Privacy Policy

Grass & Co. is a British wellbeing brand. This website is operated by Grass & Co. If you have any questions about this policy, please email hello@grassandco.com or write to Grass & Co., 24 Greville Street, London EC1N 8SS, United Kingdom.

This privacy policy explains how we collect, use, store and protect your personal information when you visit grassandco.lovable.app or interact with us through it. It applies whether you are browsing, signing up to the Grass Roots Club, using the contact form, or reading our journal.

We collect only the information we need: • **Email address** when you join the Grass Roots Club mailing list. • **Name, email and message** when you use the contact form. • **Technical data** such as your IP address, browser type and device information, collected automatically through our hosting and security systems. • **Usage data** such as pages visited and links clicked, if you choose to accept analytics cookies. We do not collect payment information on this site. All purchases are completed on Amazon, which has its own privacy policy.

We use your information to: • Send the Grass Roots Club emails you signed up for. • Respond to enquiries submitted through the contact form. • Keep the site secure and fix technical problems. • Improve the site and understand what content is useful, where you have consented to analytics cookies. We will never sell your personal information.

Under UK data protection law, we process your information because: • It is necessary to perform a contract with you or take steps at your request before entering a contract. • It is necessary for our legitimate interests, such as running and securing the website, provided those interests do not override your rights. • You have given consent, for example to receive marketing emails or to allow analytics cookies. You can withdraw consent at any time.

We use cookies to keep the site working and, with your consent, to understand how visitors use it. Essential cookies are always active. You can manage your preferences at any time by clicking the cookie button in the bottom corner of the page. For full details, see our Cookie Policy.

We use a small number of service providers who process data on our behalf: • **Lovable / Supabase** for hosting, database and authentication. • **Amazon** for fulfilment of product orders placed through Amazon links. • **Instagram / Meta** if you view embedded social content. • **Reviews.io** for displaying verified customer reviews. Each provider has its own privacy policy and is responsible for its own processing.

We keep your personal information only for as long as necessary: • Grass Roots Club email addresses are kept until you unsubscribe or we stop sending the newsletter. • Contact form messages are kept for up to two years so we can refer back to previous conversations. • Analytics data is kept for up to 26 months.

Under UK GDPR you have the right to: • Access the personal information we hold about you. • Correct inaccurate information. • Ask us to delete your information. • Object to or restrict certain processing. • Withdraw consent at any time. • Complain to the Information Commissioner's Office (ICO) if you believe your rights have been breached. To exercise any of these rights, email hello@grassandco.com.

We take reasonable technical and organisational measures to protect your information, including encryption in transit and access controls on our database. No system is completely secure, and we cannot guarantee the security of information transmitted over the internet.

Our products and website are not aimed at children under 18. We do not knowingly collect personal information from children.

We may update this privacy policy from time to time. The latest version will always be available on this page, and we will update the date at the top when changes are made.