Privacy Policy
This Privacy Policy describes how Lemon & Co. ("Lemon & Co.", "we", "us", or "our") collects, uses, and discloses your personal information when you visit, interact with, or make a purchase from www.lemonandco.com (the "Site"), use our Lemonaid chat assistant, subscribe to our communications, or otherwise interact with us. It also explains the privacy rights available to you and how to exercise them.
By using the Site, you acknowledge the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Site.
1. Personal Information We Collect
"Personal Information" means any information that identifies, relates to, or could reasonably be linked with an identifiable individual. We collect the following categories:
Device and usage information
- Examples collected: web browser type and version, IP address, approximate (city-level) location derived from IP address, time zone, device type and operating system, cookie identifiers, the pages and products you view, search terms used on the Site, referring website, and how you interact with the Site.
- Purpose: to load the Site accurately and securely, remember your cart and preferences, perform analytics on Site usage so we can improve the Site, detect and prevent fraud and abuse, and measure the effectiveness of our marketing.
- Source: collected automatically when you access the Site using cookies, log files, web beacons, tags, pixels, and similar technologies (see "Cookies and Tracking Technologies" below).
- Disclosed to: our platform provider Shopify; Google (Google Analytics and Google Ads); Klaviyo (email marketing).
Order and payment information
- Examples collected: name, billing address, shipping address, email address, phone number, order details, and payment information (processed through the payment methods offered at checkout, such as Shopify Payments, Shop Pay, and accelerated wallets like Apple Pay or Google Pay). We do not see or store your full card number — payment card data is processed by our PCI-DSS-compliant payment processors.
- Purpose: to fulfill our contract with you — process your payment, arrange shipping, provide invoices and order confirmations, service your subscription (if you choose one), communicate with you about your order, screen orders for potential risk or fraud, and, in line with the preferences you have shared with us, provide you with information or advertising relating to our products.
- Source: collected from you at checkout.
- Disclosed to: Shopify; payment processors; ShipStation (order fulfillment and shipping-label services); AfterShip (shipment tracking and delivery notifications); shipping carriers; and tax and accounting service providers where required.
Account and subscription information
- Examples collected: account login details, order history, subscription plan, renewal dates, and subscription billing status.
- Purpose: to operate your customer account and manage recurring subscription orders you have authorized, including renewal charges, notifications, pauses, and cancellations.
- Source: collected from you.
- Disclosed to: Shopify and Casa Subscriptions, the app that manages our recurring-order subscriptions.
Chat information (Lemonaid assistant)
- Examples collected: the messages you type into our Lemonaid chat widget and associated technical metadata (such as timestamps and a session identifier).
- Purpose: to answer your questions about our products, provide customer assistance, and monitor the quality and safety of the assistant.
- Source: collected from you when you use the chat.
- Disclosed to: Anthropic, whose Claude AI model powers Lemonaid and processes chat messages to generate responses. Chat transcripts are also stored securely by us, with access limited to our team, and may be reviewed for quality and safety.
- What we do NOT do with your chats: we do not use your chat messages to train AI models; we do not use them for targeted advertising; and we never sell them. Chat data is used only to provide the assistant service and to monitor its quality and safety.
- Deletion: you may request deletion of your chat history at any time by emailing hello@lemonandco.com; we will fulfill verified requests within 30 days.
- Please note: Lemonaid is an AI assistant, not a human, and it can make mistakes. It does not provide medical advice. Please do not share sensitive personal information (such as health, financial, or government-ID information) in the chat. See our Terms of Service for the full terms that apply to using Lemonaid.
Marketing communications information
- Examples collected: email address, phone number (if you opt in to SMS updates), and marketing preferences when you sign up for our newsletter, use a discount pop-up, or opt in to marketing at checkout.
- Purpose: to send you news, offers, and product information you have asked to receive. Every marketing email includes an unsubscribe link, and you can stop SMS messages at any time by replying STOP.
- Source: collected from you.
- Disclosed to: Klaviyo, our email marketing provider.
Customer support information
- Examples collected: your name, contact details, order information, and the contents of your messages when you contact us (for example at hello@lemonandco.com).
- Purpose: to provide customer support and resolve your requests.
- Source: collected from you.
- Disclosed to: our email and support tooling providers as needed to respond to you.
Reviews and user-generated content
- Examples collected: review text, star rating, your name or initials, and any photos you choose to submit when you leave a product review (collected through our review platforms, Fera and Klaviyo Reviews).
- Purpose: to display authentic customer reviews on our Site and product pages. Reviews are public — please do not include personal information you do not want displayed.
- Source: collected from you.
- Disclosed to: Fera and Klaviyo, our review platforms.
Marketplace orders
- Examples collected: order and shipping details for purchases made through third-party marketplaces and retail partners (such as Amazon, and Ulta Beauty's online marketplace), received via our marketplace integrations.
- Purpose: to fulfill and support orders you place through those channels.
- Source: received from the marketplace where you placed your order, under that marketplace's own privacy policy.
- Disclosed to: our fulfillment and shipping providers, as with direct orders.
Affiliate and referral information
- Examples collected: a referral identifier stored in a cookie when you arrive at the Site through an affiliate or partner link.
- Purpose: to credit the referring affiliate for purchases they refer (via our affiliate platform, GOAFFPRO).
- Source: collected automatically from the link you used.
- Disclosed to: GOAFFPRO, our affiliate-program platform.
We do not collect Personal Information from data brokers, and we do not purchase marketing lists.
2. How We Use Personal Information
- Providing our products and services — offering products for sale, processing payments, shipping and fulfilling orders, and servicing subscriptions;
- Communicating with you — order confirmations, shipping updates, responses to your inquiries, and service announcements;
- Marketing — keeping you up to date on new products, services, and offers where you have opted in, and measuring how well our marketing performs;
- Site improvement and analytics — understanding how visitors use the Site so we can improve content, navigation, and performance;
- Security and fraud prevention — screening orders for potential risk or fraud and protecting the Site, our customers, and our business;
- Legal compliance — complying with applicable laws, regulations, and lawful requests.
3. Cookies and Tracking Technologies
A cookie is a small amount of information downloaded to your computer or device when you visit our Site. We use functional, performance/analytics, and advertising cookies, as well as similar technologies such as pixels and web beacons. Cookies help the Site remember your actions and preferences (such as your cart and region), tell us how the Site is used, and support our marketing.
Cookies necessary for the functioning of the store
| Name | Function |
|---|---|
| _ab | Used in connection with access to admin. |
| _secure_session_id | Used in connection with navigation through a storefront. |
| cart | Used in connection with shopping cart. |
| cart_sig | Used in connection with checkout. |
| cart_ts | Used in connection with checkout. |
| checkout_token | Used in connection with checkout. |
| secret | Used in connection with checkout. |
| secure_customer_sig | Used in connection with customer login. |
| storefront_digest | Used in connection with customer login. |
| _shopify_u | Used to facilitate updating customer account information. |
Reporting and analytics
| Name | Function |
|---|---|
| _tracking_consent | Stores your tracking and cookie-consent preferences. |
| _landing_page | Tracks landing pages. |
| _orig_referrer | Tracks landing pages. |
| _s, _shopify_fs, _shopify_s, _shopify_y, _y | Shopify analytics. |
| _shopify_sa_p, _shopify_sa_t | Shopify analytics relating to marketing and referrals. |
| _ga, _ga_* | Google Analytics — distinguishes visitors and sessions. |
Marketing
| Name | Function |
|---|---|
| __kla_id | Klaviyo — recognizes newsletter subscribers and supports email marketing. |
| _gcl_* | Google Ads — attributes visits from our advertisements. |
| fera.* | Fera — powers the product-review widgets on the Site. |
| ref / goaffpro_* | GOAFFPRO — attributes purchases to referring affiliates. |
The length of time a cookie remains on your device depends on whether it is a "persistent" or "session" cookie. Session cookies last until you stop browsing; persistent cookies last until they expire or are deleted (most of ours expire between 30 minutes and two years from download).
Your cookie choices. If you visit from a region where consent is required (such as the European Economic Area, the United Kingdom, or Switzerland), we show a cookie banner and do not set analytics or marketing cookies until you accept; you can change your preferences at any time via the banner's "Manage preferences" option. Wherever you are located, you can also control cookies through your browser settings (usually under "Tools" or "Preferences"; see www.allaboutcookies.org for guidance). Removing or blocking cookies may impact your user experience, and parts of the Site may no longer be fully accessible.
4. Sharing Personal Information
We share Personal Information with service providers that help us operate our business, under contracts limiting their use of it. We do not sell your Personal Information for money. Our service providers include:
- Shopify Inc. — powers our online store, checkout, and payments. Read Shopify's privacy policy at shopify.com/legal/privacy.
- Google — Google Analytics (site analytics) and Google Ads (advertising measurement and remarketing). Read Google's privacy policy at policies.google.com/privacy; opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
- Klaviyo — email marketing. Read Klaviyo's privacy policy at klaviyo.com/legal/privacy.
- Anthropic — provides the Claude AI model that powers our Lemonaid chat assistant. Read Anthropic's privacy policy at anthropic.com/legal/privacy.
- Casa Subscriptions — manages recurring subscription orders.
- ShipStation — order fulfillment and shipping-label services.
- AfterShip — shipment tracking and delivery notifications.
- Fera and Klaviyo Reviews — collect and display product reviews.
- GOAFFPRO — operates our affiliate/referral program.
- Marketplace integrations (Shopify Marketplace Connect, Connectr, Mirakl Connect) — synchronize orders you place through partner marketplaces such as Amazon and Ulta Beauty's online marketplace.
- Reporting integrations (Supermetrics, Power My Analytics, Catchr) — compile our own sales and marketing data into internal business reports.
- Accessibly — provides accessibility features on the Site.
- Shipping carriers and logistics partners — to deliver your orders.
Our relationship with Shopify
The Site is hosted by Shopify, which collects and processes personal information about your access to and use of the Site in order to provide and improve the Site for you. Information you submit to the Site will be transmitted to and shared with Shopify, and with the third parties described in this policy, which may be located in countries other than where you reside. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features (Shopify Network Intelligence) that incorporate data obtained from your interactions with our store, with other merchants, and with Shopify; in these circumstances Shopify is responsible for the processing of your personal information, including responding to requests to exercise your rights over that use. To learn more, see the Shopify Consumer Privacy Policy; depending on where you live, you may also exercise certain rights via the Shopify Privacy Portal.
We may also disclose Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise establish or protect our rights. If Lemon & Co. is involved in a merger, acquisition, financing, or sale of assets, Personal Information may be transferred as part of that transaction, subject to this Privacy Policy.
5. Behavioural Advertising
We use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For example, we use Google Ads to measure our advertising and to show ads to people who have visited the Site. We share limited information (such as cookie identifiers and site interactions) with Google for these purposes — depending on your location, only with your consent.
For more information about how targeted advertising works, visit the Network Advertising Initiative's educational page at networkadvertising.org.
You can opt out of targeted advertising by using:
- Google's ad settings: google.com/settings/ads
- The Digital Advertising Alliance's opt-out portal: optout.aboutads.info
- Our Your Privacy Choices page (for residents of states with data-sharing opt-out rights)
6. Your Privacy Choices — Opting Out of Data Sharing
Some U.S. state privacy laws (including in California, Colorado, Connecticut, Texas, and Virginia) treat the use of advertising cookies and identifiers as the "sale" or "sharing" of personal information, or as "targeted advertising." Residents of those states have the right to opt out.
- Opt-out page: visit Your Privacy Choices (also linked in the footer of every page) to opt out of data sharing on this Site.
- Global Privacy Control: we honor the Global Privacy Control (GPC) browser signal as a valid opt-out of data sharing in states where it is legally recognized. Learn more at globalprivacycontrol.org.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
7. Your Rights
United States state privacy rights
Depending on your state of residence (including California under the CCPA/CPRA, and residents of Colorado, Connecticut, Texas, Virginia, and other states with privacy laws), you may have the right to:
- Know / access — request the categories and specific pieces of Personal Information we hold about you, including the categories of sources, purposes, and third parties with whom it is disclosed;
- Delete — request that we delete Personal Information we hold about you, subject to legal exceptions (for example, records we must keep for tax or fraud-prevention purposes);
- Correct — request that we correct inaccurate Personal Information;
- Portability — receive a copy of your Personal Information in a portable format;
- Opt out — of the "sale" or "sharing" of personal information / targeted advertising, as described in Section 6;
- Non-discrimination — we will not deny you goods or services, charge different prices, or provide a different level of quality because you exercised a privacy right.
To exercise these rights, email us at hello@lemonandco.com with the subject line "Privacy Request." We will verify your request using the email address and order information associated with your account, and respond within the time required by applicable law (generally 45 days). You may designate an authorized agent to submit requests on your behalf; we will require proof of the agent's authorization and may still need to verify your identity directly. If we decline to take action on your request, depending on where you live you may have the right to appeal our decision by replying to our response, and to lodge a complaint with your state attorney general or data protection authority.
For the purposes of the CCPA, in the preceding 12 months we have collected the categories of Personal Information described in Section 1 (identifiers; commercial information; internet or other electronic network activity; approximate geolocation; and inferences drawn for marketing), disclosed each of those categories to the service providers described in Section 4 for business purposes, and "shared" internet activity data with advertising partners as described in Sections 5–6.
European Economic Area, United Kingdom, and Switzerland (GDPR)
If you are a resident of the EEA, UK, or Switzerland, we process your personal information under the following lawful bases: your consent (for example, for non-essential cookies and marketing); the performance of our contract with you (orders and subscriptions); compliance with our legal obligations; and our legitimate interests (such as site security and improving our services), which do not override your fundamental rights and freedoms.
You have the right to access the personal information we hold about you, to port it to a new service, to object to or restrict processing, to withdraw consent at any time, and to ask that your personal information be corrected, updated, or erased. To exercise these rights, contact us at hello@lemonandco.com.
Your personal information may be processed and stored in the United States and other countries where our service providers operate. Where personal information is transferred out of the EEA or UK, our processors rely on appropriate safeguards such as Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework. For information on how Shopify handles GDPR data transfers, see Shopify's privacy compliance documentation.
If you are not satisfied with our response to a complaint, you have the right to lodge a complaint with your local data protection authority.
8. Minors
The Site is not intended for individuals under the age of 18, and our products are formulated for adults. We do not knowingly collect Personal Information from children. If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us at hello@lemonandco.com to request deletion.
9. Data Retention
- Order records — retained for as long as needed to provide our services and as required for tax, accounting, and legal purposes, unless and until you ask us to erase them (subject to legal retention requirements);
- Marketing data — retained until you unsubscribe or ask us to delete it;
- Chat transcripts — retained for quality and safety monitoring and deleted within 30 days of a verified request;
- Analytics data — retained in aggregate form; identifiable analytics records expire on the schedules set by our analytics providers.
10. Automated Decision-Making
We do not engage in fully automated decision-making that has a legal or otherwise significant effect on you. Our processor Shopify uses limited automated decision-making to prevent fraud that does not have a legal or otherwise significant effect on you, including temporary denylists of IP addresses associated with repeated failed transactions (persisting for a small number of hours) and temporary denylists of credit cards associated with denylisted IP addresses (persisting for a small number of days). Our Lemonaid chat assistant generates automated responses to your questions but makes no decisions with legal or similarly significant effects.
11. Security
We use commercially reasonable safeguards to protect your Personal Information: the Site is served over encrypted connections (TLS/HTTPS), payments are processed by PCI-DSS-compliant processors, and access to customer data is limited to those who need it. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
12. Third-Party Links
The Site may contain links to websites we do not operate (for example, our social media pages or retail partners). We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies.
13. Do Not Track and Global Privacy Control
Because there is no consistent industry understanding of how to respond to "Do Not Track" browser signals, we do not alter our practices in response to DNT signals. However, as described in Section 6, we do honor the Global Privacy Control (GPC) signal as an opt-out of data sharing where legally required.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal, or regulatory reasons. The "Last updated" date at the top shows when it was last revised. Material changes will be posted on this page.
15. Contact Us
For more information about our privacy practices, to exercise your rights, if you have questions, or if you would like to make a complaint, contact us by email at hello@lemonandco.com or by mail:
Lemon & Co.
550 Junipero Serra Boulevard
Stanford, CA 94305
United States
