Privacy policy

Overview & Purpose

Garnuu ("Garnuu," "we," "us," or "our") operates this website and the Garnuu cycle tracking app (together, the "Services") to provide you with a curated shopping and cycle-tracking experience. Garnuu's website is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose personal information — including health and menstrual cycle data — when you visit or use the Services, make a purchase, use the Garnuu app, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully, including the section below on the health and cycle data we collect through the app. By using or accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand how we collect, use, and disclose your information.

Personal Information We Collect or Process

"Personal information" means information that identifies or can reasonably be linked to you. It does not include information that is anonymized or de-identified so that it can no longer be linked to you. Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process the following categories of personal information, including inferences drawn from it:

  • Contact details, including your name, address, billing and shipping address, phone number, and email address.
  • Financial information, including credit card, debit card and other financial account information, transaction details, form of payment, and payment confirmation details.
  • Account information, including your username, password, security questions, preferences, and settings.
  • Transaction information, including items you view, add to your cart or wishlist, purchase, return, exchange, or cancel, and your order history.
  • Communications with us, including information you provide when contacting customer support.
  • Device information, including information about your device, browser, network connection, IP address, and other unique identifiers.
  • Usage information, including how and when you interact with or navigate the Services.
  • Health and menstrual cycle data collected through the Garnuu app, described in detail in "Health, Menstrual Cycle, and Cycle Tracking App Data" below.

We treat health and cycle data as a distinct, sensitive category of personal information and apply additional protections to it, described below.

Health, Menstrual Cycle, and Cycle Tracking App Data

Garnuu offers a cycle tracking app (the "App") that helps you track your menstrual cycle alongside your Garnuu period care products. Because this data is sensitive, we explain here — separately from our other data practices — what we collect, why, who it's shared with, and how you can control it.

What we collect. When you use the App, we collect health data that you choose to input, which may include: period start and end dates, cycle length and history, flow intensity, symptoms (such as cramps, mood, or other logged symptoms), predicted fertile windows or ovulation estimates, notes you add, and related in-app activity (such as reminders you set or products you log). We refer to this collectively as "cycle data."

Why we collect it. We use cycle data solely to operate and improve the App's core functionality — for example, to generate more accurate period and ovulation predictions, personalize reminders, and improve the App experience for you. We do not use cycle data to make eligibility decisions (such as for employment, credit, or insurance), and we do not use it for interest-based or targeted advertising.

Who processes it. We do not sell or share cycle data for cross-context behavioral or targeted advertising, and we do not disclose it to data brokers. We do share cycle data with a limited number of service providers who process it on our behalf, under contractual confidentiality and data protection obligations, strictly to provide the App and our Services:

Processor

Role

Supabase

Backend database and infrastructure provider that stores and secures App data

Stay.ai

Customer retention and communications platform, used to support your account and subscription experience

Shopify

E-commerce platform that powers our store and, where you link a purchase to your App account, your order and account information

These providers act as our processors (or "service providers," as some state laws describe them) — they process cycle data only on our documented instructions and only for the purposes described in this Privacy Policy. We do not permit them to use your cycle data for their own independent purposes.

Your control over cycle data. You can view, edit, and delete your cycle data at any time directly in the App's account settings. Deleting your cycle data in-app removes it from your active account; it may take a short period to be removed from backups before permanent deletion. You may also request deletion of your cycle data by contacting us using the details at the end of this Privacy Policy.

A note on legal protections. Depending on where you live, menstrual and reproductive health data may be treated as a special or "sensitive" category of personal information (or as "consumer health data") under applicable law, which may give you additional rights or require us to obtain your consent before collecting or sharing it. We collect cycle data only when you choose to provide it by using the App, and you can stop providing it, or delete what you've provided, at any time as described above.

Personal Information Sources

We may collect personal information, including cycle data, from the following sources:

  • Directly from you, including when you create an account, set up the App, log cycle data, visit or use the Services, communicate with us, or otherwise provide personal information to us.
  • Automatically through the Services, including from your device when you use the App, our products, or our website, and through cookies and similar technologies.
  • From our service providers, including Supabase, Stay.ai, and Shopify, when we engage them to enable certain technology and they collect or process personal information on our behalf.
  • From our partners or other third parties, where applicable.

How We Use Your Personal Information

Depending on how you interact with us, we may use personal information for the following purposes:

  • Provide, tailor, and improve the Services. To perform our contract with you, process payments, fulfill orders, remember your preferences, process returns or exchanges, manage your account, arrange shipping, enable App functionality (including cycle predictions built from your cycle data), and create a customized experience, such as recommending products related to your purchases or cycle.
  • Marketing and advertising. To send marketing, advertising, and promotional communications by email, text message, or other channels, and to show you advertisements based on your activity on the Services. We do not use your cycle data for marketing or advertising purposes.
  • Security and fraud prevention. To authenticate your account, provide a secure shopping and App experience, and detect or investigate fraudulent, illegal, or unsafe activity.
  • Communicating with you. To provide customer support and respond to your inquiries.
  • Legal reasons. To comply with applicable law, respond to valid legal process, and enforce or investigate potential violations of our terms or policies.

How We Disclose Personal Information

We may disclose your personal information to third parties for the purposes described in this Privacy Policy. This may include:

  • With Shopify, Supabase, Stay.ai, and other vendors who perform services on our behalf, such as e-commerce hosting, app infrastructure and data storage, payment processing, customer communications, cloud storage, and order fulfillment. As described above, cycle data is shared with these providers only as needed to operate the App, and never for advertising or sold to third parties.
  • With business and marketing partners to provide marketing services and advertise to you (this does not include your cycle data). We use Shopify to support personalized advertising based on your online activity with different merchants and websites; you may opt out of this as described in "Your Rights and Choices" below.
  • When you direct or consent to disclosure to a third party, such as to ship you products.
  • With our affiliates or otherwise within our corporate group.
  • In connection with a business transaction, such as a merger, acquisition, or bankruptcy, or to comply with legal obligations, enforce our terms or policies, or protect the Services, our rights, or the rights of others.

We do not sell personal information, and we do not sell or share cycle data, for money or other valuable consideration.

Relationship with Shopify

Our website is hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit through our website may be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside. We also use certain Shopify features that incorporate data from your interactions with our store and with Shopify. In these circumstances, Shopify is responsible for processing your personal information for these purposes. To learn more, visit the Shopify Consumer Privacy Policy, and you can exercise certain rights via the Shopify Privacy Portal.

The Services may link to websites or platforms operated by third parties. We are not responsible for the privacy or security practices of sites we do not control, and we encourage you to review their policies before providing information to them.

Children's Data

The Services, including the App, are not intended for use by children, and we do not knowingly collect personal information — including cycle data — from children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with personal information, please contact us using the details below to request its deletion. As of the effective date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" personal information of individuals under 16 years of age.

Security and Retention of Your Information

We use administrative, technical, and physical safeguards designed to protect your personal information, including cycle data, and we require our service providers to do the same. No security measures are perfect or impenetrable, however, and we cannot guarantee "perfect security." We recommend that you avoid sending sensitive information to us through unsecured channels.

How long we retain personal information depends on factors such as whether we need it to maintain your account, provide the Services, comply with legal obligations, or resolve disputes. Cycle data is retained only for as long as your App account remains active, or until you delete it as described above, whichever is earlier, unless we are required to retain it longer to comply with law.

Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information, including your cycle data:

  • Right to Access / Know. Request access to personal information we hold about you.
  • Right to Delete. Request that we delete personal information we maintain about you. For cycle data specifically, you can also delete it yourself at any time in the App's account settings.
  • Right to Correct. Request that we correct inaccurate personal information.
  • Right of Portability. Request a copy of your personal information, and in certain circumstances, that we transfer it to a third party.
  • Right to Opt Out of Sale, Sharing, or Targeted Advertising. Depending on where you reside, opt out of the "sale" or "share" of personal information, or of processing for "targeted advertising." You can exercise this here. We honor the Global Privacy Control signal where required by law. As noted above, we do not sell or share your cycle data for these purposes in the first place.
  • Managing Communication Preferences. Opt out of promotional emails at any time using the unsubscribe link in our emails. We may still send non-promotional emails about your account or orders.

If you reside in the UK or European Economic Area, you may also have the right to object to or restrict our processing of your personal information, and to withdraw consent where we rely on it (this will not affect the lawfulness of processing before withdrawal).

You may exercise these rights by contacting us using the details below, or where available, through the Services. We may need to verify your identity before processing your request, and you may designate an authorized agent to act on your behalf, subject to proof of authorization. We will not discriminate against you for exercising these rights.

Complaints

If you have complaints about how we process your personal information, please contact us using the details below. Depending on where you live, you may have the right to appeal our decision, or to lodge a complaint with your local data protection authority. For the EEA, a list of supervisory authorities is available here.

International Transfers

We may transfer, store, and process your personal information outside the country you live in. If we transfer personal information out of the EEA or UK, we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, or equivalent UK mechanisms, unless the transfer is to a country deemed to provide adequate protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal or operational reasons. We will post the revised policy on this website, update the "Last updated" date, and provide notice as required by applicable law.

Contact

Questions about our privacy practices, this Privacy Policy, or your cycle data? Call +1 612-584-0432, email macy@garnuu.com, or write to Garnuu, 801 Transfer Road, Unit H06, Saint Paul, MN 55114, United States. For purposes of applicable data protection laws, Garnuu is the data controller of your personal information.