Legal

Privacy Policy

DRAFT TEMPLATE — generated for review. Not legal advice. Have qualified counsel review before publishing.

Placeholders in brackets ([DATE], [ENTITY], [ADDRESS]) must be completed before this document is published. Where this template references specific processors (Stripe, Klaviyo, Vercel), confirm they match your live integrations and update as needed.

Privacy Policy

THESIS — havethesis.com

Effective date: [DATE] Last updated: [DATE]

This Privacy Policy describes how Thesis Labs, Inc. ([ENTITY], "THESIS," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit havethesis.com (the "Site"), join our waitlist, create an account, place an order, or otherwise interact with us (collectively, the "Services").

THESIS sells THESIS Flow, a dietary supplement in dissolvable-strip format. Our products contain caffeine and are intended for adults. The Services are not directed to, and we do not knowingly sell to, individuals under 18 years of age. See Section 11 (Children's Privacy).

By using the Services, you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Services.

1. Scope of This Policy

This Policy applies to personal information we collect through the Services and in connection with our marketing, sales, and customer-support activities. It does not apply to:

Third-party websites, products, or services that we do not own or control, even if linked from the Site (for example, a payment provider's own pages or a social-media platform); or
Information you provide directly to third parties whose terms and privacy policies govern that information.

We encourage you to review the privacy notices of any third party before providing them with personal information.

2. Information We Collect

We collect personal information in three ways: (a) information you provide directly; (b) information collected automatically; and (c) information we receive from third parties.

2.1 Information You Provide Directly

Waitlist and marketing sign-ups — your email address (and, if you provide it, your name) when you join the waitlist or subscribe to marketing communications.
Account information — name, email address, password (stored only in hashed form), and account preferences when you create an account.
Order information — products ordered, order value, shipping and billing addresses, recipient name, phone number (if provided), and order history.
Payment information — payment-card or wallet details are collected and processed by our payment processor (Stripe, which also routes Apple Pay and any other payment methods shown at checkout, such as PayPal if enabled). We do not receive or store full card numbers; we receive limited transaction metadata such as a payment confirmation, the card brand, the last four digits, and the billing ZIP/postal code. See Section 4.
Customer-support communications — the contents of emails or messages you send to hello@havethesis.com or support@havethesis.com, including any information you choose to include.
Other information you choose to provide — survey responses, reviews, feedback, referral details, or content you submit.

2.2 Information We Collect Automatically

When you use the Services, we and our service providers automatically collect:

Device and connection data — IP address, browser type and version, operating system, device identifiers, language settings, and referring/exit URLs.
Usage data — pages viewed, links and buttons clicked, products viewed and added to cart, session duration, timestamps, and navigation paths.
Cookies and similar technologies — see Section 5 (Cookies and Tracking Technologies).
Approximate location — derived from your IP address (for example, country, region, or city), used for fraud prevention, tax/shipping estimation, and regional compliance (such as displaying applicable consumer-rights notices).

2.3 Information From Third Parties

Payment processors — confirmation of payment, fraud-risk signals, and limited transaction metadata from Stripe / Apple Pay / other checkout payment methods if enabled.
Email and marketing platform — engagement data (opens, clicks, deliverability, list status) from Klaviyo.
Shipping and fulfillment providers — tracking and delivery-status updates from carriers and our third-party logistics (3PL) provider.
Analytics and advertising partners — aggregated or pseudonymized audience and performance data.
Social-media platforms — limited profile information if you interact with us through a social platform, consistent with that platform's settings and policies.

We do not collect or intentionally process special categories of sensitive personal information (such as health diagnoses, biometric identifiers, or government-ID numbers) through the Services. Please do not submit such information to us. Note that purchasing a dietary supplement is a commercial transaction and is not treated by us as health information about you.

3. How We Use Personal Information

We use personal information for the following purposes:

To operate the Services and fulfill orders — process and ship orders, manage your account, handle returns and exchanges, and provide order confirmations and shipping updates.
To process payments — authorize, settle, and reconcile transactions through Stripe, Apple Pay, and any other payment methods shown at checkout, and to detect and prevent payment fraud.
To manage subscriptions — administer recurring subscription orders, send pre-billing and renewal reminders where required, and process cancellations.
To communicate with you — respond to inquiries, send transactional messages (order, shipping, subscription, account, and security notices), and provide customer support.
To send marketing communications — with your consent where required, send newsletters, product announcements, waitlist updates, and promotional offers. You can opt out at any time (see Section 6).
To personalize and improve the Services — understand how the Services are used, develop new features, conduct analytics, and improve product, content, and user experience.
For security and fraud prevention — protect the Services, detect and prevent fraudulent, unauthorized, or illegal activity, and enforce our Terms of Service.
For legal and compliance purposes — comply with applicable laws, tax and recordkeeping obligations, age-verification and caffeine-related sale restrictions, consumer-protection requirements, and respond to lawful requests and legal process.
For corporate transactions — evaluate or carry out a merger, acquisition, financing, reorganization, or sale of assets (see Section 4.4).

We do not use personal information to make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement.

4. How We Share Personal Information

We do not sell your personal information for money. We share personal information only as described below.

4.1 Service Providers and Processors

We share personal information with vendors who perform services on our behalf and are contractually bound to protect it and use it only for the purposes we specify:

Processor	Purpose
Stripe (incl. Apple Pay and other enabled checkout payment methods)	Payment processing, fraud prevention, transaction reconciliation
Klaviyo	Email and marketing communications, list management, engagement analytics
Vercel	Website and application hosting, content delivery, edge/serverless infrastructure
Shipping carriers and 3PL provider	Order fulfillment, packing, shipping, delivery, and tracking
Analytics providers	Site and product analytics, performance measurement
Customer-support tooling	Handling and routing support inquiries

4.2 Advertising and Analytics Partners

We may share certain online identifiers and usage data with analytics and advertising partners to measure performance and, where permitted and consistent with your choices, to deliver and measure relevant advertising. Depending on your jurisdiction and the cookies in use, some of this activity may be considered "selling" or "sharing" of personal information under California law — see Section 8 for how to exercise your Do Not Sell or Share right.

4.3 Legal, Safety, and Compliance

We may disclose personal information when we believe in good faith it is necessary to: comply with applicable law, regulation, legal process, or governmental request; enforce our Terms of Service; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of THESIS, our customers, or the public.

4.4 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy with equivalent protections.

4.5 With Your Direction or Consent

We may share personal information for other purposes you direct or to which you consent.

5. Cookies and Tracking Technologies

We and our service providers use cookies, web beacons, pixels, local storage, and similar technologies ("cookies") to operate the Site, remember your preferences, analyze traffic, and support marketing.

Categories of cookies we use:

Strictly necessary — required for core functionality such as maintaining your cart, session, and security. These cannot be switched off through our controls.
Functional — remember your preferences and settings.
Analytics/performance — help us understand how the Site is used so we can improve it.
Marketing/advertising — used to measure and, where permitted, deliver relevant advertising and measure its effectiveness.

Your choices:

Browser controls — most browsers let you block or delete cookies. Blocking some cookies may affect Site functionality.
Global Privacy Control (GPC) — where required, we treat a valid GPC browser signal as a request to opt out of "sale"/"sharing" of personal information for the associated browser or device. See Section 8.3.
Cookie banner / preferences — where required by law (for example, for EU/UK visitors), we present a consent banner allowing you to accept or reject non-essential cookies.

We do not guarantee that the Site responds to all browser "Do Not Track" signals; we honor recognized opt-out preference signals (such as GPC) as described in Section 8.

6. Email Marketing, Consent, and Your Choices (CAN-SPAM)

Consent — we send marketing emails consistent with applicable law. Where required (for example, for EU/UK recipients), we obtain your consent before sending marketing communications; in other regions, we rely on your relationship with us and provide an opt-out.
Transactional messages — order confirmations, shipping notices, subscription/renewal notices, account and security alerts, and similar messages are not marketing and are sent regardless of marketing preferences.
Unsubscribe — every marketing email includes a clear unsubscribe link. You may also email support@havethesis.com with the subject line "Unsubscribe." We honor opt-out requests promptly, and in any event within 10 business days, consistent with the CAN-SPAM Act.
Physical address — our marketing emails include a valid physical mailing address: [ADDRESS].
Honest headers — we use accurate "From," "To," and subject lines and do not use deceptive routing information.

Opting out of marketing emails does not stop transactional messages necessary to administer your orders, account, or subscription.

7. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, including to provide the Services, comply with our legal, tax, accounting, and recordkeeping obligations, resolve disputes, and enforce our agreements.

General retention guidance (actual periods may vary based on legal requirements):

Order and transaction records — retained for the period required by applicable tax and commercial law (commonly several years).
Account information — retained while your account is active and for a reasonable period thereafter.
Marketing data — retained until you unsubscribe or request deletion, plus a short suppression-list period to honor your opt-out.
Waitlist sign-ups — retained until conversion, deletion request, or the waitlist program ends.
Support communications — retained as needed to resolve and document inquiries.

When personal information is no longer needed, we delete, de-identify, or aggregate it, or securely store it where deletion is not yet feasible (for example, in backups), in which case we isolate it from further active use until deletion is possible.

8. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), provides you the rights described below, subject to verification and legal exceptions.

8.1 Your Rights

Right to know / access — request the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it.
Right to delete — request deletion of personal information we collected from you, subject to exceptions.
Right to correct — request correction of inaccurate personal information.
Right to opt out of sale or sharing — direct us not to "sell" or "share" your personal information (see Section 8.3).
Right to limit use of sensitive personal information — we do not use or disclose sensitive personal information for purposes that trigger this right.
Right to non-discrimination — we will not discriminate against you for exercising your rights.

8.2 Categories of Information Collected, Disclosed, and "Sold"/"Shared"

In the preceding 12 months, we have collected the categories of personal information described in Section 2 (identifiers; customer records; commercial information; internet/network activity; approximate geolocation; and inferences). We disclose these categories to the service providers and partners described in Section 4. We do not sell personal information for monetary consideration. Depending on the cookies and advertising technologies in use, certain disclosures to analytics/advertising partners may constitute "sharing" (cross-context behavioral advertising) or "selling" under the CCPA/CPRA, and you may opt out as described below.

8.3 How to Exercise "Do Not Sell or Share"

Use the "Do Not Sell or Share My Personal Information" link in the Site footer; or
Send a valid Global Privacy Control (GPC) signal from your browser, which we treat as an opt-out request for that browser or device; or
Email support@havethesis.com with the subject "Do Not Sell or Share."

8.4 How to Submit a Request and Verification

Submit access, deletion, or correction requests by emailing support@havethesis.com. We will verify your identity using information reasonably necessary to confirm you are the person about whom we hold information. You may use an authorized agent to submit a request on your behalf with proof of authorization. We will respond within the timeframes required by law (generally within 45 days, extendable by an additional 45 days with notice).

8.5 Other State Privacy Rights

Residents of other U.S. states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, and others) may have similar rights, including rights to access, correct, delete, obtain a copy of, and opt out of certain processing (including targeted advertising and any "sale"). To exercise these rights, contact us as described in Section 13. Where required, you may appeal a denial of your request by replying to our response.

9. Your Rights in the EU, EEA, and UK (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the GDPR and UK GDPR provide you the rights below.

9.1 Lawful Bases for Processing

We process personal information under one or more of the following lawful bases:

Performance of a contract — to process and fulfill your orders, manage your account, and administer subscriptions.
Consent — for marketing communications and non-essential cookies, where required. You may withdraw consent at any time without affecting prior processing.
Legitimate interests — to operate, secure, analyze, and improve the Services, prevent fraud, and pursue our legitimate business interests, balanced against your rights.
Legal obligation — to comply with applicable laws, including tax, accounting, and consumer-protection requirements.

9.2 Your Rights

Subject to applicable law, you have the right to: access your personal information; request rectification of inaccurate data; request erasure; restrict or object to processing; request data portability; and withdraw consent. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

To exercise these rights, contact us as described in Section 13. We will respond within the timeframes required by law (generally within one month).

10. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure. These include encryption of data in transit (HTTPS/TLS), restricted access on a need-to-know basis, use of reputable processors (such as Stripe for payment data), and tokenization of payment credentials so that we do not store full card numbers.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you transmit information to us at your own risk. Please keep your account credentials confidential and notify us promptly at support@havethesis.com if you suspect unauthorized access to your account.

11. Children's Privacy

The Services are intended for adults. Because THESIS Flow contains caffeine, we do not knowingly sell to, or collect personal information from, anyone under 18 years of age. We do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA) or from minors in violation of applicable law. If you believe a minor has provided us personal information, contact support@havethesis.com and we will take reasonable steps to delete it.

12. International Data Transfers

We are based in the United States, and our service providers may process personal information in the United States and other countries whose data-protection laws may differ from those in your jurisdiction. Where we transfer personal information from the EEA, the UK, or Switzerland to a country not deemed to provide an adequate level of protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, as applicable), or another lawful transfer mechanism. You may request more information about these safeguards by contacting us.

13. Contact Us

For privacy questions or to exercise your rights, contact:

Thesis Labs, Inc. ([ENTITY]) Attn: Privacy [ADDRESS] Email: support@havethesis.com · hello@havethesis.com Website: https://havethesis.com

We will respond to your inquiry within the timeframes required by applicable law.

14. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, if the changes are material, provide additional notice (such as a notice on the Site or by email). Your continued use of the Services after the effective date of an updated Policy constitutes acceptance of the changes.

DRAFT TEMPLATE — generated for review. Not legal advice. Have qualified counsel review before publishing. Complete all [DATE], [ENTITY], and [ADDRESS] placeholders and confirm processor names match your live integrations before this document is published.