Privacy Policy — The 3 AM Wake

This Privacy Policy describes how Prashant Abhishek, operating as ayurvedaorigin.com (the "Seller", "we", "us"), collects, uses, and protects your personal data when you visit ayurvedaorigin.com (the "Site"), purchase The 3 AM Wake (the "Product"), or interact with our email lists.

1. Data we collect

We collect the following categories of personal data:

Purchase data: your name, email address, country, and payment confirmation details, provided to us by our payment processor at the time of purchase. We do not see or store your full payment card details; those are handled by the payment processor.
Email subscription data: if you subscribe to a launch list or newsletter, we collect your email address and the tag identifying which list you joined.
Diagnostic responses: if you use the Product's dashboard, we store your answers to the 3-question diagnostic and the resulting computed sub-type. We do not collect medical history beyond these three questions.
Session data: when you use the dashboard, we store a session token in a secure cookie, the time of your last visit, and the IP address and user agent on first session creation (for fraud detection only).
Site analytics: when you visit the Site, our analytics provider (Google Analytics) collects standard analytics data, including approximate location, device type, pages visited, and referrer. This data is aggregated and not linked to your purchase data.

2. How we use your data

To deliver the Product (send the personalized PDF, generate the magic link, render your dashboard).
To provide the personalized 7-day calendar based on your diagnostic responses.
To send transactional emails: receipt, Day 1 check-in, Day 3 check-in, Day 8 feedback request, Day 14 follow-up. You cannot opt out of essential transactional emails (purchase receipt) but you can opt out of follow-up emails by replying with "unsubscribe".
To respond to support requests you initiate.
To improve the Product based on aggregated, anonymized feedback responses.
To meet legal and tax obligations.

3. Third parties who process your data

We use the following third-party services. Each is bound by their own privacy policies and data-processing agreements with us:

Payment processor (Lemon Squeezy or Dodo Payments): handles payment processing, tax calculation, invoicing, and chargebacks. They act as the merchant of record. Their privacy policies apply to your payment transaction.
Email delivery (Resend): sends transactional emails (PDF delivery, dashboard magic link, follow-ups). Resend processes email content on our behalf.
Email subscriptions (Buttondown): manages our newsletter and launch lists. Buttondown stores email addresses we collect through subscribe forms.
Hosting (Cloudflare Pages, and after the Product launches, a virtual private server provider): serves the Site and stores the dashboard data.
Analytics (Google Analytics): provides aggregate site analytics. Google's privacy policy applies.
Affiliate networks (Amazon Associates): when you click affiliate links, the destination retailer collects standard tracking data per their own privacy policies.

4. Where your data is stored

Purchase and dashboard data is stored on a server in Europe (Hetzner, Germany) operated by us. Email subscription data is stored on Buttondown's infrastructure (United States). Payment data is stored by the payment processor's infrastructure (varies). Analytics data is processed by Google (varies, primarily United States).

5. How long we keep your data

Purchase records: kept for 7 years for tax and accounting compliance.
Diagnostic responses and dashboard data: kept while your account is active. You can request deletion at any time (see Your Rights, below).
Email subscription data: kept until you unsubscribe.
Analytics data: kept per the analytics provider's standard retention (typically 14 months).

6. Your rights

You have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your data (subject to our legal obligation to keep purchase records for tax purposes).
Export your data in a portable format.
Object to specific processing.
Withdraw consent for processing where consent was the basis (e.g., newsletter subscription).

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Cookies

The Site uses the following cookies:

Essential cookies: a session cookie when you use the Product dashboard. Without this cookie the dashboard cannot function.
Analytics cookies: Google Analytics sets cookies to measure aggregate site usage. You can opt out at tools.google.com/dlpage/gaoptout.

8. Children

The Product is intended for adult women experiencing menopausal symptoms. We do not knowingly collect data from anyone under the age of 18. If we learn that a person under 18 has provided us with personal data, we will delete it.

9. Security

We use HTTPS for all Site connections, encrypted storage at rest for the dashboard database, and bcrypt-or-stronger token hashing for session tokens. We are a small operation; we cannot guarantee absolute security against all threats but we follow industry-standard practices appropriate for the size and nature of the data we handle.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to active customers and subscribers. The "Last updated" date at the top of this page reflects the most recent change.

11. Contact

Questions about this Privacy Policy or your data: [email protected].