Privacy policy

Privacy Policy

Last updated: June 7, 2026  |  Applies to: ybtco.com and all related services operated by Yerba Buena Tea Co. LLC

About this policy

Yerba Buena Tea Co. LLC (“YBTCO,” “we,” “us,” “our”) operates this store and website, including all related information, content, features, tools, products, and services (together, the “Services”). Our store is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase through the Services, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described here. We review and update this policy at least once every 12 months.

Personal information we collect or process

When we use the term “personal information,” we mean information that identifies or can reasonably be linked to you or another person. It does not include information that is collected anonymously or that has been de-identified. Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process the following categories of personal information:

• Contact details including your name, address, billing address, shipping address, phone number, and email address.
• Financial information including payment card information (processed by our payment processor; we do not store full card numbers), transaction details, payment confirmation, and, for subscriptions, the recurring billing schedule you authorize.
• Account information including your username, password, preferences, and settings.
• Transaction information including the items you view, add to your cart, or purchase, your subscription details, and your order history.
• Content you submit including product reviews, ratings, photos, and the information you include when contacting us for support or any other reason.
• Device and browser information including your IP address, browser type and version, operating system, screen resolution, language preferences, and other unique identifiers.
• Usage information including pages visited, time spent on pages, referring URLs, click behavior, and how you interact with or navigate the Services.

We do not intentionally collect sensitive personal information (such as racial or ethnic origin, health data, or precise geolocation) unless you voluntarily provide it to us, for example, when you share health-related information in a customer support inquiry or a product review about our herbal products. If we do collect sensitive information, we will obtain your consent where required by applicable law.

Personal information sources

We may collect personal information from the following sources:

• Directly from you when you create an account, place an order, start a subscription, contact us, subscribe to emails or SMS, leave a review, or otherwise provide information.
• Automatically through cookies, pixels, and similar technologies when you visit or interact with the Services.
• From our service providers such as Shopify (e-commerce platform), our payment processor, our subscription and reviews apps, and our shipping carriers, when they collect or process information on our behalf.
• From our marketing tools if you interact with our advertisements or marketing emails. We may use tools such as email marketing platforms and analytics services that provide us with information about your engagement.

How we use your personal information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

• Fulfillment and service delivery. Processing payments, fulfilling orders, managing subscriptions and recurring billing, arranging shipping, facilitating returns, managing your account, and sending order-related notifications.
• Personalization. Remembering your preferences, providing product recommendations, and creating a personalized shopping experience.
• Marketing and advertising. Sending marketing and promotional communications by email, text message, or postal mail, and showing you relevant advertisements on our site and other websites based on items you have previously viewed or purchased. You can opt out at any time (see “Your rights and choices” below).
• Reviews. Collecting, publishing, and displaying product reviews and ratings you submit.
• Security and fraud prevention. Authenticating your account, providing a secure payment experience, and detecting and investigating potentially fraudulent or malicious activity.
• Site improvement and analytics. Understanding how visitors use the Services so we can improve them over time.
• Communication. Responding to your inquiries and providing customer support.
• Legal compliance. Complying with applicable law, responding to valid legal process, enforcing our terms and policies, and participating in legal proceedings where required.

Cookies and tracking technologies

We use cookies, pixels, and similar technologies to operate the Services, remember your preferences, analyze site traffic, and support our marketing efforts. These technologies may be placed by us or by third-party services we use.

The categories of cookies and tracking technologies we use include:

• Essential cookies: Required for the Site to function (shopping cart, checkout, account authentication). These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with the Site (pages visited, time on site, traffic sources).
• Marketing and advertising cookies: Used to deliver relevant advertisements and track the effectiveness of our marketing campaigns across platforms.

You can manage your cookie preferences through our cookie banner or your browser settings. Most browsers allow you to block or delete cookies. If you disable essential cookies, some features of the Site may not function properly.

If you visit our Site with the Global Privacy Control (GPC) opt-out preference signal enabled, we will treat this as a valid request to opt out of the sale or sharing of your personal information for the device and browser you are using. To learn more, visit globalprivacycontrol.org.

How we disclose personal information

We may disclose your personal information to the following categories of recipients for the purposes described in this policy:

• Shopify (e-commerce platform, hosting, payment processing, analytics).
• Payment processors to process your transactions securely.
• Subscription management provider (Seal Subscriptions) to set up and process recurring subscription orders. It processes your contact, order, and billing-schedule information to fulfill your subscription.
• Reviews provider (Judge.me) to collect, host, and display product reviews. It receives your name, email address, order information, and any review content or photos you submit.
• Shipping carriers (such as USPS, UPS, or FedEx) to deliver your orders.
• Email and SMS marketing platforms to send marketing communications you have opted in to receive.
• Analytics and advertising partners to help us understand site usage and deliver relevant advertising. Depending on where you reside, this may constitute the “sharing” or “sale” of personal information as defined in applicable privacy laws, even though we do not receive monetary payment for your data. You may opt out of this sharing (see “Your rights and choices” below).
• Other apps and service providers that support our store operations (such as our website platform, customer-support, and analytics tools), which process personal information on our behalf under contract.
• Professional advisors such as lawyers and accountants, as necessary.
• In connection with a business transaction such as a merger, acquisition, or bankruptcy.
• To comply with applicable law, respond to valid legal process, enforce our terms, or protect the rights, safety, or property of YBTCO, our customers, or others.

If you would like to know the specific third parties that have received your personal information, you may submit a request to us using the contact details below. We will respond in accordance with applicable law, including the Oregon Consumer Privacy Act’s requirement to provide a list of specific third parties.

Sale and sharing of personal information

We do not sell your personal information for monetary consideration. However, like many e-commerce businesses, we use advertising tools (such as pixels and cookies) that may share certain information, including device identifiers and browsing behavior, with advertising partners. Under some state privacy laws, including those in California, Oregon, Colorado, Connecticut, and others, this may be considered a “sale” or “sharing” of personal information.

You have the right to opt out. You can do so by:

• Enabling Global Privacy Control (GPC) in your browser.
• Emailing us at info@ybtco.com with the subject line “Opt Out of Sale/Sharing.”

In the prior 12 months, we have not sold personal information for monetary consideration. We may have shared device identifiers and browsing behavior with advertising partners as described above.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services. Shopify acts as our processor for order fulfillment and store operations, and it also acts as an independent controller for some data it uses to improve its own services and support personalized advertising across its merchant network.

Information you submit through the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside. To learn more about how Shopify uses your personal information and any rights you may have, visit the Shopify Consumer Privacy Policy. Depending on where you live, you may also exercise certain rights through the Shopify Privacy Portal.

Data retention

We retain your personal information only as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. The main factors that determine how long we keep your data include:

• Order and transaction records: Retained for as long as needed to support your account, process returns, and comply with tax and accounting obligations (typically 7 years from the date of the transaction).
• Subscription and consent records: Records of your subscription and your consent to automatic renewal are retained for at least three years, or one year after the subscription ends, whichever is longer, consistent with applicable automatic-renewal laws.
• Account information: Retained for as long as your account remains active. If you request account deletion, we will delete or de-identify your information within a reasonable timeframe, subject to legal retention requirements.
• Marketing preferences: Retained until you opt out or request deletion.
• Analytics and device data: Typically retained in identifiable form for no more than 26 months.

Third-party websites and links

Our website may include links to third-party websites or platforms. We are not responsible for the privacy or security of those sites or the accuracy of information found on them. We recommend reviewing their privacy policies before providing any personal information. Our inclusion of a link does not imply endorsement.

Children’s data

The Services are intended for adults, and our Terms of Service require purchasers to be at least 18 years of age. We do not knowingly collect personal information from children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA). We also do not knowingly sell or share the personal information of consumers under 16 years of age. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at info@ybtco.com and we will delete it.

Security

We use commercially reasonable technical, administrative, and organizational measures to protect your personal information against unauthorized access, loss, destruction, or alteration. All payment transactions are processed through encrypted connections. No method of transmission over the internet or electronic storage is completely secure, however, and we cannot guarantee absolute security.

If you have an account, keep your credentials safe and do not share your password with anyone. If you believe your account has been compromised, contact us immediately at info@ybtco.com.

In the event of a data breach affecting your personal information, we will notify you and the appropriate authorities as required by Oregon law (ORS 646A.604) and any other applicable state breach notification laws.

Your rights and choices

Depending on where you live, you may have some or all of the following rights in relation to your personal information. These rights are not absolute, may apply only in certain circumstances, and we may decline certain requests as permitted by law.

• Right to access or know. You may request access to the personal information we hold about you, including the categories and specific pieces of information collected, the sources from which it was collected, the purposes for collecting it, and the categories of third parties to whom it was disclosed.
• Right to delete. You may request that we delete personal information we have collected from you, subject to certain exceptions (such as legal retention obligations).
• Right to correct. You may request that we correct inaccurate personal information.
• Right of portability. You may request a copy of your personal information in a portable, readily usable format.
• Right to opt out of sale, sharing, or targeted advertising. You may opt out of the “sale” or “sharing” of your personal information, or opt out of processing for purposes of targeted advertising, as those terms are defined in applicable state privacy laws. You can exercise this right by enabling Global Privacy Control in your browser or by emailing us.
• Right to limit use of sensitive data. Where applicable, you may request that we limit our use of sensitive personal information to what is necessary to provide the Services.
• Right to a list of specific third parties. Under the Oregon Consumer Privacy Act, you may request a list of the specific third parties to whom we have disclosed your personal information.
• Right to non-discrimination. We will not discriminate against you for exercising any of your privacy rights.

How to exercise your rights: To submit a request, email us at info@ybtco.com with the subject line “Privacy Rights Request.” We will verify your identity before processing your request and respond within the timeframe required by applicable law (typically 45 days, with a possible extension). You may designate an authorized agent to make a request on your behalf; we will require proof of authorization.

Right to appeal: If we decline your privacy rights request, you have the right to appeal. To appeal, email us at info@ybtco.com with the subject line “Privacy Appeal.” We will respond within the timeframe required by applicable law. If you are not satisfied with our response to your appeal, you may contact your state’s attorney general or applicable data protection authority.

Managing communication preferences: You can opt out of marketing emails using the unsubscribe link in any email. You can opt out of marketing SMS by replying STOP. Opting out will not affect transactional messages related to your orders.

International transfers

We primarily serve customers in the United States. If you access the Services from outside the United States, your personal information may be transferred to, stored, and processed in the United States. If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses, or equivalent contracts issued by the relevant UK authority, unless the transfer is to a country already determined to provide an adequate level of protection.

Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, regulatory, or operational reasons. We will post the revised policy on this website and update the “Last updated” date. For material changes, we will provide notice through the Site or by email. We review this policy at least once every 12 months.

Contact

Questions about our privacy practices, or want to exercise your rights? Email us at info@ybtco.com or write to us at:

Yerba Buena Tea Co. LLC
2195 Hyacinth St NE, Suite 108
Salem, OR 97301
United States

If you have a complaint about how we process your personal information, contact us first. Depending on where you live, you may also have the right to lodge a complaint with your state attorney general or local data protection authority.