Privacy Policy

Privacy Policy

Last Updated: August 27, 2026

This Privacy Policy describes how The Rootist Inc ("Rootist," "we," "our," or "us") collects, uses, discloses and otherwise processes information about you when you visit rootist.com, buy from us, subscribe to our emails or texts, or contact our customer care team (together, our "Services").

We may change this Privacy Policy from time to time. When we do, we will revise the date at the top of this policy, and if the changes are material we will give you additional notice — for example, a notice on the site or an email. We encourage you to review this policy periodically.

Contents

• Collection of Information
• Use of Information
• Advertising, Analytics and the Companies We Work With
• Disclosure of Information
• Your Choices
• Global Privacy Control
• Do Not Sell or Share My Personal Information
• Additional Disclosures for Individuals in Certain U.S. States
• Data Retention
• Security
• Children's Privacy
• Where We Operate
• Contact Us

COLLECTION OF INFORMATION

Information you provide to us

We collect information you give us directly: when you place an order, create an account, subscribe to marketing emails or texts, start or manage a subscription, write a product review, enter a promotion, or contact customer care. That typically includes your name, email address, shipping and billing address, phone number, order contents, and whatever you choose to write to us.

We do not receive or store your full payment card number. Payments are processed by Shopify's payment processor; we receive only a confirmation, the payment method type and the last four digits.

Information we collect automatically

When you use our Services we collect:

• Activity information — pages and products you view, links you click, searches you run, and what you add to a cart.
• Order information — what you bought, when, at what price, and any return or exchange.
• Device and network information — your IP address, browser type and version, operating system, screen size, referring page, and the approximate location (typically city level) that your IP address indicates.
• Cookies and similar technologies — see "Advertising, Analytics and the Companies We Work With" below for exactly which ones, who sets them, and how to turn them off.

We collect this using cookies, pixels and similar technologies. Where an applicable law requires your consent before non-essential technologies load, we ask for it before they load; in the United States, non-essential cookies are on by default and you can turn them off at any time using the controls described below.

Information from other sources

We receive information about you from the service providers that run parts of our business — our ecommerce platform, our subscription and shipping partners, our email and SMS platform, and our advertising and analytics partners — and from the marketplaces and social platforms where we also sell, such as Amazon and TikTok Shop. Those platforms operate under their own privacy policies, and this policy does not govern what they do on their own surfaces.

We may infer information from what we collect — for example, your approximate location from your IP address, or which products are likely to interest you from what you have viewed or bought.

USE OF INFORMATION

We use the information we collect to:

• fulfil, ship and support your orders and returns, and manage any subscription you have;
• provide, maintain, secure and improve our Services;
• personalise your experience, including which products we show you;
• send you transactional messages — order confirmations, shipping notices, subscription renewal reminders, security alerts and support replies;
• send you marketing emails and texts you have asked for, and measure whether they worked (you can stop these at any time — see "Your Choices");
• run and measure advertising, including advertising shown to you on other companies' sites and apps;
• understand how people use the site so we can make it better;
• run promotions, giveaways and referral offers;
• detect, investigate and prevent fraud, abuse and security incidents; and
• comply with our legal, tax and financial obligations.

ADVERTISING, ANALYTICS AND THE COMPANIES WE WORK WITH

We would rather name the companies than describe them in the abstract. On rootist.com the following third parties receive information about your visit:

Who	What they do for us	What they receive
Google (Google Tag Manager and Google Analytics 4)	Site analytics and advertising measurement	Pages viewed, products viewed and added to cart, device and browser information, IP address, and an analytics identifier stored in a cookie
Klaviyo	Email and SMS marketing, and the signup forms on this site	Your browsing on this site, your email address if you give it to us, and your order history
Shopify	Runs our store, our checkout and our content	Everything needed to serve the page and take your order

At checkout and on the order-status page, which Shopify hosts, these additional partners receive order and purchase information: Meta (Facebook and Instagram) for advertising measurement, Klaviyo, AfterShip for shipment tracking and returns, and Google Analytics for purchase measurement.

Other companies process information for us without using it for their own advertising: Recharge (subscriptions), Gorgias (customer support conversations), and our shipping carriers.

We do not sell your personal information for money. Some of the sharing described above — principally the advertising and analytics cookies — counts as a "sale" or a "share" for cross-context behavioural advertising under California, Colorado, Connecticut and Virginia law. You can opt out. See "Do Not Sell or Share My Personal Information" below.

You can also opt out of interest-based advertising from participating companies at optout.aboutads.info and optout.networkadvertising.org. Those industry mechanisms are browser-specific and do not replace the control we offer directly.

DISCLOSURE OF INFORMATION

Beyond the partners named above, we disclose personal information:

• To service providers and contractors who perform work on our behalf — hosting, payment processing, fulfilment and shipping, subscription billing, customer support, fraud prevention, email and SMS delivery, analytics and advertising — under contracts that limit what they may do with it.
• To other users, if you post a public product review.
• In legal proceedings and to authorities, where we believe disclosure is required by law or legal process, or is necessary to respond to a lawful request.
• To protect rights and safety — ours, our customers', or the public's — including enforcing our Terms.
• To our professional advisors — legal, accounting, insurance — as needed to run and protect the business.
• In a corporate transaction — a merger, financing, acquisition or sale of assets, or during negotiation of one.
• With your consent, or when you direct us to.
• In aggregated or de-identified form that cannot reasonably be used to identify you. We will not attempt to re-identify it.

YOUR CHOICES

Marketing emails and texts. Every marketing email has an unsubscribe link and every marketing text accepts STOP. Opting out of marketing does not stop transactional messages about an order or a subscription you have.

Cookies and tracking. A notice appears on your first visit. You can decline non-essential cookies there, or at any time at rootist.com/privacy-choices. You can also block or delete cookies in your browser settings, though doing so may break parts of the site.

Your account. If you have an account you can view and update your information by signing in. If you do not, email us — we do not require you to create an account to exercise any right in this policy.

Subscriptions. You can change or cancel a subscription from the link in any subscription email, or by emailing us.

GLOBAL PRIVACY CONTROL

We honor the Global Privacy Control (GPC) signal.

GPC is a setting your browser — or a browser extension — can send on your behalf that says you do not want your personal information sold or shared. If we receive it, we treat it as an opt-out request for that browser: we turn off advertising and analytics cookies, we stop sharing your browsing with advertising partners, and we do not ask you to do anything else. It applies on every visit from that browser, and it takes precedence over any earlier choice saved in that browser.

You can find out whether your browser sends GPC, and turn it on, at globalprivacycontrol.org.

DO NOT SELL OR SHARE MY PERSONAL INFORMATION

There is a link titled "Do not sell or share my personal information" in the footer of every page of rootist.com. It leads to rootist.com/privacy-choices, where a single button records your opt-out immediately. You do not need an account, and you do not need to give us your name or email to use it.

Because we have no way to identify an unrecognised visitor, that opt-out is stored in the browser you use it from. If you clear your site data, or use a different browser or device, you will need to make the choice again — or turn on Global Privacy Control, which carries it automatically. If you would rather we applied an opt-out to your customer account and email address as well, email us at hello@rootist.com and we will.

We will not discriminate against you — in price, in product availability or in service quality — for exercising any privacy right.

ADDITIONAL DISCLOSURES FOR INDIVIDUALS IN CERTAIN U.S. STATES

California, Colorado, Connecticut, Utah, Virginia and a growing number of other states have enacted consumer privacy laws ("State Privacy Laws"). If you are a resident of one of those states, and to the extent Rootist is subject to the law that applies to you, this section applies to you.

What we collect, why, and who receives it

Category of personal information	Where it comes from	Why we use it	Who receives it
Identifiers — name, email, phone, shipping and billing address, cookie and device identifiers	You, and automatically	Orders, support, marketing, advertising, security	Service providers; advertising and analytics partners; others as listed under "Disclosure of Information"
Commercial information — orders, returns, subscriptions, purchase history	You, and our platform	Fulfilment, support, subscriptions, marketing measurement	Service providers; advertising and analytics partners
Internet and network activity — pages and products viewed, clicks, searches, cart activity, IP address, browser and device	Automatically	Analytics, personalisation, advertising, security	Advertising and analytics partners; service providers
Geolocation (approximate, from IP)	Automatically	Regional content, fraud prevention, analytics	Service providers; analytics partners
Audio, electronic or visual information — your messages to customer care, and public product reviews	You	Support; reviews are shown publicly	Support platform; other users, for reviews
Inferences — likely product interests	Derived	Personalisation and marketing	Advertising and analytics partners

We do not collect or process sensitive personal information as those State Privacy Laws define it, and we do not use or disclose personal information to infer characteristics about you.

We do not knowingly sell or share the personal information of anyone under 16.

Personal information we "sell," "share," or use for "targeted advertising"

Our advertising and analytics activities may constitute a "sale" or "share," or the use of personal information for "targeted advertising," under the State Privacy Law that applies to you. The categories involved are identifiers (such as cookie identifiers and, where you have given it to us, a hashed email address), commercial information, internet and network activity, and inferences. The categories of recipient are advertising networks and analytics providers — named in "Advertising, Analytics and the Companies We Work With" above.

We do not exchange personal information for money.

Your rights

Depending on the state you live in, you have the right to:

• Know and access the personal information we hold about you, including the categories collected, the sources, the purposes, and the categories of third party that receive it;
• Correct inaccurate personal information;
• Delete personal information we hold about you;
• Obtain a portable copy of the information you gave us;
• Opt out of the sale or sharing of your personal information and of targeted advertising;
• Opt out of profiling that produces legal or similarly significant effects — we do not engage in that kind of profiling;
• Limit the use of sensitive personal information — we do not collect any; and
• Not be discriminated against for exercising any of these rights.

How to exercise them

To opt out of sale, sharing and targeted advertising: use the "Do not sell or share my personal information" link in the footer of any page, turn on Global Privacy Control, or email us. Colorado and Connecticut residents: we honor Global Privacy Control as a universal opt-out mechanism, as those laws require.

For every other right: email hello@rootist.com with the request. We will ask for enough information to verify who you are — usually confirmation of an email address you have ordered from and details of a recent order — and we will not use what you give us for verification for anything else. We respond within the time the applicable law allows, generally 45 days, and we will tell you if we need longer.

Authorized agents. An agent may make a request on your behalf with proof of authority — a valid power of attorney, or your signed permission. We may still contact you to confirm.

Appeals. If we deny your request, you may appeal by replying to our decision or emailing hello@rootist.com with "Privacy appeal" in the subject line. We will respond within the time the applicable law allows. If you disagree with the outcome, you may contact the attorney general of your state.

Notice of financial incentives (California)

We offer a discount to customers who sign up for our marketing emails or texts. When you take it, we collect your email address or phone number and link it to your purchase history. You opt in by signing up and may opt out at any time by unsubscribing; unsubscribing may end the ongoing benefit. We calculate the value of the offer as its face value to us, which is reasonably related to the value your information provides.

Shine the Light (California)

California residents may request details about personal information disclosed to third parties for those parties' own direct marketing purposes. To make that request, email hello@rootist.com with "Shine the Light" in the subject line.

DATA RETENTION

We keep personal information for as long as we need it for the purpose we collected it, and then for as long as we are required to keep it. In practice: order and transaction records are kept for the periods tax and accounting law requires; marketing contact information is kept until you unsubscribe and for a short period after; customer support conversations are kept while they may still be relevant to your account; and analytics and advertising identifiers expire on the schedules those platforms set. When we no longer need information we delete it or de-identify it.

SECURITY

We use administrative, technical and physical safeguards designed to protect personal information — including encryption in transit, access controls, and processing payments through a PCI-compliant provider so that card numbers never reach our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

CHILDREN'S PRIVACY

Our Services are not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn that we hold information from someone under 16, we will delete it. If you are a parent or guardian and believe your child has given us information, email hello@rootist.com.

WHERE WE OPERATE

Rootist is based in the United States and ships within the United States only. Our Services are intended for people in the United States, and the information we collect is processed in the United States.

CONTACT US

The Rootist Inc
1111 MacArthur Blvd.
Mahwah, New Jersey 07430
United States

Questions about this policy, or about the personal information we hold about you: hello@rootist.com