Privacy
What we keep, what we don't.
The short version: we keep an email if you give us one, a visitor ID so the site remembers you between visits, and what you click. We don't sell your data. The longer version is below. Last updated 2026-04-28.
Who we are
habb is a brand operated by Valiso Ventures LLC, a Delaware limited liability company. Mailing address: 800 N King Street, Suite 304-3217, Wilmington, DE 19801. Reach us at hello@habb.co.
What we collect
- Email and phone — only if you submit them through a form (waitlist, quiz, journal, ambassador application). Phone is optional.
- What you said — your quiz answers, your ambassador application fields. Same form you filled in.
- A visitor ID — a random string we save in your browser so the site remembers you between visits. No name, no email, no number.
- Analytics events — pages you saw, what you clicked, scroll depth, the source you came from (referrer, ad campaign tag). Used to understand what is working on the site.
- Order details — when checkout opens, your shipping address, billing details, and what you bought. Payment is processed by Shopify Payments (which uses Stripe as its underlying processor); we never see full card numbers.
Why we collect it
- To send you the email you asked for (waitlist confirmation, journal, ambassador updates).
- To recognize returning visitors so the site behaves consistently.
- To measure which pages and which campaigns lead to subscriptions, so we don't waste money on ones that don't.
- To process and ship orders once checkout opens.
Who else sees it
- Klaviyo — email/SMS service. Receives email, phone, your form fields, and your subscribe events.
- Shopify — commerce platform and payment processor (via Shopify Payments). Receives billing, shipping, and order details when checkout opens (not yet live).
- Vercel — site host. Sees server logs (IP, user agent, request path).
- Meta, Google, TikTok — only if you grant marketing consent. Receives anonymous event signals to measure ad performance.
We do not sell your personal information. We do not share it with data brokers. Service providers process data on our instructions only.
How long we keep it
Email and form data: as long as you are subscribed. Unsubscribe and we will delete the profile within 30 days unless we are legally required to keep records (orders, tax). Server logs: 30 days. Analytics events: 14 months.
Categories of personal information (CCPA/CPRA)
We disclose the following categories of personal information collected, sources, recipients, business purposes, and retention periods, mapped to Cal. Civ. Code §1798.140(v):
| Category (Cal. Civ. Code §1798.140(v)) | What we collect | Source | Recipient categories | Business purpose | Retention |
|---|---|---|---|---|---|
| Identifiers (§1798.140(v)(1)(A)) | Email, phone, IP address, device identifier | Directly from you (forms); automatically (web logs) | Email/SMS service providers; hosting/CDN providers | Order processing, customer communication, fraud prevention | Until you unsubscribe + 30 days for legal hold |
| Customer records (§1798.140(v)(1)(B)) | Name, shipping address, payment info (tokenized — we never see card numbers) | Directly from you (checkout) | Commerce platform and payment processor (Shopify, Shopify Payments); fulfillment providers | Order processing, refunds, tax reporting | 7 years (tax / regulatory retention) |
| Commercial info (§1798.140(v)(1)(D)) | Purchase history, products viewed, cart abandonment | Automatic (site activity) | Email/SMS service providers; advertising partners (with consent) | Personalization, marketing | 24 months from last activity |
| Internet activity (§1798.140(v)(1)(F)) | Pages visited, click events, referrer, UTM parameters | Automatic (cookies, server logs) | Analytics providers; advertising partners (with consent) | Analytics, ad measurement | 14 months (analytics retention) |
| Inferences (§1798.140(v)(1)(K)) | Quiz archetype, ritual cadence preference | Derived from your form responses | Email service provider only | Personalization of email content | Until you unsubscribe |
We do not collect: biometric info, geolocation more precise than IP-based, professional/employment info, education info, or non-public personal info as defined under Gramm-Leach-Bliley.
Notice at Collection (§1798.100(b))
At the point of collection (any form on this site), we collect the categories above for the purposes listed above. We retain personal information for the periods listed above. We do not sell personal information for monetary consideration. We do share certain information with advertising partners (Meta, Google, TikTok) when you grant Marketing consent in our cookie banner — you may exercise your right to opt out via Do Not Sell or Share My Personal Information.
Sensitive Personal Information (CPRA)
We do not collect Sensitive Personal Information as defined in Cal. Civ. Code §1798.140(ae) — government IDs, financial account log-in credentials, precise geolocation, racial/ethnic origin, religious or philosophical beliefs, contents of mail/email/text messages, genetic data, biometric identifiers, health/medical info, or info concerning sex life or sexual orientation. The Right to Limit Use of Sensitive Personal Information under §1798.121 therefore does not apply.
Your rights
- See what we have on you. Email hello@habb.co from the address on file; we will reply within 30 days.
- Have it deleted. Same email. We will confirm when it's done.
- Correct it. Same.
- Stop us from selling or sharing it (CCPA/CPRA). Use the form at /do-not-sell. We do not sell, but the form lets you opt out of marketing-grade analytics fan-out as well.
- Withdraw your consent. Use Manage cookies at the bottom of any page. Set or change your choice anytime.
If your browser sends a Global Privacy Control (Sec-GPC) signal, we treat it as opt-out from marketing automatically.
Children
Under 13 (COPPA). Our site and products are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact hello@habb.co and we will delete the information.
Ages 13–16 (CCPA opt-in to sale/share). Cal. Civ. Code §1798.120(c) requires affirmative authorization before selling or sharing personal information of consumers between 13 and 16. We do not sell personal information for monetary consideration; we share certain information with advertising partners only when the consumer grants Marketing consent in our cookie banner. We do not knowingly collect or share information from minors under 16 without affirmative consent (granted by the minor for ages 13–16, or by a parent/guardian for under-13).
Changes to this notice
We will update the "Last updated" date when we change this notice. Material changes will be flagged on the next email we send you.
Pre-launch note
This page is the working summary while our supplement-DSHEA attorney finalizes the long-form policy. The facts above describe what actually happens. The long-form version will land before paid advertising goes live.