Privacy policy

Yerba Buena Tea Co. LLC — Privacy Policy

Effective date: August 7, 2025 Legal entity: Yerba Buena Tea Co. LLC ("YBTCO", "we", "us", "our") Registered address: 2195 Hyacinth St NE, Suite 108, Salem, OR 97301, USA

A Plain Language Summary

We value your privacy and believe in being transparent about how we handle your information. Here’s the gist:

  • We Collect What's Necessary: We collect the information needed to process your orders, run our website, and improve your experience (like your shipping address and order history).

  • We Do Not Sell Your Data: We do not sell your personal information for money. We also do not "share" your information for cross-context behavioral advertising or engage in targeted advertising.

  • You Have Rights: Depending on where you live, you have rights to access, correct, or delete your data. This policy explains how to exercise those rights.

  • Secure Systems: We use trusted partners like Shopify for our platform and payments, and we take data security seriously.

This full Privacy Policy provides the important details on what we collect, why, and your rights.

1. Scope & Who This Covers

This Policy applies to information we collect when you:

  • Visit or shop on ybtco.com or our mobile experiences;

  • Interact with our emails, ads, or social media;

  • Purchase YBTCO products through third-party marketplaces or at events; and

  • Contact us for support, wholesale inquiries, or partnerships.

This Policy does not apply to third-party websites or services that we do not control. Where we link to third-party services (e.g., payment processors, shipping carriers, social media platforms), their own privacy policies apply.

2. Notice at Collection (What We Collect, Why, and How Long We Keep It)

We collect the following categories of personal information, depending on your interactions:

Category of Personal Information

Sources

Business Purposes of Use

Typical Retention Period

A. Identifiers & Contact Details (name, email, phone, billing/shipping address, account ID, IP address)

You; Shopify checkout/account; customer service; newsletter/signup forms; events.

Process and deliver orders; account management; customer support; fraud prevention; legal compliance; marketing (with consent where required).

3 years after your last interaction, unless a longer period is required by law. Order records are retained for 7 years for tax/audit purposes.

B. Commercial Information (order history, products viewed, items in cart/wishlist).

Our storefront; Shopify; subscription or review apps.

Fulfill purchases; handle returns; personalize product recommendations; analytics.

Order history for 7 years; browsing/cart data for 12–24 months.

C. Internet/Network Activity (device/browser info, pages viewed, referring/exit pages, timestamps; cookies and similar technologies).

Your device and browser; our and third-party cookies, pixels, SDKs.

Site functionality; security; analytics; improve content.

Varies by cookie settings; typically 13–24 months unless you clear them earlier.

D. Inferences (preferences and interests derived from the above).

Derived from your activity.

Personalize your experience and offers; improve products; measure campaign performance.

12–24 months.

E. User-Generated Content (product reviews, Q&A, social media posts where you tag us).

You; our review platforms.

Display reviews; moderate content; community management.

Until removed by you or per our retention schedule.

F. Payment Information (tokenized card details).

Processed directly by our payment providers (e.g., Shopify Payments, PayPal). We do not store full card details on our systems.

Process payments, refunds, and conduct fraud screening.

Per payment provider policies and legal requirements.

G. Geolocation Data (approximate location from your IP address).

Your device and browser.

Localize content, shipping options, and for fraud/security purposes.

Up to 12 months.

Sensitive Personal Information (SPI): We do not seek to collect SPI (e.g., precise geolocation, health information). If we collect any SPI for a specific purpose (e.g., fraud prevention), we use it only for that purpose and do not disclose it for additional purposes. If this practice changes, we will provide a “Limit the Use of My Sensitive Personal Information” link as required by law.

3. How We Use Personal Information (Purposes)

  • To Provide Our Services: Fulfill orders, facilitate returns, manage accounts, and provide customer support.

  • For Improvement & Personalization: Personalize content and recommendations; conduct analytics and product research to improve our offerings.

  • For Marketing & Advertising: Communicate with you about products and offers (with your consent where required).

  • For Legal & Security: Detect, investigate, and prevent fraud or security incidents; comply with applicable laws, accounting, and tax obligations.

Legal bases for EEA/UK users: Our legal bases for processing include performance of a contract (to fulfill your order), our legitimate interests (e.g., to improve services and prevent fraud), your consent (for electronic marketing and non-essential cookies), and our legal obligations.

4. Cookies, Pixels & Your Choices

We use first‑party and limited third‑party cookies that are necessary to run our site, analyze performance, and, with your consent where required, improve our content. You can manage your preferences at any time via our "Cookie Settings" link and by using your browser settings. We also honor the Global Privacy Control (GPC) signal as described below.

5. Targeted Advertising, Sale/Sharing of Personal Information & Your Opt-Out Rights

We do not sell your personal information for money. Furthermore, we do not "share" personal information for cross-context behavioral advertising, nor do we process it for targeted advertising.

Because we do not engage in these activities, our site does not display a “Do Not Sell or Share My Personal Information” link. If our practices change, we will update this Policy and provide the required notices and opt-out mechanisms.

We honor Global Privacy Control (GPC) and other recognized opt-out preference signals as a valid method for you to exercise your privacy choices for the browser and device you are using.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

6. Your Privacy Rights (By Region)

Depending on where you live, you may have some or all of the following rights: access/know, data portability, correction, deletion, and the right to appeal our decision. You also have the right to be free from discrimination for exercising your rights.

  • How to Exercise Rights:

    • Email: privacy@ybtco.com

    • Mail: YBTCO Privacy, 2195 Hyacinth St NE, Suite 108, Salem, OR 97301, USA

  • Verification: To protect your information, we will ask for reasonable information to verify your identity before processing your request.

  • Timelines: We aim to respond within 45 days (we may extend once by 45 days with notice).

  • Appeals: If we deny your request, you may appeal by replying to our decision within 60 days. Our appeal response will explain our reasons and how to contact your state Attorney General, if applicable.

State-Specific Rights:

  • California (CCPA/CPRA): You have the rights to know/access, correct, delete, opt out of sale/share, and limit the use/disclosure of SPI. Our Notice at Collection is provided in Section 2.

  • Financial Incentives: If we offer benefits tied to personal information (e.g., an email sign-up discount), we provide a Notice of Financial Incentive with clear terms and an easy opt-out. See Section 9.

  • Colorado (CPA), Connecticut (CTDPA), Oregon (OCPA), Texas (TDPSA), Virginia (VCDPA), and others: You have similar rights, including the right to opt-out of targeted advertising, sale, and certain types of profiling, as well as the right to appeal. We will honor all applicable rights based on your state of residence.

EEA/UK residents: You have rights under GDPR (e.g., access, rectification, erasure, restriction, portability, and objection). You may withdraw consent at any time and may lodge a complaint with your local supervisory authority.

7. How We Disclose Information

We disclose personal information with:

  • Service Providers/Processors: Companies that help us run our business, such as Shopify (our ecommerce platform), payment processors, email vendors, and fulfillment partners. We have contracts that limit their use of your data.

  • Affiliates: We may share information within our corporate group, should our structure change in the future.

  • Business Transfers: In the event of a merger, acquisition, or asset sale, your information may be transferred.

  • Legal and Safety: To comply with the law, enforce our terms, or protect the rights and safety of YBTCO and our customers.

Relationship with Shopify: We run our store on Shopify. Shopify acts as our service provider but is also an independent controller of your information for its own services like Shop Pay. To exercise your rights directly with Shopify, please see Shopify’s Consumer Privacy Policy.

8. Data Security & Retention

We implement appropriate technical and organizational measures to protect your data. We keep data only as long as necessary for the purposes described in Section 2 or as required by law.

9. Notice of Financial Incentive

From time to time, we may offer a benefit (e.g., a discount) if you provide personal information like your email or phone number. Participation is voluntary, and you may withdraw at any time.

  • Material terms: The specific terms are described at the point of collection.

  • How to withdraw: Use the "unsubscribe" link in emails or reply "STOP" to any SMS message.

  • Value of the data: We make a good-faith estimate that the value of your personal information is reasonably related to the value of the benefit offered.

10. Children’s & Teens’ Privacy

Our services are not directed to children under 13, and we do not knowingly collect their personal information. Where required by law (e.g., California), we do not sell or share the personal information of individuals we know are under 16 without appropriate opt-in consent.

11. International Data Transfers

We primarily serve customers in the United States. If you access our site from other regions, your information may be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards like Standard Contractual Clauses for such transfers.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new effective date.

13. Contact Us

  • Email: privacy@ybtco.com

  • Mail: YBTCO Privacy, 2195 Hyacinth St NE, Suite 108, Salem, OR 97301, USA