Privacy Policy | Herbal Haven DIY

Herbal Haven DIY LLC — Privacy Policy

Effective Date: July 30, 2026
Last Updated: July 30, 2026
Contact Email: herbalhavendiy@herbalhavendiyllc.com
Website: www.herbalhavendiyllc.com

Table of Contents
1. Introduction & Developer Identification
2. Scope of This Policy
3. Data We Collect
4. How We Collect Data
5. How We Use Your Data
6. Data Sharing & Disclosure
7. Third-Party SDK Disclosures
8. App Set ID
9. Prominent Disclosure — Sensitive Data & Permissions
10. Security Practices
11. Data Retention & Deletion
12. Account Deletion Procedures
13. EU / UK / Swiss Data Protection Compliance (GDPR, UK GDPR, nFADP)
14. U.S. State Privacy Rights
15. Children's Privacy
16. Cookies & Tracking Technologies
17. Changes to This Privacy Policy
18. Contact Information

1. Introduction & Developer Identification
Herbal Haven DIY LLC ("Company," "we," "us," or "our") is the developer and data controller of the Herbal Haven mobile application (the "App") and the associated website located at www.herbalhavendiyllc.com (the "Website"). The App is distributed through the Google Play Store and is designed to provide users with herbal do-it-yourself products, recipes, educational content, and related services.

This Privacy Policy ("Policy") is intended to inform you — the user ("you" or "your") — about how we collect, use, store, share, and protect your personal information when you access or use our App, Website, or any related digital properties operated by Herbal Haven DIY LLC. It also describes the rights you hold with respect to your personal data and how you may exercise them.

We are committed to transparency and to respecting your privacy in compliance with applicable law, including the requirements of the Google Play Developer Program Policies. By using the App or Website, you acknowledge that you have read and understood this Policy.

If you have questions or concerns about this Policy or our data practices, please contact us at herbalhavendiy@herbalhavendiyllc.com.

2. Scope of This Policy
This Policy applies to all personal and non-personal information collected through the following digital properties owned and operated by Herbal Haven DIY LLC:
• The Herbal Haven Website at www.herbalhavendiyllc.com;
• The Herbal Haven Android Application, available on the Google Play Store; and
• Any future applications, platforms, or digital services operated by Herbal Haven DIY LLC that link to or reference this Policy.

This Policy does not apply to third-party websites, services, or applications that may be linked from our App or Website. We are not responsible for the privacy practices of such third parties and encourage you to review their respective privacy policies independently.

Acknowledgment of Policy: By accessing or using the App or Website, you acknowledge that you have read, understood, and agree to the data practices described in this Policy. If you do not agree with the terms of this Policy, you must discontinue use of our digital properties immediately.

3. Data We Collect
We collect various categories of personal and non-personal data in connection with your use of our App and Website. The categories, illustrative examples, primary purposes, and general retention periods are set forth in the table below, followed by additional narrative detail.

Data Category: Account / Registration Data
Examples: Full name, email address, hashed password, username
Purpose: Account creation, authentication, user identification
Retention Period: Duration of account + 12 months after closure

Data Category: Usage Data
Examples: Pages/screens visited, features used, session duration, click events, error logs, crash reports
Purpose: Service improvement, analytics, debugging
Retention Period: Up to 26 months; crash logs up to 90 days

Data Category: Device Data
Examples: Device type and model, operating system version, unique device identifiers, IP address
Purpose: Technical support, security, analytics, fraud prevention
Retention Period: Up to 26 months

Data Category: Location Data
Examples: General/coarse location (e.g., city, region); precise GPS location only if explicitly granted by user
Purpose: Localized content, regional compliance, fraud prevention
Retention Period: Session-based or up to 26 months (aggregated)

Data Category: User-Generated Content
Examples: Product reviews, herb/plant photos submitted by users, comments, ratings
Purpose: Community features, product improvement, content display
Retention Period: Duration of account; deleted upon account deletion request

Data Category: Communications Data
Examples: Messages submitted via contact forms, in-app support tickets, email correspondence
Purpose: Customer support, responding to inquiries
Retention Period: 3 years from last interaction

Data Category: Payment Data
Examples: Payment method type (card type); transaction reference numbers
Purpose: Order processing and confirmation
Retention Period: 7 years (financial/legal compliance); full card data never stored by us

Data Category: App Set ID
Examples: Android App Set ID (non-persistent, resettable, device-scoped identifier provided by Google Play Services)
Purpose: Analytics, fraud prevention, session tracking
Retention Period: Up to 26 months; resets upon user action

Data Category: Cookies & Tracking Technologies
Examples: Session cookies, persistent cookies, analytics pixels, local storage tokens
Purpose: Site functionality, user preferences, analytics, marketing (with consent)
Retention Period: Session cookies: deleted on browser close; persistent: up to 24 months

3.1 Account and Registration Data
When you create an account with Herbal Haven DIY LLC, we collect your name, email address, and a hashed (encrypted) version of your password. We do not store passwords in plain text under any circumstances.

3.2 Usage Data
We automatically collect information about how you interact with our App and Website, including the screens or pages you visit, features you use, time spent on the platform, and technical logs including crash reports. This data is collected to help us improve the functionality and stability of our services.

3.3 Device Data
We collect technical information about the device you use to access our services, including the device type, manufacturer, operating system version, and unique device identifiers. We also collect your Internet Protocol (IP) address, which may be used to infer approximate geographic location.

3.4 Location Data
We may collect general or coarse location data (such as your city or region) derived from your IP address. Precise location data (GPS-level) is collected only if you explicitly grant the relevant permission through your device's operating system settings. You may revoke location permissions at any time through your device settings.

3.5 User-Generated Content
If you submit content through our App or Website — including product reviews, photographs of herbs or plants, or comments — we collect and store that content as part of our services. You retain ownership of content you submit, but grant us a non-exclusive license to display and use it in connection with our services.

3.6 Communications Data
When you contact us through our Website contact form, in-app support system, or by email, we collect the content of your communications and any personal information you include therein, for the purpose of responding to your inquiry and maintaining a record of our communications.

3.7 Payment Data
All payment transactions are processed by third-party payment processors (such as Stripe or a comparable provider). Herbal Haven DIY LLC does not receive, process, or store full payment card numbers, CVV codes, or other sensitive payment credentials. We may receive transaction reference numbers and payment method type (e.g., "Visa ending in 4242") for order confirmation and customer service purposes.

3.8 App Set ID
Our Android App utilizes the Android App Set ID, a non-persistent, resettable identifier provided by Google Play Services. Please refer to Section 8 of this Policy for a full description of the App Set ID, its uses, and your rights with respect to it.

3.9 Cookies and Tracking Technologies
Our Website uses cookies and similar tracking technologies. Please refer to Section 16 of this Policy for a detailed description of our cookie practices.

4. How We Collect Data
We collect personal and non-personal data through three primary means:

4.1 Directly From You
We collect data that you actively provide to us, including when you register for an account, complete a purchase, submit a contact form, post a review, or communicate with our support team. This collection occurs only when you voluntarily supply the information.

4.2 Automatically
We automatically collect certain data through analytics software development kits (SDKs), cookies, device telemetry, and similar technologies when you use our App or visit our Website. This includes usage patterns, device information, crash logs, and session data. Such automatic collection begins as soon as you launch the App or visit the Website.

4.3 From Third-Party Services
We may receive data about you from third-party services that you use in connection with our platform, including:
• Social Login Providers (e.g., Google Sign-In): If you choose to authenticate using a third-party identity provider, we receive basic profile information (such as name and email address) from that provider, subject to the permissions you have granted;
• Payment Processors: We receive transaction confirmation data (not payment credentials) from our payment processing partners; and
• Analytics and Advertising Platforms: We receive aggregated or pseudonymous analytics data from analytics SDK providers as described in Section 7.

5. How We Use Your Data
We use the personal and non-personal data we collect for the following purposes, each supported by the legal basis indicated:

Purpose of Processing: Providing and operating the App and Website services
Legal Basis: Performance of contract; legitimate interests

Purpose of Processing: Personalizing your user experience (e.g., saving preferences, recommending content)
Legal Basis: Legitimate interests; consent (where required)

Purpose of Processing: Processing orders and transactions
Legal Basis: Performance of contract

Purpose of Processing: Sending transactional communications (order confirmations, password resets, service alerts)
Legal Basis: Performance of contract; legitimate interests

Purpose of Processing: Sending marketing and promotional communications
Legal Basis: Consent (opt-in required; opt-out available at any time)

Purpose of Processing: Analytics, product research, and service improvement
Legal Basis: Legitimate interests

Purpose of Processing: Security monitoring, fraud detection, and prevention
Legal Basis: Legitimate interests; legal obligation

Purpose of Processing: Legal compliance and enforcement of our Terms of Service
Legal Basis: Legal obligation; legitimate interests

Purpose of Processing: Responding to user inquiries and providing customer support
Legal Basis: Performance of contract; legitimate interests

Marketing Communications: We will only send you promotional or marketing communications where you have given us your express consent to do so. You may withdraw this consent and opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us at herbalhavendiy@herbalhavendiyllc.com. Opting out of marketing communications will not affect transactional or service-related communications.

No Automated Decision-Making with Legal Effects: We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on users, as contemplated by Article 22 of the GDPR, without first obtaining your explicit consent.

6. Data Sharing & Disclosure
Important Notice Regarding Sale of Personal Data
Herbal Haven DIY LLC does NOT sell, rent, or trade your personal data to any third party. We do not share your personal data for third-party advertising purposes without your explicit, affirmative consent.

We may share your personal data with third parties only in the limited circumstances described below:

6.1 Service Providers
We engage trusted third-party companies and individuals to perform services on our behalf, including web hosting, cloud infrastructure, analytics, payment processing, email delivery, and customer support. These service providers receive access to personal data only to the extent necessary to perform their designated services and are contractually prohibited from using such data for any other purpose. All service providers are required to execute data processing agreements consistent with applicable law.

6.2 Business Partners
We may share your data with selected business partners where you have given us explicit consent to do so. We will clearly identify such sharing at the point of collection and will not share your data with business partners without your affirmative opt-in consent.

6.3 Legal Authorities
We may disclose your personal data to governmental or regulatory authorities, law enforcement agencies, courts, or other official bodies where we are required to do so by applicable law, court order, legal process, or governmental regulation, or where we have a good-faith belief that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect the rights, property, or safety of Herbal Haven DIY LLC, our users, or the public; or (c) detect, prevent, or address fraud, security, or technical issues.

6.4 Business Transfers
In the event of a merger, acquisition, reorganization, sale of assets, or other similar corporate transaction involving Herbal Haven DIY LLC, personal data held by us may be transferred to the acquiring or successor entity as part of such transaction. In such an event, we will provide affected users with reasonable notice (including via in-app notification and/or email) prior to any such transfer and will require that the successor entity honor the terms of this Policy or provide a substantially equivalent level of protection.

6.5 Restriction on Advertising Data Sharing
We explicitly affirm that your personal data is never shared with advertising networks, data brokers, or marketing aggregators for the purpose of serving third-party advertisements or enabling cross-context behavioral advertising, without your explicit, separately obtained consent.

7. Third-Party SDK Disclosures
Our App and Website incorporate third-party software development kits (SDKs) that may collect data on our behalf. The following table identifies each SDK category currently integrated, the data it accesses, and the applicable privacy policy of the SDK provider.

SDK / Service Provider: Google Analytics / Firebase Analytics (Google LLC)
Data Accessed: Usage data, session data, screen views, device identifiers, App Set ID, IP address (anonymized)
Provider Privacy Policy: policies.google.com/privacy

SDK / Service Provider: Google Play Services (Google LLC)
Data Accessed: Core Android platform services; App Set ID provisioning; device integrity signals
Provider Privacy Policy: policies.google.com/privacy

SDK / Service Provider: Crashlytics (Firebase) (Google LLC via Firebase)
Data Accessed: Crash reports, stack traces, device model, OS version, App version, installation UUID
Provider Privacy Policy: policies.google.com/privacy

SDK / Service Provider: Payment Processor SDK (e.g., Stripe or comparable provider)
Data Accessed: Payment card data (tokenized and processed directly by the payment processor; card data is never transmitted to or stored by Herbal Haven DIY LLC); transaction reference data
Provider Privacy Policy: Provider's own privacy policy (provided at checkout)

SDK / Service Provider: Email Marketing SDK (e.g., Mailchimp or comparable provider)
Data Accessed: Email address, name, marketing preferences, email engagement data (open rates, click rates) — collected only with user consent
Provider Privacy Policy: Provider's own privacy policy

8. App Set ID
This section is provided in accordance with Google Play Developer Program Policies regarding the disclosure of the Android App Set ID.

8.1 What Is the App Set ID?
The App Set ID is a non-persistent, resettable, device-scoped identifier provided by Google Play Services to Android application developers. It is a pseudonymous identifier assigned to a specific app or group of apps by the same developer on a given device. Unlike a hardware device ID, the App Set ID is not tied to the physical device, is not unique across all apps on the device, and can be reset by the user at any time.

8.2 How We Use the App Set ID
Herbal Haven DIY LLC uses the App Set ID for the following limited purposes:
● Analytics: To measure aggregate usage patterns and app performance within our own application environment;
● Fraud Prevention: To identify and prevent fraudulent or abusive activity within our App; and
● Session Tracking: To maintain session continuity within a single device and app context.

8.3 What the App Set ID Is NOT Used For
We explicitly affirm the following with respect to the App Set ID:
● The App Set ID is NOT used for advertising, ad targeting, or ad personalization of any kind;
● The App Set ID is NOT used for cross-app tracking or to build profiles that span applications from different developers;
● The App Set ID is NOT shared with advertising networks, data brokers, or any third party for commercial advertising purposes; and
● The App Set ID is NOT combined with other identifiers to create a persistent cross-application user profile.

8.4 How to Reset the App Set ID
You may reset the App Set ID at any time through your Android device settings. Resetting the App Set ID will generate a new identifier and will break any analytics or session data linkage associated with the previous identifier. Resetting the App Set ID does not affect your account data or any other personal information stored by Herbal Haven DIY LLC.

9. Prominent Disclosure — Sensitive Data & Permissions

Google Play Prominent Disclosure Requirement
In accordance with the Google Play User Data Policy, Herbal Haven DIY LLC provides the following prominent disclosure regarding the collection of sensitive personal data. Prior to collecting any sensitive data category, you will be presented with a clear, conspicuous, in-app disclosure that explains what data is collected, why it is collected, how it will be used, and whether it will be shared with third parties.

9.1 In-App Disclosure Commitment
Before any sensitive data is accessed or collected, Herbal Haven DIY LLC will present you with an in-app disclosure notice that:
● Identifies the specific category of data to be collected;
● Explains the purpose for which the data is being collected;
● Describes how the data will be used and whether it will be shared with any third parties; and
● Is presented in plain language that a general, non-technical audience can readily understand.

9.2 Consent Prior to Collection
Your affirmative consent will be obtained before any sensitive data is collected. Such consent will be obtained through a clear, unambiguous affirmative action (e.g., tapping "Allow" in a system permission prompt, or checking a clearly labeled consent checkbox). Pre-checked consent boxes or implied consent through continued use are not used for sensitive data collection.

9.3 Withdrawal of Consent
You may withdraw your consent for the collection of sensitive data at any time. Consent for most sensitive data categories may be withdrawn through your device's application permission settings (Settings > Apps > Herbal Haven > Permissions). Where technically feasible, withdrawal of consent for sensitive data collection will not result in the loss of core App functionality. Where withdrawal of a particular permission would prevent a specific feature from operating, you will be clearly informed of that consequence before you withdraw.

9.4 Android Permissions
The Herbal Haven App may request the following Android permissions, subject to the purposes described:

Permission | Purpose | Required / Optional
INTERNET | Required for all App functionality; enables communication with our servers | Required
ACCESS_NETWORK_STATE | Allows the App to check whether a network connection is available before attempting data operations | Required
ACCESS_COARSE_LOCATION | If enabled, allows the App to access approximate location for localized content and regional features. Not used unless you opt in. | Optional
CAMERA | If enabled, allows you to photograph herbs or plants for submission as user-generated content. Not used unless you choose to submit a photo. | Optional

We do not request permissions beyond those listed above, and we do not request permissions for purposes other than those described herein. Should the App require additional permissions in the future, this Policy will be updated and you will be notified prior to such permissions being requested.

10. Security Practices
Herbal Haven DIY LLC takes the security of your personal data seriously and implements industry-standard technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

10.1 Encryption
All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) version 1.2 or higher. Data stored on our servers is encrypted at rest using AES-256 encryption where technically applicable and commercially reasonable.

10.2 Access Controls
Access to personal data is governed by a role-based access control (RBAC) framework. Employee and contractor access to personal data is limited strictly to what is necessary for each individual to perform their assigned job functions (the "principle of least privilege"). All personnel with access to personal data are subject to confidentiality obligations and receive appropriate data protection training.

10.3 Security Assessments
We conduct regular security assessments of our systems and infrastructure, which may include vulnerability scanning and periodic penetration testing by qualified security professionals. Identified vulnerabilities are remediated on a risk-prioritized basis.

10.4 Incident Response
We maintain a documented incident response plan for data security breaches. In the event of a data breach that is reasonably likely to result in risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach, to the extent required by applicable law (including Article 34 of the GDPR). Such notification will be made via the contact information associated with your account and/or via in-app notification.

10.5 User Responsibility
Notwithstanding our security measures, no information security system is completely impenetrable. You are responsible for maintaining the confidentiality of your account credentials. We strongly encourage you to use a strong, unique password for your Herbal Haven account and to avoid sharing your login credentials with any third party. If you believe your account has been compromised, please contact us immediately at herbalhavendiy@herbalhavendiyllc.com.

11. Data Retention & Deletion
We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Data Category | Retention Period | Basis for Retention
Account / Registration Data | Duration of active account relationship, plus 12 months following account closure | Contractual; legitimate interests (dispute resolution)
Transaction Records | 7 years from the date of transaction | Legal obligation (financial and tax regulations)
Usage and Analytics Data | Up to 26 months, then aggregated or deleted | Legitimate interests (service improvement)
Crash Logs | Up to 90 days | Legitimate interests (technical debugging)
Communications Data (support tickets, emails) | 3 years from last interaction | Legitimate interests (dispute resolution, record-keeping)
Marketing Consent Records | Until consent is withdrawn, plus 3 years | Legal obligation (demonstrating consent)

Data Deletion Upon Request: Users may request deletion of their personal data at any time in accordance with the procedures set forth in Section 12. Upon receipt of a valid deletion request, data will be removed from active systems within 30 days. Residual copies in backup systems will be purged within 90 days of the deletion request being processed. Certain categories of data (e.g., transaction records) may be retained for the periods specified above, notwithstanding a deletion request, where retention is required by law or to protect our legitimate legal interests.

12. Account Deletion Procedures
You have the right to delete your Herbal Haven DIY LLC account and request the deletion of associated personal data at any time. You may do so through any of the following methods:

12.1 In-App Deletion (Primary Method)

Step 1: Log in to the Herbal Haven App (Android) or Website using your registered credentials.
Step 2: Navigate to Settings > Account > Delete Account.
Step 3: Review the deletion disclosure, which will inform you of the data categories affected and any data retained for legal compliance purposes.
Step 4: Confirm your deletion request when prompted. A confirmation email will be sent to the email address associated with your account.

12.2 Deletion by Email Request
5. Step 1: Send an email to herbalhavendiy@herbalhavendiyllc.com.
6. Step 2: Use the subject line: "Account Deletion Request".
7. Step 3: Include in the body of the email the email address associated with your Herbal Haven account, along with any additional verification information we may reasonably request to confirm your identity.
8. Step 4: We will acknowledge your request within 5 business days and complete the deletion within 30 calendar days.

12.3 Processing Timeline
Account deletion will be completed within 30 calendar days of a verified deletion request. Residual backup copies will be purged within 90 days. You will receive a confirmation notification upon completion.

12.4 Data Retained After Deletion
Notwithstanding account deletion, the following categories of data may be retained for the periods described, where required by applicable law or legitimate legal interest:
● Transaction Records: Retained for up to 7 years to comply with applicable financial, tax, and accounting regulations;
● Communications Records: Retained for up to 3 years where necessary for dispute resolution or legal proceedings; and
● Aggregated, Non-Identifiable Analytics Data: Retained indefinitely, as such data cannot be linked back to any individual user.

12.5 Irrecoverability of Deleted Accounts
Please note: Once your account deletion has been processed, your account and the associated personal data cannot be recovered. Any content you have posted (reviews, photos, comments) will also be deleted, subject to the retention exceptions listed above.

12.6 Google Play Store
In accordance with Google Play Developer Program Policies, instructions for requesting account and data deletion are also accessible directly from the Herbal Haven application listing on the Google Play Store.

13. EU / UK / Swiss Data Protection Compliance (GDPR, UK GDPR, nFADP)
Herbal Haven DIY LLC is committed to complying with applicable European, United Kingdom, and Swiss data protection laws to the extent our processing activities fall within their territorial scope, including:
● The EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679);
● The UK General Data Protection Regulation (UK GDPR) as retained in UK law by the European Union (Withdrawal) Act 2018, as supplemented by the Data Protection Act 2018; and
● The Swiss Federal Act on Data Protection (nFADP) (revised Federal Act on Data Protection, effective September 1, 2023).

13.1 Legal Bases for Processing

We process personal data only where a lawful basis exists. Depending on the nature of the processing activity, we rely on one or more of the following legal bases:
● Consent (Article 6(1)(a) GDPR): Where you have given us clear, specific, and unambiguous consent to process your data for a specific purpose (e.g., marketing communications);
● Performance of Contract (Article 6(1)(b) GDPR): Where processing is necessary to provide the services you have contracted for (e.g., creating and managing your account, processing orders);
● Legitimate Interests (Article 6(1)(f) GDPR): Where processing is necessary for our legitimate business interests (e.g., analytics, security, fraud prevention), provided such interests are not overridden by your fundamental rights and freedoms; and
● Legal Obligation (Article 6(1)(c) GDPR): Where processing is necessary to comply with a legal obligation to which we are subject (e.g., financial record retention).

13.2 Data Subject Rights
If you are located in the European Union, the United Kingdom, or Switzerland, you have the following rights with respect to your personal data, exercisable by contacting us at herbalhavendiy@herbalhavendiyllc.com:

Right | Description | GDPR Reference
Right of Access | The right to obtain confirmation of whether we process your personal data and to receive a copy of that data | Article 15 GDPR
Right to Rectification | The right to have inaccurate or incomplete personal data corrected without undue delay | Article 16 GDPR
Right to Erasure (Right to be Forgotten) | The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent | Article 17 GDPR
Right to Restriction of Processing | The right to request that we restrict the processing of your personal data under certain circumstances | Article 18 GDPR
Right to Data Portability | The right to receive a structured, commonly used, machine-readable copy of your personal data and to transmit it to another controller | Article 20 GDPR
Right to Object | The right to object to processing based on legitimate interests, including processing for direct marketing purposes | Article 21 GDPR
Rights Related to Automated Decision-Making | The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects | Article 22 GDPR

We will respond to all data subject rights requests within one calendar month of receipt, subject to extension by up to two additional months where the request is complex or numerous, in which case we will notify you of such extension within one month of receipt. We may request verification of your identity before processing a rights request.

13.3 EU Representative
Where required by Article 27 of the GDPR (applicable to controllers not established in the EU that process personal data of EU data subjects on a regular basis or in relation to the offering of goods or services), Herbal Haven DIY LLC will designate an EU representative. We will update this Policy with the representative's contact details upon such designation. If no EU representative has currently been designated, users may direct all EU-related privacy inquiries to herbalhavendiy@herbalhavendiyllc.com.

13.4 International Data Transfers
Herbal Haven DIY LLC is based in the United States. When we process personal data of EU, UK, or Swiss residents, such data may be transferred to and processed in the United States or other countries outside the European Economic Area (EEA), the United Kingdom, or Switzerland. Such transfers occur only where an appropriate safeguard is in place, including:
● Standard Contractual Clauses (SCCs) as adopted by the European Commission (or UK equivalent clauses, as applicable); or
● Other appropriate transfer mechanisms recognized under applicable data protection law.

You may request further information about our international transfer mechanisms by contacting us at herbalhavendiy@herbalhavendiyllc.com.

13.5 Right to Lodge a Complaint
If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority:
● EU users: The competent data protection authority in the EU member state of your habitual residence, place of work, or the place of the alleged infringement;
● UK users: The Information Commissioner's Office (ICO) (ico.org.uk); and
● Swiss users: The Swiss Federal Data Protection and Information Commissioner (FDPIC) (edoeb.admin.ch).

We encourage you to contact us first at herbalhavendiy@herbalhavendiyllc.com so that we have the opportunity to address your concerns before you escalate to a supervisory authority.

14. U.S. State Privacy Rights
Residents of certain U.S. states have specific rights with respect to their personal data under applicable state privacy laws. This section describes those rights and how to exercise them.

14.1 California Residents (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), grants you the following rights:
● Right to Know: The right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purposes for which it was collected, and the categories of third parties with whom it was shared;
● Right to Delete: The right to request deletion of personal information we have collected from you, subject to certain exceptions;
● Right to Correct: The right to request correction of inaccurate personal information we maintain about you;
● Right to Opt-Out of Sale or Sharing: The right to direct us not to sell or share your personal information for cross-context behavioral advertising. Herbal Haven DIY LLC does not sell personal information, and does not share personal information for cross-context behavioral advertising, within the meaning of the CCPA/CPRA; and
● Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, or provide a different quality of service based on your exercise of these rights.

14.2 Other State Residents
Residents of the following states have privacy rights under their respective state laws, which we honor upon verified request. The rights

granted by these laws are substantially similar to those described above and include rights to access, correct, delete, and opt-out of the sale or targeted use of personal data:
● Virginia — Virginia Consumer Data Protection Act (VCDPA);
● Colorado — Colorado Privacy Act (CPA);
● Connecticut — Connecticut Data Privacy Act (CTDPA);
● Texas — Texas Data Privacy and Security Act (TDPSA); and
● Any other U.S. state that enacts a comprehensive consumer privacy law applicable to our processing activities.

14.3 How to Submit a U.S. Privacy Rights Request
To exercise any applicable U.S. state privacy right, please contact us at:
● Email: herbalhavendiy@herbalhavendiyllc.com with the subject line "U.S. Privacy Rights Request"

We will acknowledge your request within 10 business days and respond substantively within 45 calendar days of receipt. Where reasonably necessary due to the complexity or volume of requests, we may extend our response time by an additional 45 calendar days, in which case we will notify you of the extension within the initial 45-day period. We may request verification of your identity before processing your request.

15. Children's Privacy
The Herbal Haven App and Website are not directed to, and are not intended for use by, children under the age of 13 years in the United States, or under the age of 16 years in the European Union and United Kingdom (or such higher age as applicable law in a given jurisdiction may specify). We do not knowingly collect personal data from children below these age thresholds.

We do not include any features specifically designed to attract children, and we do not market our services to minors. Users are required to confirm that they meet the applicable minimum age requirement upon account registration.

Inadvertent Collection: If we discover or are notified that we have inadvertently collected personal data from a child below the applicable minimum age, we will promptly delete such data from our systems without undue delay.

Parental / Guardian Requests: If you are a parent or legal guardian and believe that your child has provided personal data to us without appropriate consent, please contact us immediately at herbalhavendiy@herbalhavendiyllc.com. Please include the subject line "Child Data Deletion Request" and provide sufficient information to allow us to identify and delete your child's data. We will respond within 10 business days.

Herbal Haven DIY LLC complies with the U.S. Children's Online Privacy Protection Act (COPPA) and the equivalent provisions of EU Directive 2018/1807 and applicable UK and Swiss law to the extent applicable.

16. Cookies & Tracking Technologies
Our Website uses cookies and similar tracking technologies (including analytics pixels and local storage) to operate and improve our services. This section explains what these technologies are, how we use them, and how you can control them.

16.1 Types of Cookies We Use
Cookie Category | Purpose | Consent Required?
Strictly Necessary | Essential for the Website to function; enable core features such as page navigation, session management, and security. Cannot be disabled. | No (legitimate interest / contract necessity)
Functional | Remember your preferences (e.g., language, region) and provide enhanced, personalized features | Yes
Analytics | Collect information about how you use the Website (pages visited, time spent, errors encountered) to help us improve our services | Yes
Marketing | Track your browsing activity to deliver relevant promotional content. Used only with your explicit consent. | Yes (explicit opt-in required)

16.2 Cookie Consent
Upon your first visit to our Website, a cookie consent banner will be displayed. Non-essential cookies (functional, analytics, and marketing) will not be placed until and unless you have given your affirmative consent through the banner. You may selectively consent to specific cookie categories.

16.3 Managing Your Cookie Preferences
You may manage, update, or withdraw your cookie consent at any time through either of the following means:
● Browser Settings: Most web browsers allow you to control cookies through their settings. You may instruct your browser to refuse all cookies or to indicate when a cookie is being sent. Please note that disabling strictly necessary cookies may impair the functionality of the Website; and
● In-App / Website Cookie Preferences Panel: We provide an accessible cookie preferences panel on our Website, which allows you to manage your consent preferences at any time.

16.4 Do Not Track (DNT) Signals
Some browsers offer a "Do Not Track" (DNT) feature that signals to websites that you do not wish to have your online activity tracked. At the present time, our Website does not respond to DNT signals in a technically standardized manner, as no universal technical standard for DNT recognition has been established. We will update this section if our DNT practices change. In the interim, you may manage tracking preferences through our cookie preferences panel as described above.

17. Changes to This Privacy Policy
Herbal Haven DIY LLC reserves the right to modify or update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or business operations. We distinguish between material changes and non-material changes as follows:

17.1 Material Changes
A material change is any change that meaningfully affects your rights with respect to your personal data, introduces new categories of data collection, or alters the purposes for which your data is used. In the event of a material change, we will:
● Notify you via in-app notification and/or email to the address associated with your account at least 30 calendar days before the change takes effect; and
● Update the "Last Updated" date at the top of this Policy.

17.2 Non-Material Changes
Non-material changes (such as typographical corrections, clarifications, or updates to contact information) will be reflected in this Policy with an updated "Last Updated" date, without advance notice.

17.3 Acceptance
Your continued use of the App or Website after the effective date of any changes to this Policy constitutes your acceptance of the revised Policy. If you do not agree with the revised Policy, you must cease use of the App and Website and may request account deletion in accordance with Section 12.

17.4 Prior Versions
Prior versions of this Privacy Policy are available upon request. Please contact us at herbalhavendiy@herbalhavendiyllc.com to request a copy of any prior version.

18. Contact Information
For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact Herbal Haven DIY LLC using the following details:

Contact Method:
Company Name: Herbal Haven DIY LLC
Email Address: herbalhavendiy@herbalhavendiyllc.com
Mailing Address: 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming, 82801
Website: www.herbalhavendiyllc.com
Response Time is usually within 30 business days of receipt of your inquiry

Google Play-Related Inquiries: For matters specifically related to our application's listing on the Google Play Store, users may also contact Google Play support directly at play.google.com/about/support. However, all privacy-specific inquiries concerning Herbal Haven DIY LLC's data practices should be directed to us at herbalhavendiy@herbalhavendiyllc.com.

Data Protection Officer / Privacy Contact: At the present time, Herbal Haven DIY LLC has not appointed a formal Data Protection Officer (DPO), as such appointment may not be mandated under applicable law for a business of our size. All data protection inquiries are handled directly by our designated privacy contact at herbalhavendiy@herbalhavendiyllc.com. We will revise this section if a DPO is formally appointed.

EU / UK Representative: If you are located in the EU or UK and wish to contact our EU/UK representative directly (once designated), updated contact information will be provided in this section. In the interim, please direct all inquiries to herbalhavendiy@herbalhavendiyllc.com.

This Privacy Policy was prepared in accordance with Google Play Developer Program Policies and applicable international data protection law, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (nFADP), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and other applicable U.S. state privacy statutes. © 2026 Herbal Haven DIY LLC. All rights reserved.