. U.S. state privacy rights
If you are a resident of one of the U.S. states listed below, you have the rights described under the applicable law. We do not discriminate against you for exercising these rights. To exercise a right, submit a request through:
- **Email**: contact@getdraen.com
- **Web form** (where available): https://getdraen.com/pages/privacy-request
We will verify your identity (name, email, recent order, or other reasonable verification) before fulfilling a request. You may use an authorized agent; we will verify the agent's authority and may verify your identity directly.
We will respond within the timeframes required by applicable law (generally 45 days, extendable to 90 days when reasonably necessary).
### 9.1 California — CCPA / CPRA
Categories of personal information we have collected, sold, or shared in the past 12 months:
| Category (Cal. Civ. Code § 1798.140) | Collected | Sold | Shared for cross-context behavioral advertising |
|---|---|---|---|
| A. Identifiers (name, email, IP, etc.) | Yes | No | Yes |
| B. Customer records (Cal. Civ. Code § 1798.80(e)) — address, phone, payment info | Yes | No | No |
| C. Protected classifications under California or federal law | No | No | No |
| D. Commercial information (purchases, products considered) | Yes | No | Yes |
| E. Biometric information | No | No | No |
| F. Internet or other electronic network activity | Yes | No | Yes |
| G. Geolocation (approximate, derived from IP) | Yes | No | No |
| H. Sensory data (audio, visual) | Limited (review photos/videos you submit) | No | No |
| I. Professional or employment information | No | No | No |
| J. Education information | No | No | No |
| K. Inferences drawn from the above | Yes | No | Yes |
| L. Sensitive personal information | No (we do not knowingly collect) | No | No |
**Sources, purposes, and recipients** are described in Sections 1–3 above.
**Your CCPA/CPRA rights** include the right to:
- **Know / access**: what personal information we have about you, the sources, the purposes, and the categories of third parties with whom it is shared.
- **Delete**: subject to exceptions in Cal. Civ. Code § 1798.105(d).
- **Correct**: inaccurate personal information.
- **Opt out of sale or sharing**: see **"Do Not Sell or Share My Personal Information"** link in our footer and the GPC signal mentioned in Section 4.
- **Limit use of sensitive personal information**: not currently applicable, as we do not use sensitive personal information for purposes that would trigger this right.
- **Non-discrimination** for exercising rights.
**Notice of financial incentive**: any loyalty or discount programs we offer (including newsletter sign-up discounts) are based on the value the information provides to our business (estimated customer lifetime value attributable to the channel). You may withdraw from any program at any time without penalty by emailing contact@getdraen.com.
### 9.2 Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Oregon (OCPA), Texas (TDPSA), Montana (MCDPA), Iowa (IDPA), Delaware (DPDPA), New Hampshire (NHDPA), New Jersey (NJDPA), Minnesota (MNCDPA), Maryland (MOPA), and other comprehensive privacy laws as they take effect
Subject to the specific statute, you have the right to:
- **Confirm** whether we are processing your personal data and **access** it.
- **Correct** inaccuracies.
- **Delete** your data.
- **Obtain a portable copy** (where applicable).
- **Opt out** of (i) the sale of your data, (ii) targeted advertising / cross-context behavioral advertising, and (iii) certain profiling resulting in legal or similarly significant decisions.
- **Appeal** a decision we make in response to your rights request (where applicable).
If we decline your request, you may appeal by replying to our decision email or contacting contact@getdraen.com. If we decline an appeal in states that recognize this right, you may contact your state Attorney General. Colorado residents may also contact the Colorado AG at https://coag.gov/.
### 9.3 Shine the Light (California Civil Code § 1798.83)
California residents may request information about the categories of personal information we shared with third parties for those third parties' direct marketing purposes during the prior calendar year. Email contact@getdraen.com with "California Shine the Light Request" in the subject line. We do not currently share personal information for third parties' own direct marketing purposes.
### 9.4 Nevada SB 220
Nevada residents may submit a verified request to opt out of the future sale of their covered information. Email contact@getdraen.com.
## 10. EEA / UK / Swiss visitors (GDPR and UK GDPR)
If you are in the European Economic Area, United Kingdom, or Switzerland, the data controller is **DRAEN LLC**, contactable at contact@getdraen.com. We process your personal data on the following bases:
- **Performance of a contract** — to provide the Services you request.
- **Consent** — for marketing communications and non-essential cookies (you may withdraw consent at any time).
- **Legitimate interests** — analytics, fraud prevention, security, direct marketing of similar products to existing customers (subject to your right to object), business operations.
- **Legal obligation** — tax, accounting, compliance, regulatory requests.
You have the right to: access, rectify, erase, restrict processing, object to processing (including direct marketing), data portability, and (in certain cases) not to be subject to automated decision-making. You may lodge a complaint with your supervisory authority.
We retain data for the periods described in Section 5. International transfers to the United States rely on Standard Contractual Clauses or other lawful mechanisms.
## 11. Do Not Track
Some browsers transmit a "Do Not Track" signal. There is no industry standard for responding. We honor **Global Privacy Control (GPC)** as an opt-out of "sale" and "sharing" / targeted advertising where required by law.
## 12. Third-party links
The Services may contain links to third-party websites, including social media, payment processors, and shipping carriers. Their privacy practices are governed by their own policies. We are not responsible for them.
## 13. Changes to this Policy
We may update this Policy from time to time. The most current version will always be posted on the Site with the "Last updated" date. **Material changes will be communicated by email** (where you have provided one) or by prominent notice on the Site before they take effect.
## 14. Contact us
For any privacy question or to exercise a right:
DRAEN LLC — Attn: Privacy Team
United States
Email: contact@getdraen.com
Customer support: contact@getdraen.com
