Privacy Policy

Your Privacy, Explained Plainly

At Rootwell, radical transparency isn't just how we talk about our products — it's how we run our entire business. That includes how we handle your personal data. This page tells you exactly what information we collect, why we collect it, who sees it, and what you can do about it. No buried clauses. No legalese designed to obscure. Just a straight answer to a fair question: what happens to your information when you shop with us?

If you have a question this page doesn't answer, we genuinely want to hear it. Contact details are at the bottom.

What Information We Collect

We only collect information that has a clear, honest purpose. Here's what that looks like in practice:

  • Your name and email address — provided when you create an account, place an order, or sign up for our newsletter.
  • Your shipping address — provided at checkout so we can get your order to you.
  • Payment information — we never see or store your full card details. Payment processing is handled entirely by Shopify Payments and Stripe, both of which are PCI-DSS compliant. We receive only a confirmation that a transaction was approved.
  • Order history — a record of what you've purchased, which helps us handle returns, answer questions, and improve our product recommendations.
  • Browsing data via cookies — when you visit our site, we use cookies and similar technologies to understand how people navigate our store, which pages perform well, and where the experience could be better. This includes data like pages visited, time on site, device type, and referring URL. You can manage cookie preferences at any time using the cookie settings link in our site footer.
  • Customer service communications — if you email or message us, we keep a record of that conversation so we can follow up properly and spot patterns that help us improve.

How We Use Your Information

Every piece of data we hold has a job to do. We use your information for the following purposes — and nothing else:

  • Fulfilling your orders — processing payments, arranging shipping, sending tracking updates, and handling returns or exchanges.
  • Customer service — responding to your questions, resolving issues, and keeping a record of our conversations so you never have to repeat yourself.
  • Marketing communications — only if you've opted in — if you've subscribed to our emails, we'll send you product updates, sustainability content, and occasional promotions. Every marketing email includes a clear, one-click unsubscribe link. We do not send marketing emails to people who haven't asked for them.
  • Improving our store — aggregated, anonymised browsing data helps us understand what's working and what isn't, so we can make Rootwell a better experience for everyone.
  • Legal compliance — we retain certain records as required by applicable law, including tax and accounting obligations.

Who We Share Your Information With

This is the part of privacy policies where things often get murky. We'll be direct:

  • Shopify — our store runs on Shopify's platform, which processes and stores order data on our behalf. Shopify's privacy practices are documented at shopify.com/legal/privacy.
  • Shipping carriers — we share your name and delivery address with the carrier handling your shipment (for example, UPS, FedEx, Royal Mail, or similar) so they can deliver your order. They receive only what they need to complete delivery.
  • Payment processors — Shopify Payments and Stripe receive your payment details directly and securely. We do not handle or store this data ourselves.
  • Email marketing platform — if you've opted into marketing, your name and email are stored with our email service provider (currently Klaviyo) solely for the purpose of sending you communications you asked for.

We do not sell your personal data. Ever. To anyone. We do not trade it, rent it, or share it with advertisers, data brokers, or any third party for their own commercial purposes. That's not a policy we might revisit — it's a line we won't cross.

Your Rights Over Your Data

Whether you're covered by GDPR in Europe, CCPA in California, or similar legislation elsewhere, the principle is the same: your data belongs to you. Here's what that means in plain terms:

  • The right to know — you can ask us what personal information we hold about you and receive a clear, complete answer.
  • The right to correct — if something we have on file is wrong or out of date, you can ask us to fix it.
  • The right to delete — you can ask us to delete your personal data. We'll do so promptly, subject only to any legal obligations that require us to retain certain records (such as transaction records for tax purposes).
  • The right to opt out of marketing — unsubscribe from any email we send, or contact us directly, and we'll remove you from marketing communications immediately.
  • The right to data portability — you can request a copy of your data in a portable format.
  • The right to object — if you believe we're processing your data in a way that isn't justified, you have the right to object and we'll review it seriously.

To exercise any of these rights, simply contact us using the details below. We will respond within 30 days — and usually much sooner.

Cookies and Tracking Technologies

We use cookies for three purposes: keeping your shopping session running smoothly (essential cookies), understanding how our site is used (analytics cookies), and, if you've consented, delivering relevant advertising (marketing cookies). Essential cookies are necessary for the store to function and cannot be switched off. All others are your choice.

You can update your cookie preferences at any time via the cookie settings link in our site footer, or by adjusting your browser settings. Opting out of analytics or marketing cookies won't affect your ability to shop with us.

How Long We Keep Your Data

We keep your data for as long as it serves a clear, legitimate purpose — and no longer.

  • Active account data — retained for as long as your account is open.
  • Order records — retained for seven years to meet standard accounting and tax requirements.
  • Marketing data — retained until you unsubscribe or ask us to delete it.
  • Customer service records — retained for three years, so we have context if a follow-up issue arises.
  • Anonymised analytics data — retained indefinitely, as it contains no personal identifiers.

When data is no longer needed, we delete it or anonymise it. We don't hold onto things out of habit.

Data Security

We take reasonable and industry-standard steps to protect your information — including SSL encryption across our entire site, secure third-party payment processing, and restricted internal access to customer data. No system is entirely without risk, but we treat your data with the same care we'd want applied to our own.

Changes to This Policy

If we update this privacy policy in a meaningful way, we'll let you know — either by email if you have an account with us, or by posting a clear notice on our site. We'll always display the date this policy was last updated so you know you're reading the current version.

Last updated: July 2026

Contact Us About Privacy

If you have any questions about this policy, want to exercise your data rights, or simply want to understand something more clearly, please get in touch. We read every message and respond personally.

  • Email: privacy@rootwell.com
  • Post: Rootwell Privacy Team, [Your Business Address]

We aim to respond to all privacy-related enquiries within five business days. If you're not satisfied with our response and you're based in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.