Privacy Policy
Privacy Policy
Effective date: Aug 1, 2026 Last updated: Aug 1, 2026
The short version
We sell dietary supplements online. To do that we collect what you'd expect: your name, address, email, what you ordered, and how you used the site.
Three things worth knowing up front:
- We run advertising pixels. That means some information about your visit goes to advertising platforms, which counts as "selling" or "sharing" your personal information under several state privacy laws. You can turn it off — see Section 7.
- What you buy is commercial data. Mattiva is marketed to people who use cannabis, and purchase events go to the advertising platforms listed in Section 5. We don't collect health information. Section 8 sets out what we hold and what we don't.
- You have rights over your data regardless of where you live. We extend the same rights to everyone in the US, not only residents of states that mandate them. Section 10.
This summary is not the policy. The rest of the document is.
1. Who we are
Mattiva is operated by NPK Industries, LLC d.b.a. mattiva, Mattiva Health, an Arizona limited liability company, at 9424 E Corrine Dr Scottsdale, Arizona 85260. We are the controller of the personal information described here.
Privacy questions: privacy@mattivahealth.com. Everything else: hello@mattivahealth.com.
This policy covers mattivahealth.com and our marketing emails. It does not cover third-party sites we link to.
2. Information we collect
You give us:
| What | When |
|---|---|
| Name, shipping and billing address, email, phone (optional) | Placing an order, creating an account |
| Order contents, order history, subscription settings | Ordering |
| Email address | Signing up for the newsletter |
| Message content | Contacting support, requesting a COA |
| Reviews, photos, and other content you post | Posting |
We collect automatically when you use the site:
- IP address, approximate location derived from it (city/region level), device type, browser, operating system, and language
- Pages viewed, referring page, links clicked, searches run, time on page
- Cart contents, including items you didn't buy
- Cookie and pixel identifiers, and advertising IDs (Section 6)
We get from others:
- Payment confirmation and fraud signals from our payment processor. We do not receive or store your full card number — it goes directly to the processor. We may store the last four digits, card brand, and expiry so you can recognize a saved method.
- Fulfilment and tracking status from our fulfilment partner and carriers.
- Email engagement (opens, clicks, bounces) from our email platform.
- Aggregate advertising and analytics reporting from advertising platforms.
We do not collect government ID numbers, Social Security numbers, financial account numbers, precise geolocation, biometric data, or health records. We do not ask for and do not want your medical history.
3. How we use it
- Take, process, fulfil, and deliver your order, and handle returns and refunds
- Run subscriptions: charge renewals, send reminders, process skips, pauses, and cancellations
- Answer your emails and provide support
- Send transactional email — order confirmations, shipping notices, renewal reminders, the Vacay email series if you buy the kit
- Send marketing email, if you asked for it or bought from us, until you unsubscribe
- Detect, investigate, and prevent fraud, chargebacks, and abuse of our returns policy
- Understand what's working: which pages convert, which emails get read, what people search for
- Advertise, including showing ads to people who visited the site and building similar-audience segments (Section 6)
- Comply with law — tax, accounting, consumer-protection, and FDA/FTC recordkeeping — and respond to lawful requests
- Establish, exercise, or defend legal claims
We do not use automated decision-making that produces a legal or similarly significant effect on you. We do not profile you for anything beyond the advertising and analytics described here.
4. Legal bases (for anyone this applies to)
Where a legal basis is required, we rely on: performance of a contract (fulfilling your order), legitimate interests (fraud prevention, site analytics, direct marketing to existing customers, defending claims), consent (advertising cookies, newsletter signup where required), and legal obligation (tax and regulatory records).
5. Who we share it with
Service providers, who may only use it to perform services for us:
| Category | What they get | Who [verify before publishing] |
|---|---|---|
| Payment processing | Name, billing address, amount, card data direct to them | Authorize.net / NMI and the acquiring bank |
| Fulfilment and shipping | Name, shipping address, order contents | Supliful, and carriers USPS/UPS |
| Website hosting | Everything on the site | Shopify |
| Email address, name, order and engagement data | Siteground | |
| Analytics | Site usage data, identifiers | |
| Customer support / forms | Message content | Shopify |
| Fraud prevention | Order and device signals | Shopify |
Advertising platforms. We use pixels and tags from Meta, Google, TikTok that receive identifiers, page-view and purchase events. This is the disclosure in Section 7 — under California and several other state laws this is a sale or sharing of personal information, whether or not money changes hands.
Other:
- In a business transfer — if we are acquired or merge, personal information may transfer. We will post notice here first.
- For legal reasons — to comply with law, a subpoena, or a court order; to enforce our Terms; or to protect the rights, safety, or property of Mattiva, our customers, or the public. We will push back on requests we consider overbroad and, unless legally prohibited, tell you if your data is demanded.
We do not sell your name, email address, postal address, or order history to data brokers, list brokers, or anyone else, for any price.
6. Cookies, pixels, and tracking
We use:
- Strictly necessary cookies — cart, checkout, login, age-gate acknowledgment, security. The site does not work without these and they cannot be turned off.
- Analytics cookies — how the site is used, in aggregate.
- Advertising cookies and pixels — to show you Mattiva ads elsewhere and to measure whether they worked.
Your choices:
- We honor the Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as an opt-out of sale/sharing for that browser, automatically, with no further action from you.
- Browser controls let you block or delete cookies. Blocking strictly necessary cookies will break checkout.
- Platform-level opt-outs are available from [Meta] and [Google] directly.
The age gate stores a single cookie recording that someone confirmed they are 18+. It stores no age, no date of birth, and nothing identifying.
7. "Do Not Sell or Share My Personal Information"
Because we use advertising pixels, we share personal information for cross-context behavioral advertising, and that activity is treated as a sale under some state laws. No money is exchanged for your data — but the legal definition is broader than money, and we would rather over-disclose than argue about it.
To opt out:
- Reject advertising cookies in the cookie banner, or
- Browse with Global Privacy Control enabled — we honor it automatically, or
- Email privacy@mattivahealth.com with "Opt out" in the subject.
Opting out does not change your prices, your service, or your access to anything. We do not offer financial incentives in exchange for your data, and we do not discriminate against anyone who exercises a privacy right.
We do not knowingly sell or share the personal information of anyone under 16.
8. Sensitive information
We do not collect health information. We don't ask about conditions, medications, symptoms, or diagnoses, and we ask you not to send them to us. If you include health details in a support email, we use them only to answer you.
We do not collect "sensitive personal information" as that term is defined by the California Consumer Privacy Act — health data, precise geolocation, government identifiers, racial or ethnic origin, biometric data, or the contents of your communications with anyone other than us. Because we don't collect it, there is nothing for the right to limit its use to apply to.
What we do hold is ordinary commercial information: what you bought, when, and how you reached the site. That information goes to the service providers in Section 5 and to the advertising platforms described in Sections 5 and 7.
Mattiva is marketed to people who use cannabis, so a purchase from us is information you may prefer not to have shared with an advertising platform. If so, opt out under Section 7 before you order, or email us and we will take your order manually.
9. How long we keep it
| Data | Retention |
|---|---|
| Order and transaction records | 7 years — tax, accounting, and consumer-protection recordkeeping |
| Account details | While your account is open, then 24 months, then deleted or anonymised |
| Marketing list membership | Until you unsubscribe, then a suppression record so we don't email you again |
| Support emails | 24 months |
| Analytics and advertising identifiers | 14 months or the platform's default, whichever is shorter |
| Age-gate cookie | 30 days |
| Reviews you posted | Until you or we remove them |
We delete or anonymise when the period ends, unless we have to keep something for a legal claim or obligation.
10. Your rights and how to use them
We extend these rights to every US resident, regardless of whether your state has a comprehensive privacy law. Twenty states did as of 2026 and the list keeps growing; running two standards is more error-prone than running one.
You may ask us to:
- Know what personal information we hold about you, where we got it, why we have it, and who we disclosed it to
- Get a copy in a portable format
- Correct anything inaccurate
- Delete it, subject to records we must legally keep (order records, mainly)
- Opt out of sale/sharing for advertising (Section 7) and of marketing email
- Not be discriminated against for exercising any of these
How: email privacy@mattivahealth.com, or use the contact form. We will acknowledge within 10 days and respond within 45 days, extendable once by another 45 where the request is complex — we'll tell you if we need the extension.
Verification. We will ask you to confirm details we already hold — typically the email on your account and an order number. We won't ask for a government ID. If we can't verify you, we'll say so rather than guess.
Authorized agents may submit a request with your written permission; we may still contact you to confirm.
Appeals. If we refuse a request, we will tell you why and how to appeal. Send an appeal to privacy@mattivahealth.com with "Appeal" in the subject; we respond within 45 days. If we deny the appeal, we will give you the contact details for your state attorney general.
California: you may also request the specific categories listed in Sections 2, 3, and 5, and the right to limit use of sensitive personal information — though as Section 8 explains, we don't process it for the purposes that right covers.
11. Email and marketing
We email you about your order regardless — you can't unsubscribe from a shipping notice or a renewal reminder for an active subscription.
Marketing email only goes to people who signed up or bought from us. Every marketing email has an unsubscribe link and our physical mailing address, as CAN-SPAM requires. Unsubscribing takes effect within 10 business days and usually immediately.
[If we introduce SMS, it will be separate opt-in with its own consent, and this section will be updated before a single message is sent.]
12. Children
The Site is for adults. We do not knowingly collect personal information from anyone under 18, do not knowingly sell to them, and do not knowingly sell or share the data of anyone under 16 for advertising. If you believe a minor has given us information, email privacy@mattivahealth.com and we will delete it.
13. Security
We use TLS across the site, restrict access to customer data to people who need it, and rely on PCI-compliant processors so that full card numbers never touch our systems. No method of transmission or storage is perfectly secure, and we can't guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant regulators as required by law.
14. Where your information goes
We operate in the United States and store personal information here. Our service providers may process it elsewhere. If we ever transfer data internationally in a way that requires a safeguard, we will put one in place and update this policy.
15. Third-party links
The Site links to other sites. We're not responsible for their privacy practices. Read their policies.
16. Changes to this policy
We may update this policy. The "Last updated" date changes and the new version is posted here. For a material change — a new category of sharing, a new advertising platform, a new purpose — we will give notice by email to account holders and by a notice on the Site before it takes effect. We will not apply a materially different use to information already collected without your consent where consent is required.
17. Contact
NPK Industries, LLC d.b.a. mattiva, Mattiva Health, at 9424 E Corrine Dr Scottsdale, Arizona 85260. privacy@mattivahealth.com
We answer privacy email from a person, usually within one business day.
