Privacy Policy

Last updated: July 26, 2026

This Privacy Policy describes how your personal information is collected, used, and shared when you visit or make a purchase from www.vystaco.com (the "Site").

The Site is operated by LUXORA GLOBAL LLC, a limited liability company registered in the State of Montana, United States, doing business as Vystaco ("we", "us", "our"). We are the data controller responsible for your personal information.

1. Information We Collect

Device Information

When you visit the Site, we automatically collect certain information about your device, including your web browser, IP address, time zone, operating system, and the cookies installed on your device. As you browse, we also collect information about the pages and products you view, the websites or search terms that referred you to the Site, and how you interact with the Site. We refer to this as "Device Information."

We collect Device Information using:

• Cookies — small data files placed on your device, often containing an anonymous unique identifier.
• Log files — records of actions on the Site, including IP address, browser type, internet service provider, referring and exit pages, and date/time stamps.
• Web beacons, tags, and pixels — electronic files that record how you browse the Site. This includes the Meta Pixel and Meta Conversions API, which we use to measure and optimize our advertising.

Order Information

When you make or attempt to make a purchase, we collect your name, billing address, shipping address, payment information (processed by our payment providers — we do not store full card numbers on our servers), email address, and phone number. We refer to this as "Order Information."

Information You Give Us Directly

This includes information you provide when you subscribe to our email or SMS list, contact customer support, respond to a survey, or leave a product review.

Together, Device Information, Order Information, and information you give us directly are referred to as "Personal Information."

2. How We Use Your Personal Information

We use Order Information to fulfill orders placed through the Site — processing payment, arranging shipping, and providing invoices and order confirmations. We also use it to:

• Communicate with you about your order and respond to support requests;
• Screen orders for potential risk or fraud;
• Send you marketing communications, where you have consented or where permitted by law;
• Comply with our legal, tax, and accounting obligations.

We use Device Information to screen for potential risk and fraud (in particular, your IP address), to improve and optimize the Site, to generate analytics about how customers browse and interact with the Site, and to measure the performance of our marketing and advertising campaigns.

Legal bases (for EEA/UK visitors). We process your Personal Information to perform our contract with you (order fulfillment), on the basis of your consent (marketing and non-essential cookies), for our legitimate interests (fraud prevention, site improvement, direct marketing to existing customers), and to comply with legal obligations.

3. Marketing Communications

If you subscribe to our email or SMS list, we use your contact details to send promotional messages about our products and offers. We use Klaviyo as our email and SMS marketing platform.

• You can unsubscribe from marketing emails at any time using the unsubscribe link at the bottom of any message.
• You can stop marketing text messages by replying STOP to any message. Message and data rates may apply.
• Unsubscribing from marketing does not stop transactional messages, such as order confirmations and shipping notifications.
• You can also email us at hellovystaco@gmail.com to be removed from all marketing lists.

4. How We Share Your Personal Information

We share your Personal Information with third parties who help us operate our business:

To fulfill your order, we share the information necessary for shipping — your name, shipping address, phone number, and order details — with our fulfillment and supplier partners, who ship products directly to you. These partners may be located outside your country of residence. They are permitted to use your information only to fulfill your order and for no other purpose.

We may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information, or to establish, exercise, or defend our legal rights.

We do not sell your Personal Information for money. However, our use of advertising and analytics cookies may be considered "sharing" for cross-context behavioral advertising under California law. See Section 8 for how to opt out.

5. International Data Transfers

We are based in the United States, and our service providers and fulfillment partners operate in multiple countries. If you are located outside the United States, your Personal Information will be transferred to, stored in, and processed in the United States and other countries whose data protection laws may differ from those in your country. Where required by law, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, for these transfers.

6. Behavioural Advertising

We use your Personal Information to show you targeted advertisements and marketing communications that we believe may interest you. To learn more about how targeted advertising works, you can visit the Network Advertising Initiative's educational resources.

You can opt out of targeted advertising through the following:

• Meta (Facebook and Instagram): https://accountscenter.facebook.com — go to Ad preferences → Ad settings
• Google: https://adssettings.google.com/anonymous (or https://myadcenter.google.com if signed in)
• Google Analytics: https://tools.google.com/dlpage/gaoptout
• Digital Advertising Alliance industry opt-out: https://optout.aboutads.info
• Network Advertising Initiative industry opt-out: https://optout.networkadvertising.org

You can also manage cookies directly through your browser settings. Blocking all cookies may affect how the Site functions.

7. Do Not Track and Global Privacy Control

Our Site does not respond to Do Not Track browser signals. However, where required by applicable law, we treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of your personal information for that browser.

8. Your Privacy Rights

If you are located in the EEA, UK, or Switzerland

You have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your personal information;
• Restrict or object to our processing, including direct marketing;
• Receive your data in a portable format;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with your local data protection supervisory authority.

Please note that your information will be transferred outside of Europe, including to the United States.

If you are a California resident

Under the California Consumer Privacy Act, as amended, you have the right to:

• Know what categories of personal information we collect, the purposes for collection, and the categories of third parties we disclose it to;
• Access a copy of the specific pieces of personal information we hold about you;
• Delete your personal information, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of your personal information for cross-context behavioral advertising;
• Non-discrimination — we will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised your rights.

The categories of personal information we have collected in the past 12 months are: identifiers (name, email, address, phone, IP address), commercial information (purchase history), internet and network activity (browsing and interaction data), and geolocation data inferred from IP address. We do not collect sensitive personal information as defined under California law, and we do not knowingly sell or share the personal information of consumers under 16 years of age.

If you are located elsewhere

Residents of other U.S. states and other jurisdictions may have similar rights under local law. We will honor verified requests wherever we are able to do so.

How to exercise your rights

Email hellovystaco@gmail.com with the subject line "Privacy Request." Please tell us which right you wish to exercise and provide enough information for us to verify your identity — typically the email address and order number associated with your purchase. We will respond within the timeframe required by applicable law. You may use an authorized agent to submit a request on your behalf, subject to verification.

9. Data Retention

We retain your Order Information for as long as necessary to fulfill the purposes described in this policy, including to meet legal, tax, accounting, and reporting obligations, and to resolve disputes or enforce our agreements. Where we no longer need your information, we will delete or anonymize it. You may ask us to delete your information at any time, subject to the retention obligations described above.

10. Security

We take reasonable technical and organizational measures to protect your Personal Information, including encryption of data in transit and restricting access to those who need it. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

11. Minors

The Site is not intended for individuals under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Third-Party Links

The Site may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of every site you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. When we make material changes, we will update the "Last updated" date at the top of this page.

14. Contact Us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us:

LUXORA GLOBAL LLC (dba Vystaco) 1001 S Main St, Ste 600 Kalispell, MT 59901 United States

Email: hellovystaco@gmail.com

⚠️ INTERNAL CHECKLIST — DELETE THIS SECTION BEFORE PUBLISHING

Links I could verify against live sources:

• accountscenter.facebook.com — confirmed; Meta moved ad controls out of the old facebook.com/settings/?tab=ads URL into Accounts Center. Your previous policy used the outdated link.
• adssettings.google.com/anonymous — confirmed live. Your previous link (google.com/settings/ads/anonymous) is the older form.

Links I could NOT verify — please open each one before publishing:

• shopify.com/legal/privacy [FACT: source needs verification]
• policies.google.com/privacy [FACT: source needs verification]
• tools.google.com/dlpage/gaoptout [FACT: source needs verification]
• facebook.com/privacy/policy [FACT: source needs verification]
• klaviyo.com/legal/privacy [FACT: source needs verification]
• optout.aboutads.info [FACT: source needs verification]
• optout.networkadvertising.org [FACT: source needs verification — the NAI has changed domains previously]

Decisions you need to confirm:

1. Entity change. This version names LUXORA GLOBAL LLC. Your previous policy named BGS ECOMMERCE LLC. Make sure the entity name is identical across: Terms of Service, Refund Policy, Shipping Policy, Shopify checkout/billing settings, order confirmation emails, and your Shopify Payments account. A mismatch between the policy and the name on the customer's bank statement is a common chargeback trigger.
2. Klaviyo SMS. Section 3 assumes you collect phone numbers for SMS/RCS marketing. Remove that section if you do not.
3. Meta Conversions API. Section 1 states you use it. Remove if not implemented.
4. California opt-out mechanism. Section 4 discloses "sharing" and Section 7 references GPC. To back this up you need Shopify's customer privacy / data-sale opt-out setting switched on, plus a cookie banner for EEA/UK visitors. [FACT: exact Shopify setting path needs verification in your admin.]
5. Google Analytics. Remove that row from the Section 4 table if you are not running GA on the store.
6. Not legal advice. This is a drafted template, not a lawyer's work product. If you are actively selling into the EEA/UK, a lawyer should review whether you need an Article 27 EU representative.