GORA

Fine Print

Privacy Policy

Effective date: July 30, 2026

1. Who We Are & What This Policy Covers

This Privacy Policy describes how GORA RITUALS LLC ("GORA," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit gorarituals.com, browse our ingredient library, subscribe to our emails, contact us, or purchase our products (collectively, the "Services"). It also explains the choices and rights you have over your information, including rights under the EU/UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other applicable privacy laws.

By using the Services, you acknowledge this Policy. If you do not agree with it, please do not use the Services. This Policy does not cover third-party websites we link to, including our checkout hosted by Shopify, which is additionally governed by Shopify's own privacy practices.

2. Information We Collect

Information you provide directly:

  • Order information — name, shipping and billing address, email address, phone number, and payment details when you make a purchase. Payment card details are processed by our payment processors (e.g., Shopify Payments, Shop Pay, PayPal, Apple Pay, Google Pay) and are never stored on our servers.
  • Newsletter information — your email address and communication preferences when you subscribe to updates.
  • Contact information — your name, email address, and the contents of your message when you write to us.
  • Account information — details associated with any customer account, including purchase history and preferences.

Information collected automatically:

  • Device and usage data — IP address, browser type and version, operating system, device identifiers, referring pages, pages viewed, products viewed, searches performed, items added to cart, time spent, clicks, and similar interaction data.
  • Cookies and similar technologies — cookies, pixels, tags, local storage, and software development kits placed by us and by our analytics and advertising partners (see Sections 4 and 5).
  • Approximate location — inferred from your IP address, used for currency, shipping estimates, fraud prevention, and regional compliance.

3. How We Use Your Information

  • To process, fulfill, and deliver your orders, including sending order confirmations, shipping notifications, and receipts.
  • To send marketing emails and updates when you have opted in, which you can unsubscribe from at any time.
  • To respond to your inquiries and provide customer support.
  • To personalize your experience, including showing relevant products and remembering your cart.
  • To measure and improve the Services — understanding which products, pages, and features people use.
  • To advertise our products, including personalized and retargeted advertising on third-party platforms (see Section 4).
  • To detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms of Use.
  • To comply with legal obligations, including tax, accounting, consumer protection, cosmetic safety reporting, and lawful requests from authorities.

Legal bases (EEA/UK): where GDPR applies, we process your data on the bases of (a) contract performance — fulfilling your orders and providing the Services; (b) consent — marketing emails and non-essential cookies/advertising, which you may withdraw at any time; (c) legitimate interests — analytics, security, fraud prevention, and improving the Services, balanced against your rights; and (d) legal obligation — where processing is required by law.

4. Advertising & Tracking

We advertise on third-party platforms and use their technologies to measure and personalize those ads. Specifically, we use — and may in the future use — services from Meta (Facebook and Instagram, including the Meta Pixel and Custom Audiences), Google (Google Ads, Google Analytics 4, and Google Tag Manager), TikTok (TikTok Pixel and Events API), and similar advertising and analytics platforms. These tools may collect device identifiers, browsing activity on our site (such as products viewed, carts, and purchases), and hashed contact information (such as a hashed email address) to show you relevant ads on those platforms and to measure ad performance.

We do not sell your personal information for money. However, some disclosures to advertising platforms for cross-context personalized advertising may be considered a "sale" or "sharing" under the CCPA, or "targeted advertising" under other U.S. state laws. You have the right to opt out of such sharing — see Sections 10 and 11.

You can also limit personalized advertising directly with the platforms:

  • Google: adssettings.google.com and the Google Analytics opt-out browser add-on.
  • Meta: Settings → Ad preferences on Facebook/Instagram.
  • TikTok: Settings → Ads personalization.
  • Industry tools: youradchoices.com, optout.networkadvertising.org, and youronlinechoices.eu (EU).

5. Cookies & Similar Technologies

We use the following categories of cookies and similar technologies:

  • Strictly necessary — required for the site and cart/checkout to function (e.g., the Shopify cart session). These cannot be switched off.
  • Analytics — help us understand how the Services are used (e.g., Google Analytics 4, Google Tag Manager, Shopify analytics).
  • Advertising — used by us and our advertising partners to deliver and measure personalized ads (e.g., Meta Pixel, Google Ads tags, TikTok Pixel).
  • Preferences — remember your choices, such as dismissed prompts and region settings.

You can control cookies through your browser settings (blocking or deleting cookies), through the platform tools listed in Section 4, and — where a consent banner is shown in your region — through the preferences you select there. Blocking some cookies may affect site functionality, including checkout.

6. How We Share Information

We do not sell your personal information for money, and we do not share it with third parties for their own independent marketing. We share personal information only with:

  • Service providers / processors — companies that operate parts of the Services on our behalf under contractual confidentiality and data-protection obligations: Shopify (store, checkout, order management, email), payment processors, shipping and fulfillment partners, our manufacturing and quality partners where required for safety inquiries, cloud infrastructure (e.g., Amazon Web Services), email delivery providers, analytics providers, and customer support tools.
  • Advertising partners — as described in Section 4, for personalized advertising and measurement (subject to your opt-out rights).
  • Legal and safety — where required by law, subpoena, or court order; to enforce our Terms; or to protect the rights, safety, and property of GORA RITUALS LLC, our customers, or others.
  • Business transfers — in connection with a merger, acquisition, financing, or sale of assets, in which case this Policy will continue to apply to your information.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your own — including the United States — where our service providers operate. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, adequacy decisions, or our providers' participation in the EU–U.S. Data Privacy Framework, as applicable.

8. Data Retention

We keep personal information only as long as needed for the purposes described in this Policy: order records for as long as required for tax, accounting, product-safety, and warranty purposes; marketing data until you unsubscribe or ask us to delete it; support messages for as long as needed to resolve your inquiry; and analytics data per our providers' retention settings. When data is no longer needed, we delete or anonymize it.

9. Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data — including encryption in transit (HTTPS), access controls, and reputable PCI-DSS-compliant payment processors. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security; please protect your own account credentials.

10. Your Rights (EEA, UK & Worldwide)

Depending on your location, you may have the right to:

  • Access the personal data we hold about you and receive a copy (data portability).
  • Correct inaccurate or incomplete data.
  • Delete your data ("right to be forgotten"), subject to legal retention requirements.
  • Restrict or object to processing, including processing based on legitimate interests.
  • Withdraw consent at any time (e.g., unsubscribe from marketing), without affecting prior processing.
  • Opt out of personalized/targeted advertising.
  • Lodge a complaint with your local supervisory authority (in the EEA/UK, your national Data Protection Authority).

To exercise any right, email us at hello@gorarituals.com and tell us which right you want to exercise. We will verify your request and respond within the timeframe required by applicable law (one month under GDPR, 45 days under CCPA, extendable where permitted). We will never discriminate against you for exercising your rights.

11. California Privacy Rights (CCPA/CPRA)

In the preceding 12 months we have collected the following categories of personal information: identifiers (name, email, address, phone, IP); commercial information (purchases and carts); internet activity (browsing and interaction data); and approximate geolocation. We collect them from you directly and automatically via cookies and pixels, for the purposes in Section 3. We disclose identifiers and commercial information to service providers, and we "share" identifiers and internet activity with advertising platforms for cross-context behavioral advertising as described in Section 4. We do not collect or process sensitive personal information for the purpose of inferring characteristics, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

California residents have the right to:

  • Know what personal information we collect, use, disclose, and share.
  • Delete personal information, subject to exceptions.
  • Correct inaccurate personal information.
  • Opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising.
  • Not be discriminated against for exercising these rights.

To opt out of sharing, email hello@gorarituals.com with the subject "Do Not Sell or Share My Personal Information," and use the platform controls in Section 4. We honor the Global Privacy Control (GPC) browser signal as an opt-out of sale/sharing where required by law. Authorized agents may submit requests on your behalf with proof of authorization. California's "Shine the Light" law (Civil Code §1798.83) requests can be made through the same channel.

Residents of other U.S. states with privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon) have similar rights of access, deletion, correction, and opt-out of targeted advertising, exercisable through the same channel. If we deny your request, you may appeal by replying to our decision, and we will respond as required by your state's law.

12. Children's Privacy

The Services are not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where that is the applicable threshold). Purchases must be made by adults. If you believe a child has provided us personal information, email hello@gorarituals.com and we will delete it.

13. Do Not Track & Marketing Choices

Except for the GPC signal described in Section 11, we do not currently respond to browser "Do Not Track" signals, as no consistent industry standard exists. Every marketing email we send contains an unsubscribe link; unsubscribing stops marketing messages but not transactional emails about your orders.

14. Changes to This Policy

We may update this Policy from time to time. The "Effective date" above reflects the latest revision. Material changes will be announced on the site or by email where required. Your continued use of the Services after changes take effect constitutes acceptance of the revised Policy.

15. How to Contact Us

For any privacy question, request, or complaint, contact GORA RITUALS LLC at hello@gorarituals.com. If GDPR applies to you and you are unsatisfied with our response, you may contact your local Data Protection Authority.