Privacy Policy
Last updated: 1 November 2026
Who we are
Grandpa Finn's ("we", "us", "our") runs the online store at grandpafinns.com, selling dietary supplements. This policy explains what personal data we collect, why, who we share it with and the choices you have. Contact: domtrades@mail.grokbot.com.
Data you give us
Email sign-up: your email address when you join Grandpa's emails or complete our follow quest. Contact form: your name, email address and message. Account: your email address and password when you create an account (see "Sign-in" below). Orders and subscriptions: your name, email address, shipping address, the products you order, your order and subscription history, and the date, time and wording of any subscription terms you agree to. Discount codes: the email address you used to claim and redeem a code.
Sign-in (Clerk)
Accounts and sign-in are provided by Clerk, Inc. When you create an account or sign in, Clerk processes your email address, your password (stored by Clerk in hashed form; we never see it), sign-in and session information, and technical data such as IP address and browser type, and sets cookies needed to keep you signed in securely. We receive your account ID and email address so we can show your orders and subscriptions and let you cancel online.
Payments (Square)
Payments, including Subscribe & save renewals, are processed by Square (Block, Inc.) on Square-hosted checkout pages. Square collects your payment card details, billing details and the information needed to process the payment and prevent fraud. We never see or store your full card number. Square shares with us the payment status, the amount, your name, email and shipping address, and the last digits and type of card for order support.
Analytics (PostHog)
We use PostHog to understand how people use our site so we can improve it. PostHog may collect pages visited, clicks and other interactions, referring page, approximate location derived from IP address, device and browser type, and a random identifier stored in a cookie or local storage. We use this in aggregate and do not use it to identify you by name.
Data collected automatically
Like most websites, our hosting provider automatically logs basic technical data such as IP address, browser type, device, pages requested and the time of the request, to keep the site running and secure.
Cookies & local storage
We and our providers use cookies and similar technologies for: (1) essential functions, such as keeping you signed in (Clerk), secure checkout (Square) and site security and load balancing by our hosting provider; (2) remembering your cart and whether you've seen our email popup (your browser's local storage); and (3) analytics (PostHog). We do not currently use advertising pixels. If we add them in future (for example from TikTok or Meta), we'll update this policy first. You can block or delete cookies in your browser settings at any time; blocking essential cookies may stop sign-in or checkout from working.
How we use your data
To process, ship and support your orders and subscriptions; to send order confirmations, subscription confirmations, renewal reminders and cancellation emails; to manage your account; to reply to your messages; to send marketing emails you've signed up for (every marketing email includes a way to unsubscribe anytime); to prevent fraud and misuse; and to understand and improve our site.
Sharing
We share personal data only with service providers that help us run the store, each for its own task: Clerk (sign-in), Square (payments), PostHog (analytics), our email delivery provider (sending emails), our hosting and database providers (running the site and storing order records), and shipping carriers and our product fulfilment partner (delivering your order). We may also disclose data when required by law or to protect our rights. We do not sell your personal information and we do not share it for cross-context behavioural advertising.
Data deletion: how to request it
You can ask us to delete your personal data at any time. Email domtrades@mail.grokbot.com with the subject "Delete my data" from the email address you used with us (or tell us that address). We'll confirm we've received your request, verify it, and delete your account, sign-up and contact details, and analytics identifiers linked to you within 30 days. We'll also ask our providers to delete what they hold for us. We may keep order and payment records we're required to retain for tax, accounting or legal reasons, and we'll tell you what we keep. You can also unsubscribe from marketing emails anytime using the link in any email, and cancel subscriptions online at grandpafinns.com/account#subscriptions.
Your rights
Depending on where you live (including California under the CCPA/CPRA, other US states, Australia and New Zealand), you may have the right to: know and access the personal information we hold about you; correct it; delete it; get a copy of it; opt out of the sale or sharing of your personal information (we do not sell or share it); limit the use of sensitive personal information; and not be discriminated against for exercising these rights. To make a request, email domtrades@mail.grokbot.com. We'll verify your request and respond within 30 days (and within 45 days at the latest where US state law allows). You may use an authorised agent. If you're unhappy with our response, you can complain to your local privacy regulator.
International transfers
We and our providers may process and store your data in the United States, Australia and other countries. Where we do, we rely on our providers' safeguards to protect it.
Data retention & security
We keep personal data only as long as needed for the purposes above: account data until you delete your account or ask us to; order and subscription records for as long as required for tax, accounting and legal purposes; email sign-ups until you unsubscribe or ask us to delete them. We use reasonable technical and organisational safeguards, including encrypted (HTTPS) connections, to protect your data.
Children
Our site and products are not directed to children under 18, and we do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, email us and we'll delete it.
Changes to this policy
We may update this policy. The latest version, with its last-updated date, will always be at grandpafinns.com/privacy.
Contact
Questions or requests about your privacy: domtrades@mail.grokbot.com.