Privacy policy
Wellua Privacy Policy
Effective date: 2026-07-27 Last updated: 2026-07-27
Wellua, Inc. ("Wellua," "we," "us," or "our") cares about the people who trust us with their information. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices and rights you have. We wrote it to be read, not to be skipped.
We are a California company, and most of the people who visit our website are in the United States. This policy is written with that in mind. A short note for visitors in the European Union and the United Kingdom appears near the end.
If anything here is unclear, please write to us. The contact details are at the bottom of this policy, and we are glad to help.
1. A quick summary
We believe in collecting as little as possible and being clear about what we do collect.
- Right now, before we sell any products, the main thing we collect is the information you give us when you join our waitlist: your email address, a record of your consent, and how you found us. We also record the internet address your device used, which our email platform keeps with that record.
- We use a cookie-consent banner on our website. It blocks non-essential and marketing tracking until you say yes. It honors the Global Privacy Control browser signal. It includes a "Do Not Sell or Share My Personal Information" choice.
- We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising against the choices you have made.
- We use a small number of trusted service providers, such as our e-commerce platform and our email platform, to run our website and to send the messages you ask for. They handle your information on our behalf and under contract.
- You have rights over your personal information. Section 8 explains them and how to use them.
The sections below give the full detail.
2. Who we are and the scope of this policy
This policy applies to wellua.com and to the personal information we collect through the website, through our waitlist, and through messages you exchange with us. It does not apply to any third-party website that we may link to, each of which has its own privacy practices.
Wellua, Inc. is the business responsible for the personal information described here. Under California law, we are the "business." Under European and United Kingdom law, where it applies to an individual visitor, we act as the "controller" of that person's information.
3. The personal information we collect, and why
We collect personal information in three ways: information you give us directly, information collected automatically when you visit the website, and information we receive from the service providers that help us operate.
We have organized this section using the categories that California law uses, so that it doubles as the disclosure California requires. Where a category does not apply to us today, we say so plainly rather than leave you guessing.
| Category of personal information (California labels) | What this means for Wellua today | Why we collect it (purpose) | Sources |
|---|---|---|---|
| Identifiers | Your email address, and your internet address, which is the identifier your device uses to connect to the internet and is commonly called an IP address. Our email platform records your internet address when you sign up, and with some of your later activity on our website, and keeps it with your record. Our waitlist form does not ask for your name. Where a record has reached us through our e-commerce platform, it may also include a name. If we begin selling products, this will also include your billing and shipping address and your phone number when you provide them. | To add you to the waitlist, to send you the messages you asked for, to keep a record of your signup and of the consent you gave, to respond to your questions, and (later) to process and deliver orders. Your internet address is also the source of the approximate location described in the Geolocation row. | Directly from you; automatically, from your device when you use the website; from our e-commerce platform. |
| Customer records / commercial information | Today, none beyond your waitlist signup. Once we sell products, this will include your order history and records of products you have purchased. | To fulfill orders, provide customer service, and keep accurate business records. | Directly from you; from our e-commerce platform. |
| Internet or network activity | Basic technical information your browser shares, such as device and browser type, and, only if you consent, information from cookies and similar technologies about how you use the website. | To keep the website secure and working, to understand at a general level how the website is used, and, with your consent, to improve your experience. | Automatically, through your browser and our website. |
| Geolocation (general, not precise) | An approximate, city-or-region-level location inferred from your internet address. We do not collect precise geolocation. | Security, fraud prevention, and understanding at a general level where our visitors are. | Automatically. |
| Commercial communications and marketing consent | A record that you opted in, the date and time, and the source of your signup. | To prove that you asked to hear from us, to honor your preferences, and to comply with email and consent laws. | Directly from you; from our email platform. |
| Inferences | We do not currently build profiles or draw inferences about you. | Not applicable today. | Not applicable. |
| Sensitive personal information | We do not intentionally collect sensitive personal information as California defines it (for example, government identifiers, precise geolocation, account log-in credentials combined with passwords, racial or ethnic origin, health information, or the contents of your messages). Please do not send us sensitive information that we do not ask for. | Not applicable today. See Section 9. | Not applicable. |
A note on skin and health. Wellua makes products for sensitive, redness-prone skin. We do not ask you to tell us about your skin or your health in order to join the waitlist, and we ask that you not include health details in messages to us. If you choose to describe your skin to us, for example in a customer-service message, we treat that information with care and use it only to help you. We do not use it for advertising.
4. How we use your personal information
We use your personal information for the following purposes, and we limit our use to what each purpose reasonably requires:
- To operate the website and keep it secure.
- To add you to the waitlist when you submit the signup form.
- To send you the messages you asked for, such as news about our products and our company.
- To respond to your questions and provide support.
- To keep accurate records and to comply with our legal obligations.
- Once we sell products, to process payments, fulfill and deliver orders, handle returns, and provide customer service.
If we ever use your personal information for a purpose that is not compatible with the ones listed here, we will tell you first.
5. Cookies and your tracking choices
When you visit wellua.com, we use a small number of cookies and similar technologies. Some are strictly necessary to make the website work and to keep it secure; these are always on, because the website cannot function without them. Others are non-essential, such as analytics and any marketing technologies; these stay off until you consent.
We use a consent banner to manage this. The banner:
- blocks non-essential and marketing technologies until you make a choice;
- lets you accept, decline, or adjust your preferences at any time;
- honors the Global Privacy Control (GPC), an opt-out signal that some browsers and extensions send on your behalf. When we detect a Global Privacy Control signal from your browser, we treat it as a valid request to opt out of the sale or sharing of your personal information; and
- includes a "Do Not Sell or Share My Personal Information" choice, described in Section 7.
You can also control cookies through your browser settings. If you block strictly necessary cookies, parts of the website may not work.
6. How we share personal information, and the service providers we rely on
We share personal information only as described here.
Service providers and processors. We use a small set of trusted companies to run our business. They process personal information on our behalf, under written contracts that limit what they may do with it and require them to protect it. Under California law, these companies are our "service providers," and our disclosures to them are not "sales" of personal information. The categories of service provider we use are:
- Our e-commerce and website platform, which hosts wellua.com, stores our customer and order records as our first-party system of record, manages the consent banner, and (once we sell products) processes orders and payments. Our current provider is Shopify.
- Our email and messaging platform, which manages our waitlist, records consent, and sends the messages you ask for. This platform is connected to our website on a server-to-server basis only; we do not run a legacy on-site tracking script for it. Our current provider is Klaviyo.
- Payment processors, once we sell products, which handle payment information securely. We do not store full payment-card numbers ourselves.
Legal and safety reasons. We may disclose personal information if the law requires it, if we receive a valid legal request, or if we need to protect the rights, property, or safety of Wellua, our customers, or the public.
Business transfers. If Wellua is ever involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will require the recipient to honor this policy or give you notice and a choice as the law requires.
We do not sell your personal information for money. We do not share your personal information for cross-context behavioral advertising in a way that overrides the choices you make through our consent banner or through a Global Privacy Control signal. If this ever changes, we will update this policy and give you the notice and the opt-out the law requires before doing so.
7. "Do Not Sell or Share My Personal Information"
California law gives you the right to opt out of the "sale" or "sharing" of your personal information, even when no money changes hands. You can exercise this right in two ways:
- Use the "Do Not Sell or Share My Personal Information" choice in our website consent banner; and
- Turn on the Global Privacy Control in a supported browser or extension. We treat that signal as an opt-out request for the browser that sends it.
We honor these choices. Because we do not sell your personal information for money and do not share it for cross-context behavioral advertising against the choices you have made, exercising this right will not reduce the quality of your experience on our website.
8. Your privacy rights and how to use them
Depending on where you live, you have rights over your personal information. For California residents, these rights come from the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We honor them, and we extend the core choices below to all visitors as a matter of practice.
You have the right to:
- Know and access. Ask us to tell you the categories and the specific pieces of personal information we have collected about you, the categories of sources, the purposes for which we use it, and the categories of third parties to whom we disclose it.
- Delete. Ask us to delete the personal information we collected from you, and to tell our service providers to do the same, subject to the exceptions the law allows.
- Correct. Ask us to correct inaccurate personal information we hold about you.
- Opt out of the sale or sharing of your personal information, as described in Section 7.
- Limit the use of sensitive personal information. Direct us to use any sensitive personal information only for limited, permitted purposes. As noted in Section 3, we do not currently collect sensitive personal information, so today this right has nothing to act on. We include it here so you know it is yours.
- Non-discrimination. Exercise any of these rights without being treated differently. We will not deny you service, charge you a different price, or give you a lower quality of service because you used your rights.
How to make a request. Please send your request to privacy@wellua.com or write to us at the postal address in Section 13. Please tell us what you would like to do so that we can help quickly.
How we verify you. To protect your information, we will take reasonable steps to confirm your identity before we act on a request to know, delete, or correct. For most requests this simply means confirming that you control the email address associated with your information. We will not ask for more information than we need.
Authorized agents. You may use an authorized agent to make a request on your behalf. We may ask the agent for proof that you gave them permission, and we may ask you to confirm the request directly.
How long we take. We will confirm that we received your request, and we aim to respond within the timeframes California law sets, which is generally forty-five days, with the possibility of an extension when a request is complex. We will tell you if we need more time.
Appeals. If we decline your request and you believe we were wrong, please reply to our response and we will review it again.
9. Sensitive personal information
As stated in Section 3, we do not intentionally collect sensitive personal information as California defines it, and we do not use or disclose it for purposes that would trigger the right to limit. If our practices ever change, we will update this section, give notice, and provide the limit-use choice the law requires.
10. How long we keep personal information
We keep personal information only for as long as we need it for the purposes described in this policy, and then we delete it or de-identify it. Our retention approach is:
| Information | How long we keep it |
|---|---|
| Waitlist email address, consent record, and the internet address recorded with them | For as long as you remain subscribed, plus a reasonable period afterward to honor your unsubscribe and to keep a record of consent, unless you ask us to delete it sooner. |
| Customer and order records (once we sell products) | For as long as needed to provide the service and to meet our tax, accounting, and legal obligations, which is generally several years. |
| Website and security logs | For a short period, typically used for security and troubleshooting, then deleted or de-identified. |
| Customer-service messages | For as long as needed to resolve your matter and keep a reasonable record. |
If you ask us to delete your information, we will do so except where the law allows or requires us to keep it.
11. How we protect personal information
We use reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, and unauthorized access. We rely on established platforms for our website and email, and we limit who can access personal information to those who need it. No method of transmission or storage is perfectly secure, and we cannot promise absolute security, but we take this responsibility seriously.
12. A note for visitors in the European Union and the United Kingdom
Wellua is a United States company, and our website is directed to the United States. We do not currently target the European Union or the United Kingdom, and we do not offer goods or services there at this time. If you visit us from the European Union or the United Kingdom, the following short points apply to any personal information we hold about you, to the extent that the General Data Protection Regulation or the United Kingdom GDPR governs it:
- Our role. Where this law applies, we act as the controller of your personal information.
- Our legal bases. We rely on your consent for marketing messages and for non-essential cookies, on our legitimate interests for operating and securing the website, and on the steps necessary to respond to your requests.
- Your rights. You may have the right to access, correct, delete, restrict, or object to our use of your personal information, and the right to data portability and to withdraw consent at any time. To exercise any of these, please contact us using the details in Section 13.
- International transfer. Your personal information will be processed in the United States. We rely on appropriate safeguards for any transfer where the law requires them.
- Complaints. You have the right to complain to your local data-protection authority. We would appreciate the chance to address your concern first.
This note is intentionally brief. Our current audience is in the United States, and this note describes the obligations the law already places on us; it does not add to them.
13. How to contact us
Mailing Address:
Wellua, Inc.
Attention: Privacy
101 Cooper Street, Santa Cruz, CA 95060
Email: privacy@wellua.com
General email: care@wellua.com
14. Changes to this policy
We may update this policy as our business grows or as the law changes. When we make a meaningful change, we will update the "Last updated" date above, and, where the law requires it, we will give you additional notice. We encourage you to review this policy from time to time.
Thank you for trusting Wellua with your information. We will continue to earn that trust by collecting little, being clear, and treating your information with care.