Privacy Policy
A short version, because there isn't much to tell: we collect what's needed to make and post your order, we don't sell it to anyone, and you can ask us to delete it.
Last updated 21 July 2026
On this page
Who we are
Herbal Alchemist and it's employees. We're the ones who decide what happens to the information described here.
For anything on this page, email hello@herbal-alchemist.com.
What we collect
When you order
- Your name, email address and shipping address
- Your phone number, if you give one — carriers sometimes need it
- What you bought, including which oils went into each bottle
- The amount paid and a payment reference from our merchant processor
When you subscribe to the newsletter
Just your email address.
When you browse
Our analytics records pages viewed, roughly where in the world you are, and what kind of device and browser you're using. See Analytics below.
What we deliberately don't collect
- Card numbers. They never touch our server — see Payments.
- Accounts and passwords. There's no customer login, so there's no password of yours for us to lose.
- Health information. If you tell us about a sensitivity so we can advise on a blend, we'd rather you did — but please don't send us medical detail we haven't asked for.
Why we hold it
Payments
Payments are handled by Stripe. When you check out you're taken to a page hosted by Stripe, and your card details go straight to them. They never pass through our website and we never see or store them.
What comes back to us afterwards is your name, email, shipping address, the amount, and a reference — enough to know the order is paid and where to send it.
Stripe processes this as its own data controller under its privacy policy.
Analytics
We use Matomo, an analytics tool we run on our own server rather than a third-party service. That's a deliberate choice: the data stays with us and isn't handed to an advertising company or used to build a profile of you across other websites.
It records which pages are visited, which site you arrived from, an approximate location from your IP address, and your browser and device type.
You can opt out by turning on Do Not Track in your browser, or by blocking analytics scripts. Nothing on the site stops working if you do.
Cookies
Your shopping cart is held in your browser's memory, not in a cookie, which is also why it empties if you reload the page.
Who else sees it
We do not sell your information, rent it, or trade it. It's shared only where it's needed to get your order to you:
- Stripe — to take payment
- The delivery carrier — your name and address, so they can deliver it
- Our email provider — for receipts and the newsletter
- Our web host — where the site and its database sit
- Law enforcement — only where we're legally required to
How long we keep it
Your rights
Wherever you live, you can ask us to:
- Tell you what we hold about you
- Correct anything that's wrong
- Delete it
- Send you a copy
- Stop emailing you
Email hello@herbal-alchemist.com and we'll respond within 14 days. There's no charge, and we won't treat you differently for asking.
One limit worth being straight about: we may have to keep the bare financial record of a completed sale even after deleting everything else, because tax law requires it. We'll tell you exactly what was kept and why.
California residents
Under the CCPA, as amended by the CPRA, you have the right to know what personal information is collected and why, to have it deleted, to have inaccuracies corrected, to opt out of its sale or sharing, and not to be discriminated against for exercising any of that.
We do not sell or share personal information as those terms are defined in the Act, and we don't use it for cross-context behavioural advertising. There's no opt-out to offer, because there's nothing to opt out of.
We don't collect sensitive personal information as the Act defines it. To make a request, use the email address above.
Canadian customers
We ship to Canada, so information about Canadian customers is handled in line with PIPEDA. That information is stored in the United States and is subject to US law, including lawful access requests by US authorities. Placing an order means you're content with that.
Security
The site is served over HTTPS. Order records sit in a database that isn't reachable from the web, and administrative access needs a password. Card details, as above, we simply never hold — the most effective security measure available to a shop our size.
No system is perfect. If there were ever a breach affecting your information, we'd tell you and the relevant authorities as the law requires.
Changes
If this policy changes we'll update the date at the top. Anything substantial — a new category of data, a new company seeing it — we'll say plainly rather than quietly reword.