We collect what we need to run the store: fill and deliver your order, take payment, answer your messages, and send the emails you ask for. We never sell your information. Card numbers go straight to our payment processor, Waave, so we never see them. We use no Google Analytics, no Facebook Pixel, and no advertising trackers, and our visitor statistics stay on our own server.
- Never sold
- Cards stay with Waave
- No ad trackers
01Information we collect
We collect a limited set of information to run the store and serve you properly.
Information you give us
- Name, email address, and addresses. Used for your order, receipts, shipping labels, and support. Delivery addresses are also checked against state and local kratom laws, both to confirm we can ship to you and to tell you if a ban moves forward there.
- Phone number (optional). Used only if a carrier or we need to reach you about a delivery.
- Order details. Products, quantities, totals, and the payment method you chose.
- Payment information. Card details are entered on the secure page of our payment processor, Waave. We never receive or store card numbers, expiration dates, or security codes. If you pay with Cash App, we see the name and Cash App account the payment comes from. Mail-in payments are handled by hand, and USPS collects COD payments.
- Account details. Your username and password (stored only as a bcrypt hash), and your birthday if you choose to add it for the birthday points bonus.
- Messages. What you send us through the contact form, chat, email, or text.
- Reviews. Your rating, review, photos, and videos, which are published on the site with the name you give.
- Program sign-ups. Your email for back-in-stock alerts, newsletters, and law alerts. Your name, email, and address for free sample requests. Affiliate applications, including the Cash App, Zelle, or Venmo handle we pay commissions to. Wholesale applications, including the shop name, contact name, email, phone, website, and location.
Age verification for New York orders
New York law requires proof that kratom buyers are 21 or older. For New York orders we email you and ask you to reply with a photo of your government-issued ID. We check only the name and date of birth, then delete the image and the email. We never store ID photos or ID numbers. We keep a note on the order that your age was verified, so later orders with the same email, name, and shipping address do not need the check again.
Information collected automatically
- IP address and device details. Browser, operating system, and screen size. Used for security, fraud prevention, and page layout.
- Visitor statistics. Pages viewed, time on page, the page that sent you here, and clicks. An approximate location (state and city) is looked up from your IP address on our own server, using IP Geolocation by DB-IP, a database stored there. Nothing is sent to an outside analytics service.
- How you found us. When you order, the store saves the source of your visit with the order (for example a search engine, a link, or typing our address in) and the type of device.
- Cookies and browser storage. Listed in the cookies section below.
What we do not collect
- Social Security numbers.
- ID photos or ID numbers (the photo is deleted after the age check).
- Card numbers (they go to Waave).
- Biometric data such as fingerprints or face scans.
- Political opinions, health data, or religious beliefs.
02How we use your information
We use the information above for a small, specific set of reasons. We do not sell personal information, and we do not share it with anyone for their own marketing.
- To fill your orders. Processing payments, packing the right products, printing shipping labels, making local deliveries, and sending order confirmations and tracking updates.
- To provide customer support. Answering your questions, handling returns, and fixing problems with an order.
- To run the programs you join. Rewards points and the birthday bonus, back-in-stock alerts, free samples (including checking that each household claims only one), affiliate payouts, and wholesale accounts.
- To operate and secure the site. Detecting fraud, preventing abuse, fixing technical problems, keeping accounts safe, and understanding which pages people use.
- To send you email you’ve opted into. Our newsletter (new product announcements, restock notices, and occasional updates) and, separately, kratom law alerts (new federal, state, and local laws and rule changes, with no sales content). Each is its own choice. Every email has a link to leave that list or all of them, and you can switch each one on or off in My Account under Newsletters.
- To tell you about a kratom ban moving forward where you live. If a state, county, city, or town moves toward banning kratom where your orders are delivered, we may send you one email about it, with what is proposed and how to take part if you want to. It contains no sales content. If you unsubscribed from our email we will not send it, and if you reply that you would rather not get these, we will not send them again.
- To meet legal obligations. Including tax records, age verification, and responding to valid legal requests.
03Cookies and browser storage
We use cookies and browser storage to run the store and keep our own visitor statistics. No advertising cookies, no tracking pixels, no Google Analytics, no Facebook Pixel.
| What | Purpose | How long | Names |
|---|---|---|---|
| Cart and checkout | Keeps your cart and checkout working | Up to 2 days | wp_woocommerce_session_*, woocommerce_cart_hash, woocommerce_items_in_cart |
| Sign-in | Keeps you signed in to your account | Until you sign out, or up to 14 days with "Remember me" | wordpress_logged_in_*, wordpress_sec_* |
| Order source | Notes how you arrived, so it can be saved with an order | 30 minutes or less | sbjs_* |
| Visitor statistics | Our own page and visit counts | Cookie 30 minutes; browser storage until you clear it | hvb_va_ref, hvb_va_session |
| Affiliate referral | Credits an affiliate when you arrive through their link | 90 days, only if you use an affiliate link | wcap_affiliate |
| Your choices | Guest wishlist, a closed newsletter pop-up or notice, the ZIP code you entered, your map view, and your chat in that tab | Wishlist 30 days; the rest until you close the browser or clear storage | hvb_wishlist_guest, hvb_popup_dismissed, hvb_zip, hvb_chat_v1 |
| Security and payment | Cloudflare’s check on the contact and account sign-up forms, Waave’s payment page and age pop-up, and our host’s bot check | Set and managed by those companies | Their own |
You can clear or block cookies and browser storage in your browser settings at any time. Blocking the cart and sign-in cookies will break checkout and accounts.
04Services that receive customer data
We never sell, rent, or trade your personal information. These companies receive customer data, and each gets only what it needs for its job:
| Service | What it receives | Why | Their policy |
|---|---|---|---|
| Waave | The card details you enter, your billing details, and the order amount | Card payments | Waave |
| Cash App (Block, Inc.) | Your payment and its note, if you pay with Cash App | Cash App payments | Cash App |
| ShipStation, including ParcelGuard insurance | Name, email, phone if given, shipping address, and order contents and weight | Shipping rates, labels, tracking, and insurance claims | ShipStation |
| USPS and UPS | Name, shipping address, package weight, and phone if needed | Delivery, and USPS collects COD payments | USPS · UPS |
| Zoho (ZeptoMail) | Email address, name, and the content of the emails we send you | Delivering order, account, newsletter, and law-alert emails | zoho.com/privacy |
| Cloudflare | Your IP address and browser details during the spam check on our contact and account sign-up forms, and copies of our database backups | Spam protection and off-site backups | Cloudflare |
| KnownHost | Everything stored on our website, including orders and accounts | Hosting our website and database | KnownHost |
That is the complete list. No analytics vendors, no advertising platforms, no data brokers.
Legal requests. We may disclose information if required by subpoena, court order, or other valid legal process. We will tell you unless the law prohibits it.
05Your rights and choices
Wherever you live, you can ask us to do any of the following through the contact page.
- Access. Get a copy of the personal information we hold about you.
- Correction. Fix information that is wrong or out of date.
- Deletion. Delete your account and personal information, except what tax and consumer protection laws require us to keep.
- Opt out of marketing. Unsubscribe with the link at the bottom of any marketing email, change your choices in My Account, or contact us.
- Data portability. Get your data in a structured, machine-readable format.
- Objection. Object to certain processing, such as our visitor statistics.
You can also add, change, or remove your birthday in your account at any time. We aim to answer verified requests within 30 days. If a request is complex, we may take up to 30 more days and will tell you in writing if so.
06Data retention and security
We keep personal information only as long as we need it for the reasons above, or as long as the law requires.
How long we keep it
- Order and transaction records
- Up to 7 years, as tax and accounting rules require.
- Account data
- As long as your account is open, plus a reasonable period after you close it to handle returns, disputes, and legal obligations.
- Support messages
- Typically 2 years from the last message.
- Visitor statistics
- 90 days, then deleted.
- ID photos for age checks
- Deleted right after the check. Only a note that your age was verified stays on the order.
- Free sample requests
- Kept, so each household can claim only one sample.
- Newsletter and law-alert lists
- Until you unsubscribe, plus a record of the unsubscribe so we do not email you from that list again.
- Backups
- Daily database backups are kept for 14 days.
- Cookies and browser storage
- See the table above.
To ask us to delete your information sooner, use the contact page. We act on verified requests within 30 days.
How we protect it
- HTTPS encryption on every page.
- Card details go straight to Waave, so card numbers never touch our servers.
- Passwords are stored only as bcrypt hashes.
- Login protection: two-step verification on administrator accounts, and lockouts after repeated failed sign-in attempts.
- Firewalls: our host’s server firewall and malware scanning, plus a firewall on the site itself.
- Daily checks of the software we run against published security alerts.
- Daily database backups stored off-site.
No way of storing or sending information is 100% secure. If a breach affects your personal information, we will notify you as the law requires.
07Where we operate
Hudson Valley Botanicals is based in New York. We sell and ship only to US addresses, and our website and servers are in the United States. If you visit from outside the US, your information is processed in the US.
08State privacy rights
Some state privacy laws, such as California’s, give residents the right to know what information a business collects, to delete or correct it, and to opt out of its sale or sharing. We offer the rights in section 05 to everyone, wherever you live. We do not sell personal information or share it for targeted advertising, and we will not treat you differently for using your rights.
If you are in the EU or UK, you can also contact your local data protection authority.
09Children’s privacy
Hudson Valley Botanicals is an age-restricted site. We do not knowingly collect personal information from anyone under 18, and we do not direct marketing or advertising to children or minors. The site and its services are intended for adults only.
The minimum age to buy kratom may be higher than 18 where you live. Some states, including New York, require buyers to be 21 or older. Age requirements are enforced at checkout and are separate from the privacy threshold in this section.
If we learn that we have collected personal information from someone under 18, we will delete it. If you are a parent or guardian and believe your child has given us personal information, please reach us through the contact page.
10Changes to this policy
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we do, we will post the new version here and update the date at the top.
If a change is material, we will do our best to tell you by email or with a clear notice on the site before it takes effect. If you keep using the site after an update takes effect, the updated policy applies.
Listed every service that receives customer data and the cookies and browser storage we actually use. Added the New York ID check, birthdays, reviews, and program sign-ups. Corrected the security measures and retention periods. Visitor locations are now looked up on our own server.
Added optional kratom law alerts, named our email service, and added one email if a kratom ban moves forward where your orders are delivered (section 02).
11Contact us
Privacy questions
For data access, deletion, or correction requests, reach us through the contact page.
Visit contact pagePO Box 1135
Wappingers Falls, NY 12590
Last updated November 4, 2026. Also see our Terms and Conditions.
