Privacy Policy

Last Updated: November 7, 2026

Effective Date: November 7, 2026

Introduction

Welcome to TOHETAKA ("we," "our," or "us"). We are committed to protecting your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, www.tohetaka.com (the "Site"), create an account, make a purchase, or otherwise interact with our services.

This Privacy Policy applies to all visitors, customers, and others who use our Site. By using our Site, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use our Site.

We may update this Privacy Policy at any time. Changes take effect when we post the updated policy on our Site. Your continued use of the Site after changes are posted means you accept the updated policy.

Information We Collect

We collect information that identifies you personally and information that is about you but does not identify you. What we collect depends on how you interact with our Site.

Information You Provide to Us

Customer account: If you create an account, we collect your name, email address, and password. We use this to run your account, process your orders, and personalize your experience.
Purchases: When you place an order, we collect your billing and shipping information, including your full name, address, phone number, email address, and payment information. We use it to process your order, arrange shipping, send order confirmations and updates, and provide customer support.
Newsletter: If you subscribe to our newsletter or marketing emails, we collect your email address and anything else you choose to share, such as your name or skincare preferences.
Contacting us: When you contact us through our contact form or by email, we collect your name, email address, and the content of your message.
Surveys or promotions: If you take part in a survey, contest, or promotion, we may collect your preferences, feedback, or other information you provide.

Information Collected Automatically

Device information: such as your device type, operating system, browser type and version, and unique device identifiers.
Usage information: the pages you visit, the date and time of your visits, time spent on pages, links clicked, and other actions you take on our Site.
Location information: an approximate location based on your IP address, which helps us comply with applicable laws and provide location-specific content.
Cookies and similar technologies: see "Cookies and Tracking Technologies" below.

Information from Third Parties

Payment processors: When you make a purchase, our payment processors (such as Squarespace Payments, which runs on Stripe, or PayPal and Venmo) give us the information needed to process the transaction and prevent fraud. We do not see or store your full card number.
Social media platforms: If you interact with us through social media, we may receive information from those platforms according to their privacy policies.
Advertising and analytics partners: We may receive information from advertising and analytics partners, such as Meta, to help us understand our audience and improve our marketing.

How We Use Your Information

Order processing and customer service: to process and fulfill orders, arrange shipping, send confirmations and updates, and respond to your questions.
Account management: to maintain your account, verify your identity when you log in, and save your preferences and order history.
Marketing and communications: with your consent, to send you emails about our products, offers, and news. You can opt out at any time using the unsubscribe link in our emails or by contacting us.
Website improvement and analytics: to understand how visitors use the Site, find areas to improve, and make the Site better.
Advertising: to measure and improve our advertising, including on Meta platforms (Facebook and Instagram).
Legal compliance and protection: to comply with laws and legal processes, respond to lawful requests from public authorities, and protect our rights, property, and safety and those of others.
Fraud prevention and security: to detect, prevent, and address fraud, security breaches, and other prohibited or illegal activity.
Business operations: for record-keeping, internal reporting, and other administrative functions.

Legal Basis for Processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on these legal grounds: your consent (for example, marketing emails); contract performance (for example, fulfilling your order); our legitimate interests (for example, improving our services and preventing fraud), where they do not override your rights; and legal obligation.

How We Share Your Information

We do not sell your personal information for money. We share it only in the situations described here.

Service providers. We share information with trusted providers who help us run our business. They are bound to protect your information and use it only for the services they provide to us. They include:

Payment processors (Squarespace Payments, Stripe, PayPal, Venmo) to process transactions securely.
Shipping carriers and fulfillment services to deliver your orders. This includes your name, address, and order details.
Email marketing services, if you subscribe to our newsletter.
Website hosting and analytics (Squarespace, Google Analytics) to run the Site and understand how it is used.
Advertising partners (Meta) to measure and improve our advertising.
Customer support tools that may access your messages to us.

Legal requirements and protection. We may disclose information when we believe in good faith that we must: comply with a legal obligation such as a court order or subpoena; protect our rights, property, and safety or those of others; prevent fraud; or enforce our terms and policies.

Business transfers. If we are involved in a merger, acquisition, reorganization, sale of assets, or similar event, your information may be transferred to the new owner. We will give notice of any such transfer and any choices you have.

With your consent. We may share information with third parties when you have given us explicit permission.

Aggregated or de-identified information. We may share aggregated or de-identified information that cannot be used to identify you.

International Data Transfers

Our servers and database are in the United States. If you are located outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. For users in the EEA, the United Kingdom, or Switzerland, we use appropriate safeguards for international transfers, such as Standard Contractual Clauses.

Cookies and Tracking Technologies

Our Site uses cookies and similar technologies to improve your browsing experience, analyze site usage, and help with our marketing.

What are cookies? Cookies are small text files stored on your device when you visit a website. They let the site recognize your device and remember things about your visit, such as your preferences and actions.

Types of cookies we use

Essential cookies are needed for the Site to work, for example for security and checkout. They cannot be turned off.
Performance and analytics cookies help us understand how visitors use the Site. They may be provided by Squarespace Analytics or Google Analytics.
Functionality cookies remember choices you make, such as your region.
Marketing and advertising cookies help deliver ads that are more relevant to you and measure how well our advertising works.

Meta (Facebook) pixel. Our site uses the Meta (Facebook) pixel to understand how visitors use the site and to measure our advertising. You can limit this through your browser or Meta ad settings.

Your cookie choices

Browser settings: Most browsers let you refuse or delete cookies, or tell you when one is being set. If you turn cookies off, some parts of the Site may not work properly.
Cookie banner: If a cookie banner appears when you visit, you can use it to accept or decline non-essential cookies.
Ad settings and opt-out tools: You can adjust how Meta uses your information in your Facebook and Instagram ad settings, and use industry opt-out tools such as the Digital Advertising Alliance and Network Advertising Initiative opt-out pages.
Do Not Track: There is no standard for how websites should respond to "Do Not Track" signals, so we do not currently respond to them.

Similar technologies. We may also use web beacons (pixels), which are small images that help us measure the effectiveness of our marketing, and local storage, which keeps information on your device to improve site functionality.

Data Security

We take reasonable technical and organizational measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Payment information is encrypted in transit using SSL/TLS.
Our website is hosted on Squarespace's secure platform.
Payments are handled by PCI-compliant payment processors. We do not store complete card numbers.
We limit access to personal information to people and providers who need it to serve you.

You also play a part: choose a strong, unique password, keep your login private, and contact us right away if you notice suspicious activity on your account.

If a data breach affects your personal information, we will assess and contain it, notify the relevant authorities as the law requires, and notify affected people as the law requires.

Data Retention

We keep your personal information only as long as needed for the purposes we collected it for, to meet legal obligations, resolve disputes, and enforce our agreements.

Account information: for as long as your account is active, then deleted under our deletion procedures.
Order and transaction information: at least seven years, for tax and accounting.
Marketing communications: until you unsubscribe or ask us to delete your information.
Customer support records: up to three years.
Website analytics: in aggregated or anonymized form, for as long as our analytics provider keeps it.
Legal and compliance records: longer when the law requires.

When we no longer need your information, we delete or anonymize it using standard methods. Deleted information may remain in backups for a limited time before it is permanently removed.

Your Privacy Rights

Depending on where you live, you may have certain rights over your personal information.

GDPR (EEA, UK, Switzerland). You have the right to access, correct, and erase your personal information; to restrict or object to its processing; to data portability; to withdraw consent at any time; and to lodge a complaint with your local supervisory authority.

California (CCPA/CPRA). If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to delete it; to correct inaccurate information; to opt out of the sale or sharing of your personal information for targeted advertising; to limit the use of sensitive personal information; and not to receive discriminatory treatment for using these rights.

Other states. Residents of Virginia, Colorado, Connecticut, and other states with privacy laws may have similar rights, including to access, correct, delete, and opt out of certain processing.

How to use your rights. Email us at hello@tohetaka.com. We may ask for your name, email address, and an order number to verify your identity. We respond within the time the law requires, typically 30 days for GDPR requests and 45 days for CCPA requests. There is no fee unless a request is clearly unfounded, excessive, or repetitive. You may use an authorized agent to make a request for you, and we may ask for proof of their authorization. These rights are not absolute and may be limited by law. For example, we may need to keep certain records.

Children's Privacy

Our Site is not intended for children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have, we will delete it as quickly as possible. If you are a parent or guardian and believe your child has given us personal information, please email us. Parents and guardians may ask to review or delete their child's information, refuse further collection, or withdraw consent at any time. For users aged 13 to 18, we encourage parents and guardians to be involved in their online activity. Where the minimum age for data processing is higher than 13 in your location, you must be at least that age to use our Site.

Marketing Communications

We send marketing emails about our products, offers, and news only if you have consented, you are an existing customer and the message relates to similar products, or the law otherwise permits. We may also communicate with you on social media platforms where you choose to follow or interact with us.

You can opt out at any time by clicking the unsubscribe link in any marketing email, updating your preferences in your customer account, or emailing us. Even if you opt out of marketing, we may still send transactional messages such as order confirmations and shipping updates.

Third-Party Links and Services

Our Site may link to websites, applications, or services that we do not own or control, and this Privacy Policy does not apply to them. Please read their privacy policies. Our Site may also include social media features, such as sharing buttons and Instagram feeds, that may collect your IP address and the pages you visit and may set cookies. Those features are governed by the privacy policies of the companies that provide them.

Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will update the "Last Updated" date at the top. For material changes that significantly affect how we collect, use, or share your information, we will provide prominent notice, such as a notice on our Site or an email. Your continued use of the Site after changes means you accept the updated policy. If you do not agree, you should stop using the Site and may ask us to delete your personal information.

Contact Information

If you have questions, concerns, or requests about this Privacy Policy or our privacy practices, please contact us:

Tohetaka, LLC

Email: hello@tohetaka.com

We aim to respond to privacy inquiries within 30 days. For complex requests we may need more time, and we will let you know.

Governing Law and Jurisdiction

This Privacy Policy and any disputes arising out of or related to it are governed by the laws of the State of California, without regard to its conflict of law principles. Any legal action or proceeding arising under this Privacy Policy will be brought exclusively in the courts of San Diego County, California, and you consent to personal jurisdiction there.

Severability

If any part of this Privacy Policy is found to be unenforceable or invalid, that part will be limited or removed as much as necessary, and the rest will stay in full force and effect.

Entire Agreement

This Privacy Policy, together with our Terms of Sale, is the entire agreement between you and us on this subject and replaces any earlier understandings about it.

California "Shine the Light" Law

California Civil Code Section 1798.83 lets California residents request certain information about our disclosure of personal information to third parties for their direct marketing purposes. To make a request, email hello@tohetaka.com.

Do Not Sell or Share My Personal Information

We do not sell personal information for money. However, we share personal information with service providers and partners for business purposes such as:

Payment processing (Squarespace Payments, Stripe, PayPal, Venmo)
Shipping and fulfillment
Website hosting and analytics (Squarespace, Google Analytics)
Advertising measurement (Meta pixel)
Email marketing services, if you subscribe
Customer support tools
Security and fraud prevention

Under California law, some of these activities, such as advertising through the Meta pixel, may be considered "sharing" or "sale" of personal information. If you are a California resident and want to opt out, email hello@tohetaka.com with the subject line "Do Not Sell or Share My Information" and include the full name and email address associated with your account. We will process your request within 45 days and confirm by email. You will not receive discriminatory treatment for using this right.