Privacy Policy

Last updated 12 September 2026

1. Why you should read this

This Privacy Policy explains how we handle your personal data when you visit myfolkherbal.com ("Website"), answer our questionnaire, subscribe to our service, or contact us.

It covers what we collect, why, who we share it with, how long we keep it, and what rights you have.

We process personal data in accordance with the General Data Protection Regulation (GDPR), the UK GDPR, the ePrivacy Directive, and applicable US state privacy laws including the California Consumer Privacy Act.

If you do not agree with our practices, please do not use the Website or provide your data.

2. Who is responsible for your data

MyFolkHerbal is the data controller for the personal data described in this Policy.

Contact for all privacy matters: info@myfolkherbal.com

3. Important things to know up front

Your questionnaire answers are deleted once your library is built. We keep the resulting list of recipes, not the answers that produced it. Section 5 explains this.
We ask how you have been feeling. Those answers are used once, for one purpose, and then removed.
We never sell your data. Not to advertisers, data brokers, or anyone else.
We do not use your data to train AI models.
This Website is not for anyone under 18. We do not knowingly collect data from minors. If we learn we have, we delete it.
Card details never reach us. Payments are handled by Stripe.

4. What we collect and why

4.1. Questionnaire answers

What: Your responses to our questionnaire, including how you have been feeling physically and emotionally, and for some users information about menstrual cycle and hormonal symptoms.

Why: To work out which herbs and which areas of the library suit you, and to order your library around them.

Legal basis: Your explicit consent (GDPR Art. 9(2)(a)), given when you begin the questionnaire.

Retention: your answers are deleted as soon as your library has been assembled, normally within minutes.

What we keep instead. We keep a short list of herbs suited to your answers, and the broad areas of the library those answers pointed to, such as digestion or sleep. We keep this so your library opens the same way each time you sign in, without asking you to answer again.

We want to be straightforward about one thing. That list is derived from your answers rather than a copy of them, but it can still suggest the kind of thing you told us. A herb traditionally associated with nursing, or with the menopause, carries a hint of why it was chosen. We treat this list with the same protection as the answers themselves: it is used only to assemble and order your library, it is never used for marketing, never shared with advertisers or data brokers, never sold, and never used to train AI models.

If you retake the questionnaire, the new list replaces the old one, and the new answers are deleted once your library is rebuilt.

You may withdraw your consent at any time by deleting your account, which removes the list along with everything else.

4.2. Account information

What: Email address and a securely hashed password. We never store your password in readable form.

Why: To create your account, sign you in, keep your library available across devices, and send service messages such as password resets.

Legal basis: Performance of contract (Art. 6(1)(b)).

Retention: For as long as your account exists, plus 30 days.

4.3. Subscription and payment information

What: Which plan you bought, the amount, currency, the date, your renewal date, cancellation date and any reason you give for cancelling, and a Stripe customer reference. From Stripe we also receive the card brand, last four digits, expiry and issuing country.

We never receive or store your full card number, CVC or PIN. Those go directly to Stripe.

Why: To take payment, manage renewals and cancellations, provide receipts, handle disputes, and meet our accounting and tax obligations.

Legal basis: Performance of contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

Retention: 10 years, as required by accounting and tax law.

4.4. Email addresses from people who do not complete payment

What: If you create an account and answer the questionnaire but do not subscribe, we keep your email address and the list of recipes selected for you. Your answers themselves are deleted as described in 4.1.

Why: So your library is still there if you return, and so we can send you a limited number of reminders.

Legal basis: Performance of contract for the account itself (Art. 6(1)(b)), and our legitimate interest in following up on an incomplete purchase (Art. 6(1)(f)).

Retention: 12 months from your last activity, then deleted.

You may object to this at any time by emailing us, or by using the unsubscribe link in any message we send.

4.5. Customer support

What: Your email address, the content of your message, any attachments, and our correspondence history.

Why: To answer your question or resolve your problem.

Legal basis: Performance of contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).

Retention: 3 years after your enquiry is closed.

4.6. Service messages

What: Emails we must send you — password resets, payment receipts, renewal reminders, price change notices, and notices about changes to these terms.

Why: To administer your subscription and meet our obligations to you.

Legal basis: Performance of contract (Art. 6(1)(b)).

These are not marketing and you cannot opt out of them while you hold an account.

Retention: Delivery logs for 12 months.

4.7. Marketing emails

What: Your email address and your consent record.

Why: To tell you about new recipes added to the library, seasonal notes, and occasional offers.

Legal basis: Your consent (Art. 6(1)(a)). If you are already a subscriber, we may send limited messages about similar content on the basis of legitimate interest (Art. 6(1)(f)) unless you object.

Retention: 3 years from consent, or until you unsubscribe.

You can unsubscribe at any time using the link in any marketing email. That does not affect service messages.

4.8. Website analytics and security

What: Page views, referring website, country, device and browser type. We use Vercel Analytics, which is cookieless and does not track individuals across sites or build a profile of you. It does not store your IP address; it derives an anonymous identifier that changes daily and cannot be used to identify you.

Why: To understand which pages are used, and to find and fix problems.

Legal basis: Legitimate interest in operating and improving the Website (Art. 6(1)(f)). Because no cookies are set and no personal identifiers are stored, this does not require your consent.

Retention: Aggregated figures only, retained by Vercel for up to 12 months.

4.9. Legal claims

What: Any data relevant to a legal claim or dispute, including chargebacks.

Why: To establish, exercise or defend legal claims.

Legal basis: Legitimate interest (Art. 6(1)(f)).

Retention: For the duration of proceedings and 5 years afterwards.

5. How we handle health-related information

This deserves its own section because it is the most sensitive data we hold.

5.1. Your questionnaire answers describe how you have been feeling. Under GDPR some of this counts as data concerning health, and is given extra protection. We treat all of it that way.

5.2. We ask for your explicit consent before you answer. You give it by proceeding through the questionnaire, having been told what the answers are used for.

5.3. We use these answers for one purpose only: selecting the recipes in your personal library.

5.4. We delete them immediately afterwards. Once your library has been assembled, your answers are removed from our systems. What remains is a short list of herbs and library areas suited to you. That list is derived from your answers rather than a copy of them, but because a herb can hint at why it was chosen, we give it the same protection as the answers themselves, as set out in 4.1.

5.5. We do not:

use them for marketing, targeting or advertising
share them with advertisers, data brokers, insurers or employers
sell them to anyone
use them to train AI models
combine them with data from other sources to build a profile of you

5.6. Access within our organisation is limited to what is necessary to operate the service.

5.7. You can change what is in your library at any time by retaking the questionnaire, and remove it entirely by deleting your account.

6. Automated decision-making

6.1. Your library is assembled automatically: your answers are matched against a fixed set of rules that link each answer to particular recipes. There is no profiling, no scoring, and no machine learning involved. The rules are the same for everyone.

6.2. This process does not produce legal effects concerning you or similarly significantly affect you within the meaning of GDPR Art. 22.

6.3. If you want to understand why a particular recipe appears in your library, email us and we will explain.

7. Who we share your data with

We share data only where necessary, and only with providers bound by data processing agreements.

Provider	What they receive	Where
Stripe	Payment and subscription data	US and EEA
Neon	Database hosting — all stored data	EEA
Vercel	Website hosting, technical logs	US and EEA
Resend	Email address, message content	US and EEA
Vercel Analytics	Anonymous, aggregated page-view data	US and EEA

We may also disclose data to public authorities, courts or legal advisers where required by law or to defend legal claims, and to a buyer or their advisers in the event of a merger, acquisition or restructuring.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

8. International transfers

Your data is primarily stored in the EEA. Some providers listed above operate in the United States.

Where data is transferred outside the EEA or UK, we rely on:

an adequacy decision by the European Commission or UK Government, where one exists; or
Standard Contractual Clauses approved by the European Commission, or the UK International Data Transfer Addendum; together with
additional technical safeguards such as encryption in transit and at rest.

9. How we protect your data

Passwords are hashed, never stored in readable form
All traffic is encrypted in transit
Database access is restricted and credentials are rotated
Card details never reach our systems
Access is limited to those who need it

No system is entirely risk-free. Please use a strong, unique password and keep it confidential.

10. Your rights

Under GDPR and UK GDPR you have the right to:

Be informed about how we use your data (Art. 12–13)
Access a copy of the data we hold about you (Art. 15)
Rectification of inaccurate or incomplete data (Art. 16)
Erasure of your data in certain circumstances (Art. 17)
Restrict processing in certain circumstances (Art. 18)
Data portability — receive your data in a machine-readable format (Art. 20)
Object to processing based on legitimate interest, or to direct marketing (Art. 21)
Withdraw consent at any time, without affecting processing that already took place (Art. 7(3))
Complain to a supervisory authority

If you are in California, you also have the right to know what personal information we collect and how it is used, to request deletion, to request correction, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising.

To exercise any right, email info@myfolkherbal.com. Please tell us which right you wish to exercise and give us enough information to identify you. We may need to verify your identity.

We respond within one month. If your request is complex we may extend this by a further month and will tell you why.

To complain to a supervisory authority:

Lithuania: State Data Protection Inspectorate — https://vdai.lrv.lt
UK: Information Commissioner's Office — https://ico.org.uk
Elsewhere in the EEA: your national data protection authority

11. Cookies

We use only cookies that are strictly necessary for the Website to work — keeping you signed in, and remembering your questionnaire progress while you answer it. Under the ePrivacy Directive these do not require consent.

We do not use advertising or tracking cookies. Our analytics provider, Vercel Analytics, is cookieless.

Stripe may set cookies on its own checkout pages for fraud prevention. Those are governed by Stripe's own privacy policy.

12. Deleting your account

You can ask us to delete your account at any time by emailing info@myfolkherbal.com.

When you do, we delete your email address, password and library within 30 days. Your questionnaire answers will already have been deleted when your library was built.

We must keep records of payments and invoices for 10 years to meet accounting and tax obligations. These are retained separately and are not used for any other purpose.

13. Changes to this Policy

We may update this Policy. The current version is always on this page with the date it was last updated at the top. Where changes materially affect your rights, we will notify you by email before they take effect.

14. Contact

Email: info@myfolkherbal.com

For any question about this Policy, or to exercise any of your rights, please write to us. We aim to respond within two business days.