Privacy policy
Privacy Policy
Effective date: March 19th, 2026 Last updated: March 19th, 2026
This Privacy Policy describes how Sea Witch Botanicals ("Sea Witch Botanicals," "we," "us," or "our"), operated by Living Glass Houses, LLC, collects, uses, and discloses Personal Information when you visit, use, or make a purchase from seawitchbotanicals.com (the "Site"), or otherwise interact with us.
Washington residents: Sea Witch Botanicals also maintains a separate Consumer Health Data Privacy Policy as required by Washington's My Health My Data Act. That policy governs how we handle consumer health data and is separate from this document.
1. Personal Information We Collect
We collect Personal Information from and about you in the categories below. In this Privacy Policy, "Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you.
a. Device and usage information
- Examples collected: web browser type and version, IP address, time zone, cookie identifiers, device identifiers, pages and products viewed, search terms used, referring URLs, and interactions with the Site (clicks, scroll depth, session duration).
- Source: collected automatically when you access the Site through cookies, log files, web beacons, tags, pixels, and similar tracking technologies.
- Purpose: to render the Site correctly, perform analytics on Site usage, detect and prevent fraud, and improve performance.
- Disclosed to: Shopify, Google, Meta (Facebook/Instagram), Klaviyo, Recharge, and other service providers listed in Section 4.
b. Order and account information
- Examples collected: name, billing and shipping addresses, email address, phone number, payment information (credit card or ACH/checking information processed by Shopify), order history, account credentials, and any custom order notes you provide.
- Source: provided directly by you at checkout or when creating an account.
- Purpose: to fulfill your order, process payments, arrange shipping, issue invoices and order confirmations, manage returns, screen for fraud, manage subscriptions, and provide order-related communications.
- Disclosed to: Shopify, Recharge (for subscription orders), ShipStation, TaxJar, Numeral, payment processors, and other service providers listed in Section 4.
c. Customer support and communications
- Examples collected: name, email, phone number, mailing addresses, order history, payment information, and the content of your messages to us.
- Source: provided by you when you contact us by email, SMS, web form, social media direct message, or other means.
- Purpose: to respond to inquiries, resolve issues, and improve our service.
- Disclosed to: Shopify, Klaviyo, Stamped.io, and any help-desk software in use.
d. Marketing preferences and engagement
- Examples collected: email subscription status, SMS subscription status, marketing preferences, email open and click data, ad interaction data, loyalty program activity, and product review submissions.
- Source: provided by you (opt-ins, form submissions) and collected automatically as you engage with our marketing.
- Purpose: to send marketing communications, personalize recommendations, run loyalty and referral programs, and measure marketing effectiveness.
- Disclosed to: Klaviyo, Smile.io, Stamped.io, Meta, Google, and other service providers listed in Section 4.
e. Inferences
- Examples: product preferences, predicted lifetime value, audience segment membership, and likelihood to repurchase.
- Source: derived from the categories above.
- Purpose: to personalize the Site, tailor marketing, and improve our products.
We do not intentionally collect government-issued identifiers (Social Security numbers, driver's license numbers, passport numbers), biometric information, precise geolocation data, or information about your racial or ethnic origin, religious beliefs, union membership, sexual orientation, or immigration status. If you provide such information voluntarily (for example, in a customer service message), we will handle it under this policy and delete it when no longer needed.
2. Sources of Personal Information
We collect Personal Information from:
- You directly — when you place an order, create an account, sign up for marketing, contact us, leave a review, participate in our loyalty program, or apply for wholesale.
- Automatically — through cookies and similar technologies when you use the Site.
- Third parties — including advertising platforms that share audience or campaign data with us, fraud-prevention services, and shipping carriers that confirm delivery.
3. How We Use Personal Information
We use Personal Information to:
- Provide, operate, and maintain the Site and fulfill orders;
- Process payments and prevent fraud;
- Communicate with you about your orders, account, and customer service inquiries;
- Send marketing communications you have consented to receive, and personalize their content;
- Run advertising on third-party platforms (including retargeting and lookalike audiences);
- Operate our loyalty, referral, and review programs;
- Conduct analytics, research, and product development;
- Comply with legal obligations and enforce our terms.
4. Who We Share Personal Information With
We share Personal Information with service providers and partners that help us run the business. These parties are contractually obligated to use the information only as needed to provide their services and consistent with this policy.
Current service providers and partners
| Vendor | Function |
|---|---|
| Shopify | E-commerce platform, hosting, payments, fraud screening |
| Recharge | Subscription billing and management |
| Klaviyo | Email and SMS marketing, customer profiles, segmentation |
| Stamped.io | Product reviews and ratings |
| Smile.io | Loyalty and rewards program |
| ShipStation | Order fulfillment and shipping label generation |
| TaxJar | Sales tax calculation and reporting |
| Numeral | Sales tax filing |
| Analytics, advertising (Google Ads), Search Console | |
| Meta (Facebook / Instagram) | Advertising, retargeting, audience matching |
| Amazon | Listings and order fulfillment via the Amazon sales channel |
| Bread Loaf Corporation (webakebread.com) | Creative, development, advertising, and retention services agency; processes data on our behalf as a service provider |
Other categories of recipients
- Payment processors (Shopify Payments and any third-party processor for ACH, Shop Pay, or other methods);
- Shipping carriers (USPS, UPS, FedEx, DHL, and any other carrier used to deliver your order);
- Professional advisors (attorneys, accountants, auditors) under confidentiality obligations;
- Successors in the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, in which case Personal Information may be transferred to the successor entity;
- Government authorities and law enforcement when required by valid legal process, to protect our rights, or to investigate potential violations of our terms.
Additional processing and third-party apps
We may install additional apps, plugins, or integrations within Shopify, Klaviyo, or other platforms to support business operations (for example: analytics tools, customer support helpdesks, abandoned cart recovery, popups, upsell apps, attribution platforms, reviews, or returns management). Where any such app processes Personal Information on our behalf, that app acts as a service provider under this policy. A current and complete list of apps with access to Personal Information is maintained internally and available upon written request (see Section 10). We will update this Privacy Policy when material changes are made to our vendor stack.
5. Sharing of Personal Information (and CCPA/CPRA Disclosure)
Sea Witch Botanicals does not sell Personal Information for monetary consideration. However, under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and similar laws in other U.S. states, the term "sharing" is defined to include the disclosure of Personal Information to third parties for cross-context behavioral advertising, even when no money changes hands.
Sea Witch Botanicals does share Personal Information for cross-context behavioral advertising. Specifically:
- We allow Meta (Facebook/Instagram) and Google to receive Site usage information through advertising pixels for the purposes of retargeting, lookalike audience modeling, and conversion tracking.
- We allow Klaviyo to facilitate audience syncing with Meta and Google for targeted advertising.
Categories of Personal Information shared for cross-context behavioral advertising:
- Identifiers (hashed email addresses, device identifiers, IP address)
- Internet or other electronic network activity (browsing history on our Site, products viewed, search terms)
- Commercial information (purchase history, products purchased)
- Inferences drawn from the above (audience segment membership, predicted interests)
Categories of third parties we share with for advertising: advertising networks and platforms (Meta, Google) and marketing automation providers that facilitate audience matching (Klaviyo).
We have not sold Personal Information in the preceding 12 months. We have shared Personal Information for cross-context behavioral advertising in the preceding 12 months, as described above.
We do not knowingly sell or share the Personal Information of consumers under 16 years of age.
Your right to opt out of sharing
You can opt out of the sharing of your Personal Information for cross-context behavioral advertising at any time:
- Use the "Do Not Sell or Share My Personal Information" link in our Site footer, or
- Enable a Global Privacy Control (GPC) signal in a supported browser, which we honor as a valid opt-out request, or
- Email hifriend@seawitchbotanicals.com with the subject line "Privacy Request — Opt Out of Sharing."
You can also opt out at the platform level:
- Meta: https://www.facebook.com/settings/?tab=ads
- Google: https://adssettings.google.com
- Klaviyo: https://www.klaviyo.com/privacy
- Digital Advertising Alliance: https://optout.aboutads.info/
- Network Advertising Initiative: https://optout.networkadvertising.org/
6. Cookies and Tracking Technologies
A cookie is a small text file placed on your device when you visit a website. We use cookies and similar technologies (pixels, tags, local storage) for:
- Strictly necessary functions (cart, checkout, login, security)
- Performance and analytics (Shopify Analytics, Google Analytics)
- Advertising and targeting (Meta Pixel, Google Ads tags, Klaviyo tracking)
- Functional preferences (saving region, language, recently viewed)
You can manage cookies through your browser settings or any cookie banner provided on the Site. Blocking cookies may degrade Site functionality. We honor Global Privacy Control (GPC) signals as opt-outs for sale/sharing where applicable.
Because there is no consistent industry standard for "Do Not Track" browser signals, we do not currently respond to Do Not Track headers, but we do honor GPC as described above.
7. SMS / Text Message Marketing
If you opt in to receive SMS marketing messages from Sea Witch Botanicals:
- Message frequency varies. You may receive up to several messages per month.
- Message and data rates may apply.
- Text HELP for help. Text STOP to unsubscribe at any time.
- Consent to receive marketing messages is not a condition of any purchase.
- We do not share your mobile information with third parties or affiliates for their own marketing or promotional purposes. Information sharing is limited to subcontracted service providers (such as Klaviyo) that help us operate our SMS program.
For our complete SMS Terms, see Terms of Service.
8. Retention
We retain Personal Information only as long as needed for the purposes described in this policy or as required by law. General retention periods:
| Category | Retention period |
|---|---|
| Order records | 7 years from order date (tax and accounting requirements) |
| Customer account data | For the life of the account, plus 2 years of inactivity |
| Marketing engagement data | Until you unsubscribe, plus 2 years for suppression and audit purposes |
| Customer service records | 3 years from last contact |
| Website analytics | Up to 26 months (Google Analytics default) |
| Fraud and security logs | Up to 5 years |
You may request deletion at any time (see Section 10). Some information may be retained longer when required by law (for example, tax records) or to enforce our agreements.
9. Children's Privacy
The Site is not directed to, and we do not knowingly collect Personal Information from, children under 13 years of age. We also do not knowingly sell or share the Personal Information of consumers under 16 years of age. If you believe a child has provided us with Personal Information, please contact us at hifriend@seawitchbotanicals.com and we will delete it.
10. Your Privacy Rights
Depending on where you live, you may have some or all of the following rights:
- Right to know / access — request a copy of the Personal Information we hold about you.
- Right to delete — request that we delete Personal Information we have collected from you.
- Right to correct — request that we correct inaccurate Personal Information.
- Right to data portability — receive your Personal Information in a portable format.
- Right to opt out of sale or sharing — see Section 5.
- Right to limit use of sensitive Personal Information — we do not currently use Personal Information for purposes that trigger this right, but we will honor it if applicable in the future.
- Right to non-discrimination — we will not discriminate against you for exercising any of these rights.
- Right to appeal (Virginia, Colorado, Connecticut, and certain other states) — if we deny a privacy request, you may appeal by replying to our response email.
How to exercise your rights
Email hifriend@seawitchbotanicals.com with the subject line "Privacy Request" and a description of your request. We will verify your identity (typically by confirming information matching your account or order history) before responding. We respond within 45 days, with a possible 45-day extension when needed; we will notify you if an extension is required.
You may also designate an authorized agent to submit a request on your behalf. The agent must provide written authorization signed by you.
Specific rights frameworks
- California (CCPA/CPRA): rights to know, delete, correct, opt out of sale/sharing, limit use of sensitive PI, and non-discrimination.
- Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws: rights to access, delete, correct (where applicable), portability, and opt out of targeted advertising and sale.
- EEA and UK (GDPR / UK GDPR): rights to access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent, and to lodge a complaint with your supervisory authority.
- Washington (My Health My Data Act): see our separate Consumer Health Data Privacy Policy.
11. International Data Transfers
Sea Witch Botanicals is based in the United States. If you access the Site from outside the United States, your Personal Information will be transferred to, stored, and processed in the United States and in other countries where our service providers operate. We rely on appropriate safeguards for such transfers, including Standard Contractual Clauses and our vendors' compliance certifications, where applicable.
12. Lawful Basis (EEA / UK)
Where GDPR or UK GDPR applies, we process Personal Information under one or more of the following lawful bases:
- Performance of a contract with you (order fulfillment, account management);
- Consent (marketing communications, non-essential cookies);
- Legitimate interests (analytics, fraud prevention, service improvement), provided these do not override your fundamental rights;
- Legal obligation (tax, accounting, regulatory compliance).
13. Automated Decision-Making
We do not engage in fully automated decision-making that produces legal or similarly significant effects on you. Our payment processor Shopify uses limited automated logic for fraud prevention (such as temporary IP and card denylists), which does not produce legal or significant effects on you.
14. Security
We use commercially reasonable administrative, technical, and physical safeguards designed to protect Personal Information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your Personal Information, we will notify you and applicable regulators as required by law.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, vendors, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this policy and, where required, provide additional notice (such as an email or banner on the Site).
16. Contact Us
For privacy questions, complaints, or to exercise your rights:
Sea Witch Botanicals Living Glass Houses, LLC 1616 N State St, STE 103, Bellingham, WA 98225 Email: hifriend@seawitchbotanicals.com
EEA / UK residents have the right to lodge a complaint with their local data protection authority.