Effective date: October 29, 2026

This Privacy Policy explains how Body Love Group, Inc. ("Vitalura Labs," "we," "us," or "our") collects, uses, shares, and protects personal information when you visit vitaluralabs.com (the "Site"), buy our products, subscribe to deliveries, sign up for our emails, or contact us. It also explains your privacy rights and how to use them.

Your Privacy Choices: to opt out of the "sale" or "sharing" of your personal information and targeted advertising, visit https://vitaluralabs.com/pages/data-sharing-opt-out, or email support@vitaluralabs.com with the subject "Do Not Sell or Share." You can also use the browser and industry opt-out tools described in Sections 3 and 5.

Notice at Collection (summary)

We collect the categories of personal information listed in Section 1 for the purposes listed in Section 2. We "sell" or "share" (as those terms are defined under California and other US state laws) identifiers and internet activity with advertising partners such as Meta and Google, for targeted ("cross-context behavioral") advertising. You can opt out at any time on our data sharing opt-out page (https://vitaluralabs.com/pages/data-sharing-opt-out), by emailing us, or by using the browser and industry opt-out tools described in Section 5. We do not sell or share information we know belongs to anyone under 16. We keep each category for the periods described in Section 10. Full details are below.

1. Information we collect

We collect personal information in three ways: from you, automatically when you use the Site, and from third parties.

Category	Examples	Source
Identifiers and contact details	Name, email address, phone number, billing and shipping address, customer account login, order number	You
Order and commercial information	Products bought or viewed, cart contents, order history, subscription plan and delivery schedule, returns, discount codes, gift cards	You; our platform and subscription providers
Payment information	Payment method type, last four digits, billing address. Full card numbers are handled by our payment processors (Shopify Payments, PayPal, Sezzle and other checkout options), not stored by us. If you choose Sezzle, Sezzle collects the information it needs to offer you financing under its own privacy policy.	You; payment processors
Customer support and communications	Messages, chat transcripts, emails, call notes, survey answers, product reviews and photos you submit	You (via Zendesk chat or email, Judge.me reviews, post-purchase surveys)
Quiz and preference answers	Answers to our product-finder quiz (for example, your goals and product preferences), email preferences	You
Device and online activity	IP address, browser and device type, operating system, language, time zone, pages viewed, products viewed, search terms, referring URL, clicks, scrolling and mouse movements (heatmaps and session recordings), cookie and pixel IDs	Automatically, via cookies, pixels, and similar tools (Section 3)
Approximate location	Country, state or city inferred from your IP address or shipping address	Automatically; you
Marketing and advertising information	Whether you opened or clicked our emails, ad interactions, audience and campaign information	Automatically; our email providers and advertising partners
Inferences	Likely product interests and preferences based on the above	Derived by us and our service providers
Affiliate and referral information	Referral codes or links you used; for affiliates, your name, contact and payout details	You; our affiliate platform

Health-related information. We do not ask you for medical information to buy our products. If you choose to tell us about a health condition, pregnancy, allergy, or a reaction to a product (for example, in a support message), we use it only to respond to you, to handle a product complaint or adverse-event report, and to meet our legal obligations. We do not use it for advertising. See Section 8.

If you don't provide information. Some information (like your name, address, and payment details) is needed to process an order. If you don't provide it, we can't complete the purchase.

2. How we use your information

We use personal information to:

·       Process and deliver orders: take payment, ship products through our fulfillment partners (Fluffle for US orders, using ShipStation shipping software; ShipBob for Canadian orders) and shipping carriers, send order and shipping updates, handle returns and refunds.

·       Run subscriptions: manage recurring deliveries, charges, skips, and cancellations through Recharge.

·       Provide customer support: answer questions through chat and email, and handle product complaints.

·       Run and improve the Site: keep it working and secure, remember your cart and preferences, understand how the Site is used, fix problems, and test new features.

·       Send marketing, where permitted: emails (Klaviyo and Mailchimp). See Section 12.

·       Show advertising: measure our ads and show you relevant ads on other sites and apps (for example, on Meta and Google), subject to your choices in Sections 3 and 5.

·       Show reviews and widgets: collect and display product reviews (Judge.me) and Site widgets (Elfsight).

·       Run promotions and our affiliate program.

·       Prevent fraud and protect our business: screen orders for fraud, enforce our Terms of Service, and protect our rights and the safety of others.

·       Meet legal obligations: tax, accounting, product-safety, and consumer-protection requirements, and responding to lawful requests.

·       Business transfers: as part of a merger, acquisition, financing, or sale of assets (see Section 4).

We may also create de-identified or aggregated information that can't reasonably identify you. We keep it in that form and don't try to re-identify it.

Automated decisions. We do not make decisions about you that have legal or similarly significant effects based only on automated processing. Shopify and our payment providers use automated fraud-screening tools (for example, temporarily blocking repeated failed payment attempts) to protect transactions.

3. Cookies, pixels, and similar technologies

Cookies are small files stored in your browser. Pixels, tags, and scripts are small pieces of code that send information to us or to our partners when you load a page or take an action. We group them as follows:

Category	What it does	Examples on our Site	Consent
Strictly necessary	Makes the store work: cart, checkout, login, security, fraud prevention, remembering your privacy choices	Shopify cookies (e.g., cart, _shopify_essential, _secure_session_id, _tracking_consent, localization), Recharge subscription widget, Sezzle checkout, hCaptcha on forms	Always on
Preferences / functional	Remembers choices and powers optional features	Zendesk chat (__zlcmid), Elfsight widgets, Judge.me review widgets	Where the law requires it (for example, in the EEA, UK, and Switzerland), we use these only with your consent, which you can give or decline in the cookie banner shown on our Site
Analytics	Helps us understand how visitors use the Site	Shopify analytics (e.g., _shopify_y, _shopify_s), Google Analytics 4 (_ga, _ga_*), Crazy Egg heatmaps and session recordings (e.g., _ce.s, cebs)	Where the law requires it (for example, in the EEA, UK, and Switzerland), only with your consent, which you can give or decline in the cookie banner shown on our Site. US: on by default
Marketing / advertising	Measures ads and shows you relevant ads on other sites; builds email audiences	Meta Pixel and Conversions API (_fbp, _fbc), Google Ads (_gcl_au), Klaviyo (__kla_id), Mailchimp, Shopify marketing cookies (_shopify_marketing), affiliate referral cookies	Where the law requires it (for example, in the EEA, UK, and Switzerland), only with your consent, which you can give or decline in the cookie banner shown on our Site. US: on by default; you can opt out (Section 5)

Names and lifetimes change as vendors update their tools. Shopify's current cookie list is at https://www.shopify.com/legal/cookies. Most cookies we use last from the end of your browsing session up to two years.

Your cookie choices. Our store runs on Shopify and uses Shopify's cookie banner. Where the banner is shown to you (for example, if you visit from the EEA, UK, or Switzerland), you can accept, decline, or manage your cookie preferences in the banner, and non-essential cookies and pixels are used only according to your choice. You can change your choice later through the cookie preferences in the banner. You can also block or delete cookies in your browser at any time, use the tools below, or email support@vitaluralabs.com and we will help. US visitors can opt out of advertising cookies and other "sale"/"sharing" as described in Section 5.

Mobile and browser controls. You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop the cart or checkout from working. Industry opt-out tools: Digital Advertising Alliance (https://optout.aboutads.info), Network Advertising Initiative (https://optout.networkadvertising.org), Google Ads Settings (https://adssettings.google.com), Meta ad preferences (https://www.facebook.com/adpreferences), Google Analytics opt-out add-on (https://tools.google.com/dlpage/gaoptout).

Third-party content. Some pages load fonts, scripts, and libraries from third-party servers (for example, Google Fonts and public code libraries). Those providers receive your IP address and browser information when the content loads.

Do Not Track. Browsers' "Do Not Track" setting has no agreed standard, so we don't respond to it. We respond to Global Privacy Control signals as described in Section 5.

4. How we share your information

We share personal information with:

·       Service providers (processors) who work for us under contract and may only use the information to provide services to us. These include:

·       E-commerce and payments: Shopify (store platform, checkout and hosting), Shopify Payments, PayPal, Sezzle, Recharge (subscriptions).

·       Fulfillment and shipping: Fluffle (warehousing and fulfillment of US orders) and ShipStation (the shipping software Fluffle uses with us); ShipBob (warehousing and fulfillment of Canadian orders only); and shipping carriers (such as USPS, UPS, FedEx, and Canada Post).

·       Email and support: Klaviyo, Mailchimp, Zendesk.

·       Reviews, surveys, and site features: Judge.me, KnoCommerce (post-purchase surveys), RevenueHunt (product quiz), Elfsight (widgets), back-in-stock alert tools, hCaptcha (spam protection).

·       Analytics: Google Analytics, Crazy Egg, Lifetimely (profit analytics).

·       Affiliate program: UpPromote.

·       Professional advisers: accountants, lawyers, and auditors.

·       Advertising partners, such as Meta (Facebook and Instagram) and Google, which receive device and online-activity information and, for ad measurement and audiences, may receive hashed contact details and purchase events. These partners may combine it with information they already have and use it under their own privacy policies. Under some US state laws this is a "sale" or "sharing" of personal information. You can opt out (Section 5).

·       Payment-option providers you choose, such as Sezzle or PayPal, which act under their own privacy policies.

·       Legal and safety: courts, regulators, law enforcement, or others when required by law, to respond to lawful requests, to report adverse events where required, or to protect rights, property, and safety.

·       Business transfers: a buyer, successor, or financing party in a merger, acquisition, reorganization, or sale of assets. This includes our affiliates under common control by Body Love Group, Inc. (for example, Bodylura), only as described in this policy.

·       Bodylura (an affiliate under common control): when we run a joint offer or verify membership between Vitalura Labs and Bodylura, we exchange your email address, name, and customer or membership status (for example, whether you are a Vitalura Labs customer or subscriber, and whether you have an active Bodylura membership) so each brand can confirm eligibility and send you related offers.

·       With your direction or consent: for example, when you post a public review.

We do not sell or rent your email address or phone number to other companies for their own marketing.

5. Your privacy choices: "Do Not Sell or Share" and targeted advertising

Some US state laws treat our use of advertising cookies and pixels (Meta and Google) as a "sale" or "sharing" of personal information, or as "targeted advertising." You have the right to opt out, and we honor that right for all US visitors.

How to opt out:

1.     Data sharing opt-out page: visit https://vitaluralabs.com/pages/data-sharing-opt-out and follow the instructions to opt out for the device and browser you are using.

2.     Email (alternative): write to support@vitaluralabs.com with the subject "Do Not Sell or Share." We will apply your opt-out to the email address you write from and to any customer account linked to it, and tell you when it is done. (Because the ad tools on our Site work through cookies, you may also need to use browser controls on each device.)

3.     Global Privacy Control (GPC): if you visit our Site with a GPC signal enabled, then, depending on where you are, we treat it as a request to opt out of "sale" or "sharing" and targeted advertising for the device and browser you use. Our store platform, Shopify, honors GPC automatically in the regions where our data sharing opt-out is enabled. If you want to be sure your opt-out is recorded, also use the opt-out page or email us.

4.     Browser and industry tools: block or delete cookies in your browser, and use the Digital Advertising Alliance (https://optout.aboutads.info), Network Advertising Initiative (https://optout.networkadvertising.org), Google Ads Settings (https://adssettings.google.com), and Meta ad preferences (https://www.facebook.com/adpreferences).

Because cookies are tied to a browser, you need to opt out on each browser and device you use (unless you're logged in). If you clear your cookies, you may need to opt out again. Opting out doesn't stop all ads; you may still see ads that aren't based on your activity across other sites.

6. US state privacy rights

This section applies to residents of California (CCPA as amended by the CPRA) and of other states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states as their laws take effect. Rights vary by state.

6.1 Your rights

Depending on where you live, you may have the right to:

·       Know / access the personal information we have about you, including the categories, sources, purposes, and the categories of third parties we disclose it to, and get a copy in a portable format.

·       Delete personal information we collected from you.

·       Correct inaccurate personal information.

·       Opt out of the sale or sharing of personal information and of targeted advertising (Section 5).

·       Opt out of profiling that produces legal or similarly significant effects. We don't do this kind of profiling.

·       Limit the use of sensitive personal information (California). We only use sensitive personal information (such as account login credentials) for purposes allowed by law, so this right doesn't change how we process it.

·       Get a list of the specific third parties we have disclosed your personal information to (Oregon and Minnesota residents) or of the categories of third parties (Delaware residents).

·       Non-discrimination: we will not deny you products, charge you a different price, or give you a lower quality of service because you used your rights. (Loyalty or discount programs work as described in Section 6.5.)

6.2 Categories of personal information (last 12 months)

Category (CCPA)	Collected?	Sources	Business purposes	Disclosed for a business purpose to	"Sold" or "shared" to
Identifiers (name, email, phone, address, IP address, cookie/device IDs, account name)	Yes	You; automatically; partners	Orders, subscriptions, support, marketing, analytics, security	Service providers (Section 4)	Advertising partners (cookie/device IDs, IP address, hashed email or phone)
Customer records (Cal. Civ. Code §1798.80(e)) (name, address, phone, limited payment details)	Yes	You; payment processors	Orders, payments, support	Payment, fulfillment, and platform providers	No
Commercial information (products viewed, bought, subscribed to)	Yes	You; automatically	Orders, subscriptions, marketing, analytics	Service providers	Advertising partners (purchase and product-view events)
Internet or network activity (browsing, search, interactions, heatmaps, session recordings)	Yes	Automatically	Analytics, site improvement, advertising, security	Analytics providers	Advertising partners
Approximate geolocation (from IP or address)	Yes	Automatically; you	Shipping, tax, fraud prevention, analytics, regional settings	Service providers	Advertising partners (IP-based region)
Audio, electronic, visual (review photos, chat transcripts)	Yes, if you provide	You	Support, reviews	Zendesk, Judge.me	No
Inferences (interests, preferences)	Yes	Derived	Marketing, personalization	Email and analytics providers	Advertising partners may draw their own inferences
Sensitive personal information (account login and password)	Yes	You	Account access and security only	Shopify	No
Professional, education, biometric, precise geolocation	No	–	–	–	–

We collect these categories for the business and commercial purposes in Section 2. Retention periods are in Section 10. We do not knowingly sell or share personal information of consumers under 16.

6.3 How to submit a request

·       Email: support@vitaluralabs.com (subject: "Privacy Request")

·       Opt out of sale/sharing: https://vitaluralabs.com/pages/data-sharing-opt-out, or email support@vitaluralabs.com with the subject "Do Not Sell or Share" (see Section 5)

Verification. For requests to know, delete, or correct, we'll ask you to confirm information we already have (for example, your email address and a recent order number) and may send a confirmation link to your email. We'll use the information you give us only to verify and respond. Opt-out requests don't need verification.

Authorized agents. You may use an authorized agent. We may ask the agent for signed permission from you and ask you to verify your identity directly with us, unless the agent has a valid power of attorney.

Timing. We confirm receipt within 10 business days and respond within 45 days. If we need more time (up to another 45 days), we'll tell you why.

6.4 Appeals

If we deny your request, you can appeal by emailing support@vitaluralabs.com with the subject "Privacy Appeal" within a reasonable time after our decision. We'll respond within the time required by your state's law (usually 45–60 days). If you're not satisfied, you can contact your state Attorney General (for example, Virginia, Colorado, Connecticut, or Texas) or, in California, the California Privacy Protection Agency (https://cppa.ca.gov).

6.5 Notice of financial incentive

We offer a welcome discount when you join our email list: our website sign-up pop-up currently offers 10% off ("You've Got 10% OFF — sign up for email to receive your discount"), and we send the discount to the email address you provide. To join, you provide your email address. The value of your information to us is a reasonable estimate based on the cost of the offer and the expected value of marketing to subscribers, which is roughly equal to the value of the discount. Joining is optional, and you can unsubscribe at any time (Section 12), which ends the program for you.

6.6 Other California notices

·       Shine the Light (Cal. Civ. Code §1798.83): we don't share personal information with third parties for their own direct marketing, as defined by that law.

7. EEA, UK, and Swiss visitors (GDPR and UK GDPR)

Controller. Body Love Group, Inc. (address in Section 15) is the controller of your personal information.

If you are in the EEA or UK and have a question about how we handle your personal information, contact us using the details in Section 15.

7.1 Legal bases

Purpose	Legal basis
Processing orders, payments, subscriptions, delivery, account management	Performance of a contract
Customer support	Contract; legitimate interests (helping customers)
Non-essential cookies and pixels (analytics, preferences, marketing), session recordings	Consent, where required
Marketing emails	Consent (or, where allowed, legitimate interests for similar products you've bought, with an easy opt-out)
Site security, fraud prevention, improving our products	Legitimate interests
Tax, accounting, product-safety and legal obligations	Legal obligation

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details.

7.2 International transfers

We are based in the United States, and most of our service providers process data in the US. When we transfer personal information from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, plus additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

7.3 Your rights

You have the right to: access your data; correct it; erase it; restrict or object to processing (including an absolute right to object to direct marketing); data portability; withdraw consent at any time (this doesn't affect earlier processing); and not be subject to decisions based solely on automated processing that significantly affect you. To use these rights, contact us (Section 15). We'll respond within one month (extendable by two months for complex requests).

Complaints. You can complain to your local data protection authority. A list of EU authorities is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, contact the Information Commissioner's Office (https://ico.org.uk). In Switzerland, contact the FDPIC (https://www.edoeb.admin.ch). We'd appreciate the chance to address your concern first.

8. Supplements and health information

Vitalura Labs sells dietary supplements and related products. Information on our Site, in our emails, quizzes, guides, and support replies is for general information only and is not medical advice. It is not meant to diagnose, treat, cure, or prevent any disease. These statements have not been evaluated by the Food and Drug Administration. Talk to your doctor before using supplements, especially if you are pregnant or nursing, take medication, or have a medical condition.

Our product quiz asks about goals and preferences, not medical conditions. Please don't send us medical records or detailed health information. If you tell us about a health condition or a reaction to a product, we use that information only to help you, investigate the product issue, and meet legal obligations (for example, recording and, where required, reporting serious adverse events to the FDA, which requires us to keep those records for six years). We don't use it for advertising, and we don't sell it.

Washington, Nevada, and other consumer health data laws. If any information we collect counts as "consumer health data" under Washington's My Health My Data Act or similar laws in Nevada or other states, we process it only as needed to provide the product or service you asked for, or with your consent, and we never sell it. You can ask to access or delete it, or withdraw consent, using the methods in Section 15.

9. Canada

If you are in Canada, we handle your personal information under applicable Canadian privacy law (including PIPEDA and, for Quebec residents, Law 25). Your information may be stored and processed in the United States, where it may be accessible to US authorities under US law. You can ask to access or correct your information, or withdraw consent, by contacting us (Section 15).

10. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy:

Information	Retention
Orders, invoices, payment and tax records	7 years after the order (tax and accounting law)
Customer account	Until you delete your account, or 3 years after your last activity
Subscription records	For the life of the subscription, then 7 years for billing records
Customer support messages	3 years after the conversation closes
Adverse-event reports and product complaints	At least 6 years (FDA requirements)
Marketing lists (email)	Until you unsubscribe; we keep a suppression record so we don't contact you again
Analytics, cookie, and pixel data	Up to 26 months (or the cookie's lifetime, if shorter)
Session recordings and heatmaps	Up to 12 months
Privacy request records	24 months (as required by California law)

We may keep information longer if required by law or to resolve disputes, and we delete or de-identify it afterwards.

11. Security

We use reasonable administrative, technical, and physical safeguards, including encrypted (HTTPS) connections, PCI-compliant payment processing by our checkout providers, access controls, and vendor contracts that require security measures. No system is 100% secure, so we can't guarantee absolute security. Keep your account password private. If a data breach affects your personal information, we'll notify you and regulators as the law requires.

12. Marketing emails and your choices

·       Email: we send marketing emails through Klaviyo and Mailchimp if you sign up or, where allowed, after you buy from us. Every email has an unsubscribe link. You can also email support@vitaluralabs.com. We'll still send order, shipping, and subscription messages.

·       Ads: see Sections 3 and 5.

13. Children

The Site and our products are intended for adults 18 and older. We don't knowingly collect personal information from children under 13, and we don't knowingly sell or share personal information of anyone under 16. If you believe a child has given us personal information, contact us at support@vitaluralabs.com and we'll delete it.

14. Changes to this policy

We may update this policy as our practices or the law change. We'll post the new version here and update the effective date. If we make material changes, we'll give you notice (for example, by email or a notice on the Site) and ask for your consent where the law requires it.

15. Contact us

Body Love Group, Inc. (Vitalura Labs)
901 South MoPac Expressway, Building 1, Suite 300
Austin, TX 78746, United States
Email: support@vitaluralabs.com
Privacy choices and opt-outs: https://vitaluralabs.com/pages/data-sharing-opt-out, or email support@vitaluralabs.com (subject: "Do Not Sell or Share")

If you have a disability, you can ask for this policy in another format by emailing us.