Privacy policy

Effective date: August 2, 2026. Last updated: August 2, 2026.

This policy explains what personal information brasa collects, why we collect it, who we share it with, and the choices you have. It is written to be read, not to be survived.

1. Who we are

brasa ("brasa," "we," "us," "our") sells gentle iron oral strips and related products through hellobrasa.com and its checkout (together, the "Services"). Our mailing address is 3550 Altis Cir N, Hialeah, FL 33018, United States.

For questions about this policy or to exercise a privacy right, email support@hellobrasa.com or use the contact page.

Our store is hosted by Shopify Inc., which processes personal information on our behalf to operate the Services and, for certain features, for its own purposes. See the Shopify Consumer Privacy Policy at shopify.com/legal/consumer-privacy-policy.

2. Who this policy covers

The Services are intended for customers in the United States and the other destinations listed in our shipping policy. We do not target the European Economic Area or the United Kingdom, and we do not currently sell or ship to the United Kingdom. If you access the Services from outside the United States, your information will be processed in the United States, where privacy laws differ from those in your country.

The Services are not directed to children. We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share the personal information of anyone under 16. Our products are not intended for children, and iron products should be kept out of their reach. If you believe a child has given us personal information, email support@hellobrasa.com and we will delete it.

3. Information we collect

We collect only what we need to sell you a product, deliver it, support you afterward, keep the store secure, and market responsibly.

You give us directly:

• Name, email address, phone number, shipping address, and billing address when you place an order or create an account.
• Order contents, quantity, subscription selection, and gift or bundle selections.
• Messages, photos, order numbers, lot codes, and other information you send us through the contact page, by email, or when you submit a guarantee, damage, or shipping claim.
• Content you choose to publish, including product reviews, ratings, and any photos submitted with them.
• Your email address and, if you provide it, your phone number when you sign up for marketing.

We collect automatically when you use the Services:

• Device and connection information: IP address, browser type, operating system, device identifiers, referring page, and language.
• Usage information: pages viewed, products viewed, items added to cart, searches, clicks, session duration, and the path you take through the site.
• Cookies, pixels, tags, local storage, and similar technologies, described in section 7.

We receive from others:

• Payment confirmation, partial card details such as the last four digits and card brand, and fraud signals from our payment processors. We never receive or store your full payment card number. Card data goes directly to the processor.
• Fulfillment and delivery status, tracking numbers, and delivery scans from our fulfillment partners and carriers.
• Aggregated and event-level advertising measurement from advertising platforms, including whether an ad click led to a purchase.

We do not collect: government identification numbers, financial account numbers, precise geolocation, biometric identifiers, genetic data, or the contents of your medical records. We do not ask for and do not want your lab results, ferritin values, diagnoses, or medication lists. Please do not send them to us. If you send health details anyway, section 4 explains how we treat them.

4. Health-related information

We sell an iron supplement, so some information can imply something about your health. A purchase of brasa, a subscription to brasa, a message describing why you are buying it, or a review describing how you felt can all reasonably be linked to a health interest.

We treat that category as sensitive. Specifically:

• We do not sell health-related information, and we do not share it for cross-context behavioral advertising.
• We do not use the content of your support messages, guarantee claims, or reviews to build advertising audiences.
• We limit internal access to support and fulfillment staff who need it to do their job.
• We keep claim photographs and lot codes only as long as needed to resolve the claim and to meet our record-keeping obligations, then delete them.

Washington and Nevada residents: our separate Consumer Health Data Privacy Policy governs consumer health data as those laws define it, and it controls over this policy where they conflict.

We are not a healthcare provider, and we are not a HIPAA covered entity. Nothing you send us is protected health information under HIPAA.

5. How we use information

• To sell and deliver. Process orders and payments, verify identity for fraud purposes, arrange fulfillment and shipping, send order and shipping confirmations, and manage returns, guarantee claims, and shipping claims.
• To run subscriptions. Manage a monthly refill you have chosen, send the notices described in our terms of service, process recurring charges, and process cancellations.
• To support you. Answer questions, investigate claims, and keep a record of what we told you.
• To improve the Services. Understand which pages and products work, diagnose errors, and test changes. Wherever it is practical, we do this with aggregated or de-identified data.
• To market. Send email marketing you asked for, send text messages only if you separately opted in, and show ads on other platforms. See sections 6 and 8 for your controls.
• To keep the store safe. Detect and prevent fraud, abuse of the guarantee, chargeback fraud, bot traffic, and security incidents.
• To meet legal obligations. Tax and accounting records, responses to lawful requests, and establishing or defending legal claims, including a payment dispute.

We do not use automated decision-making that produces legal or similarly significant effects about you. Guarantee claims are reviewed by a person.

6. How we share information

We share personal information with the following categories of recipients, for the purposes described:

• Commerce platform. Shopify Inc., which hosts the store, checkout, and customer accounts.
• Payment processing. Shopify Payments and the alternative wallets shown at checkout, including PayPal, Apple Pay, Google Pay, and Shop Pay.
• Fulfillment and shipping. Our supplement fulfillment partner, our accessory fulfillment partner, and carriers, which receive the name, address, phone number, and contents needed to ship your order.
• Subscriptions. Our subscription application, which manages recurring orders and cancellations.
• Reviews. Our reviews application, which collects, stores, and publishes reviews and ratings.
• Email and messaging. Our email and messaging providers, which send transactional and marketing messages.
• Analytics and advertising. Google Analytics, Meta, and our on-site behavior analytics tool, described in section 7.
• Professional advisors. Accountants, auditors, and lawyers, under confidentiality obligations.
• Legal and safety. Government or law enforcement bodies where we are legally required to respond, and other parties where necessary to establish, exercise, or defend legal claims or to protect someone's safety.
• Business transfer. An acquirer, successor, or lender in connection with a merger, financing, reorganization, or sale of assets, subject to this policy.

We do not sell personal information for money.

Some of our advertising and analytics tools do count as a "sale" or as "sharing for cross-context behavioral advertising" under California and other state laws, because they disclose identifiers and browsing activity to advertising platforms that may use them for their own advertising purposes. We treat them that way and give you an opt-out. See section 8.

We do not knowingly disclose personal information to data brokers, list brokers, or people-search services.

7. Cookies, pixels, and analytics

The Services use cookies and similar technologies for four purposes:

• Strictly necessary. Cart, checkout, session, security, and fraud prevention. These cannot be turned off without breaking the store.
• Performance and analytics. Google Analytics and an on-site behavior analytics tool that records aggregate interaction and page-performance data. Where these tools offer it, we enable the setting that masks what you type into form fields, and payment fields are handled by our payment processor and are never exposed to them.
• Advertising. The Meta pixel and related advertising tags, which record page views, product views, add-to-carts, and purchases and connect them to advertising platforms so we can measure and target advertising.
• Preferences. Remembering settings such as your opt-out choice.

Most browsers let you block or delete cookies. Blocking strictly necessary cookies will break checkout.

We honor the Global Privacy Control ("GPC") and other recognized universal opt-out signals as a request to opt out of the sale and sharing of personal information from the browser that sends the signal. Because the signal is stored per browser, you will need to send it from each browser and device you use.

8. Your choices and rights

Marketing email. Every marketing email has an unsubscribe link. Transactional messages about an order, a claim, or a subscription are not marketing and will continue.

Text messages. We send marketing texts only to people who separately agreed to receive them. Reply STOP to any message to stop. Message and data rates may apply. Consent to marketing texts is never a condition of buying anything.

Opt out of targeted advertising, sale, and sharing. Use our Do Not Sell or Share My Personal Information page, or send a GPC signal from your browser. You may also use the ad settings offered by Meta and Google directly.

Access, correction, deletion, and portability. You may ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, and ask for a portable copy. Email support@hellobrasa.com with the email address you used to order.

Limit the use of sensitive information. You may ask us to limit our use of health-related information to what is needed to provide the product and support you.

No retaliation. We will not deny you products, charge you a different price, or give you a lower level of service because you exercised a privacy right.

How we handle a request. We respond within 45 days, and we may extend once by another 45 days where the law allows, telling you why. To protect you, we verify a request by matching it to information already in our records, usually the order email address. We do not create new accounts or ask for identity documents to verify a routine request. If we cannot verify you, we will say so rather than disclose someone's data to the wrong person.

Authorized agents. An agent may submit a request on your behalf with written permission signed by you. We may contact you to confirm.

Appeals. If we refuse a request, our response will explain why and how to appeal. To appeal, reply to that response with the word "appeal." We will decide the appeal within 45 days and give you a written explanation. If we deny the appeal, you may complain to your state attorney general.

State-specific note. State privacy laws apply based on where you live and on our size. We extend the rights above to every US customer as a matter of policy, whether or not a particular law requires it of a business our size. That is a promise we intend to keep, not a claim that every state law applies to us.

9. Retention

We keep order and transaction records for as long as needed to run the business and to satisfy tax, accounting, and legal obligations, which is generally seven years. We keep support conversations for three years. We keep guarantee-claim photographs and lot codes until the claim is resolved and any dispute window has closed, and no longer than 24 months. We keep marketing contact data until you unsubscribe and then for a short suppression period so we do not accidentally message you again. We keep advertising and analytics identifiers for the retention period offered by each platform, which is generally 14 months or less for event-level data.

10. Security

We use HTTPS across the store, rely on PCI-compliant payment processors so that card numbers never touch our systems, restrict administrative access to the store and to our email accounts to the smallest number of people who need it, and review connected application access periodically.

No method of transmission or storage is perfectly secure, and we do not claim otherwise. If a breach affects your personal information, we will notify you and the relevant regulators as required by law and without unreasonable delay.

11. Third-party links

The Services link to third-party sites and apps, including social platforms and our subscription and review tools. Their privacy practices are their own. This policy does not cover them.

12. Changes

We may update this policy. When we do, we will change the "last updated" date at the top. If a change materially reduces your rights or materially expands how we use your information, we will give notice on the site before it takes effect and, where the law requires it, ask for your consent.

Older versions are kept in our records. Ask us for a prior version and we will send it.

13. Contact

Email support@hellobrasa.com, or write to brasa, 3550 Altis Cir N, Hialeah, FL 33018, United States. We respond to privacy requests within 45 days and to ordinary questions within two business days.