Privacy policy

Effective date: October 6, 2026

Who we are

Cilia Labs is a trading name of IZEE LTD, a company registered in England and Wales (company number 17250889), at 87 Beaumont Road, London SW19 6TH, United Kingdom. In this policy "Cilia Labs", "we" and "us" mean IZEE LTD. We are the controller of the personal information described here. Email hello@cilialabs.com for anything about privacy.

What this policy covers

cilialabs.com, our storefront on the Shop app, our checkout, the emails and text messages we send, our chat, and the customer service we provide. It does not cover websites we link to, or the privacy practices of the payment providers and apps named below, which have their own policies.

We sell dietary supplements only to adults 21 and over, and we ship only within the United States: the 48 contiguous states and the District of Columbia. If you are anywhere else you can read the site, but you cannot order.

What we collect

Information you give us

Contact and delivery details: name, email address, phone number, shipping and billing address.
Order details: what you bought, when, for how much, and any discount code you used.
Payment details: handled by Shopify Payments, Shop Pay, PayPal, Apple Pay or Google Pay. We see the payment method type, the last four digits and the outcome. We never see or store your full card number.
Account details: if you sign in to an account, the email address you sign in with, your order history and your subscription settings. Shopify signs you in with a one-time code sent to your email, so there is no password.
Subscription details: the products, the monthly delivery schedule, the next charge date and the payment method on file for renewals.
Messages: anything you send us by email, chat or the contact form.
Reviews: if you leave a review through Judge.me, the review text, rating, any photo or video you upload, and the name you choose to show.
Marketing preferences: whether you have said yes to email or text messages.

Information collected automatically

Device and browsing information: IP address, browser type, operating system, screen size, referring page, the pages you view and how long you view them, and the products you look at or add to your cart.
Cookies and similar technologies: small files and pixels that recognize your browser. Details are under "Cookies, pixels and your choices".
Session recordings and heatmaps: through Microsoft Clarity, which records how a visitor moves around a page (clicks, scrolls and mouse movement). Clarity masks the text you type into the site by default, and we keep that setting on.

Information from others

Shopify gives us order and checkout information, including from Shop Pay and the Shop app.
Klaviyo gives us signup information from our popup and forms.
Shopify Collabs tells us which creator's code or link an order used. Creators see the sales linked to their code or link, not your name or address.
Judge.me gives us reviews you post.

How we use it

To make and deliver what you ordered. Your name, address, phone number and order contents go to our manufacturing and fulfillment partner, Supliful, which ships from US warehouses, and to the carrier.
To run subscriptions: charging the payment method on file every month until you cancel, retrying a payment that fails, sending the reminder before each charge and a yearly reminder of your subscription terms, and acting on your choices to skip, pause, cancel or change a subscription.
To answer you when you write to us.
To send you marketing emails and text messages, only if you have agreed, and to stop as soon as you unsubscribe.
To send order, shipping, subscription and account emails, which are not marketing and continue while you have an order or subscription with us.
To ask for a review after delivery, through our review provider. Each request has an unsubscribe link.
To show and measure our advertising, including through the pixels described below.
To understand how the site is used and to improve it.
To detect fraud and keep the site secure.
To apply the limits on our offers: one use of each discount code per customer. We check the email address, phone number and shipping address against earlier orders.
To keep the records the law requires and to enforce our terms.

Who we share it with

We share personal information with service providers who act for us and are bound to use it only for our purposes, and we share it with advertising partners as described. We do not sell your personal information for money.

Some of the tools below (Klaviyo, Judge.me, ReConvert, Microsoft Clarity, and the Meta, TikTok and Google tools) are being added as the store grows. We describe them here so that this policy covers each one from the day it goes live.

Who	What they receive	Why
Shopify	Everything above; Shopify hosts the store, the checkout, accounts, subscriptions (Shopify Subscriptions), kits (Shopify Bundles), chat (Shopify Inbox), the creator program (Shopify Collabs), the Shop app and Shop Pay	Running the store
Supliful	Name, shipping address, phone number (for the carrier), order contents	Making and shipping your order
Shipping carriers, including USPS (through Supliful)	Name, address, phone number	Delivery and tracking
Shopify Payments, PayPal, Apple Pay, Google Pay, Shop Pay	Payment details, billing address, order value	Taking payment; fraud prevention
Klaviyo	Email address, phone number, name, order history, site activity, consent records	Email and text marketing, order and subscription reminders
Judge.me	Email address, name, order details, review content	Requesting and displaying reviews
ReConvert	Order details	Showing a post-purchase offer on the thank-you page
Microsoft (Clarity)	Device and browsing information, masked session recordings	Understanding how the site is used
Meta Platforms (Meta Pixel and Conversions API), TikTok (TikTok Pixel), Google (Google Analytics 4, Google Ads, Merchant Center)	Device and browsing information; events such as a page view, add to cart or purchase, with the order value but not the names of the products, collections or pages involved; and a hashed email address where the platform supports it. Never your phone number, and never your text-message opt-in data or consent	Measuring and showing advertising
Professional advisers, banks, insurers	What they need	Accounting, legal and insurance
Authorities	What the law requires	Legal obligations, and protecting our rights and our customers

We have turned on Shopify Network Intelligence. This lets Shopify use information from our store, together with information from other Shopify stores, to run and improve its own services. Shopify handles that information under its own privacy policy (shopify.com/legal/privacy). Shopify's use of this information for its own services may count as a "sale" or "sharing" under some state laws, so we count Shopify as a recipient and apply your opt-out of sale and sharing to it as well.

If IZEE LTD or Cilia Labs is sold or merged, personal information moves with the business, under this policy.

Cookies, pixels and your choices

Cookies are small files set by the site. Pixels are snippets that report events (a page view, a purchase) to us or to an advertising partner. We use three kinds:

Essential: the cart, the checkout, your login, security. The site does not work without them.
Analytics: Shopify analytics, Google Analytics 4, Microsoft Clarity. They tell us what is used and what is broken.
Marketing: Meta, TikTok and Google pixels, and Klaviyo tracking. They let us measure ads and show you ours elsewhere.

We sell only in the United States, and our site does not show a cookie banner to visitors in the United States. Analytics and marketing cookies and pixels are therefore set when you visit, unless you opt out as described below.

To opt out of the sale or sharing of your personal information and of targeted advertising, use the "Your Privacy Choices" link in the footer (cilialabs.com/pages/data-sharing-opt-out). Shopify makes this page available automatically to visitors from California, Colorado and 13 other states whose laws give this right. If you live in any other US state, email hello@cilialabs.com and we will honor the same request. Your choice on that page is saved in your browser, so make it again on each browser or device you use, or email us to apply it to your account. We honor Global Privacy Control signals where Shopify supports them, as an opt-out of sale and sharing for that browser. Our site does not respond to browser "Do Not Track" signals, because there is no common standard for them; we do honor Global Privacy Control as described here.

You can also block or delete cookies in your browser. Blocking essential cookies will stop the checkout working.

Email and text messages

Email. We send marketing email only to people who signed up or left the box checked at checkout. The email box at checkout is checked in advance, and you can uncheck it. Every marketing email has an unsubscribe link, and unsubscribing takes effect right away. Order, shipping, subscription-reminder and account emails are not marketing and continue for as long as you have an order or subscription with us.

Text messages. The text-message box at checkout is never checked in advance. If you enter your mobile number and check the box, or sign up for texts through one of our forms, you give your express written consent to receive recurring automated marketing text messages from Cilia Labs at that number, such as offers and cart reminders. Consent is not a condition of buying anything. Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out, and HELP for help. You can also opt out by replying CANCEL, END, QUIT, UNSUBSCRIBE or REVOKE, or by telling us in any other reasonable way, such as by email to hello@cilialabs.com, and we act on it promptly. Carriers are not liable for delayed or undelivered messages. We keep a record of your consent, including when and where you gave it and the number you gave. We do not sell, rent or share your mobile number, text-message opt-in data or consent with third parties or affiliates for their marketing or promotional purposes; the only companies that receive them are the service providers that collect them and send our messages for us, such as Shopify and Klaviyo. Our terms of service and this policy apply to our text messages.

How long we keep it

Order and payment records: seven years, for tax and accounting law. Account information: while your account exists, and then as part of the order records. Subscription consent records: at least three years, or one year after the subscription ends, whichever is longer. Marketing consent and contact details: until you unsubscribe, and then on a suppression list so we do not contact you again. Text-message consent records: at least four years after you opt out or after our last message to you, whichever is later. Chat and email: three years after the conversation ends. Reviews: while they are shown on the site, or until you ask us to remove them. Device and browsing information held in Shopify and Klaviyo: while it is linked to your order records or marketing profile, and no longer than those records. Analytics and session recordings: we set Google Analytics to keep user-level data for no more than 14 months, and Microsoft Clarity normally deletes individual session recordings after 30 days. Advertising platforms keep event data under their own policies. Where a shorter or longer period is required by law, we follow the law.

Security

The store runs on Shopify, which is PCI DSS Level 1 compliant; card details are handled by the payment providers and never reach our systems. Access to customer data inside Shopify and the other tools we use is limited to the people who need it. No system is perfect. If a breach affects you, we will tell you and the relevant authorities as the law requires.

Children

Cilia Labs products are for adults 21+, and we do not sell to anyone under 21. The site is not directed at anyone under 21, and we do not knowingly collect information from anyone under 21. We do not knowingly sell or share the personal information of consumers under 16. If you believe a minor has given us information, email hello@cilialabs.com and we will delete it.

Your privacy rights

Anyone can ask us what we hold about them, ask us to correct it or delete it, and unsubscribe from marketing. Email hello@cilialabs.com. We will confirm your identity by matching the details on your account or a recent order. We reply within one month of receiving your request. If a request is complex, or you send several, we may take up to 45 more days; if so, we tell you why within the first month. We act on a request to opt out of sale or sharing, or to limit the use of sensitive personal information, within 15 business days. If we cannot do what you ask (for example, because we must keep order records for tax law) we will say so and why. We never charge for a request and we never punish you for making one.

California residents

This section applies if you live in California. It reflects the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We give these rights to every California resident whether or not the law's size thresholds apply to us.

What we collect, by category: identifiers (name, email, phone, address, IP address, cookie and device IDs); customer records (billing and shipping details, payment method type); commercial information (orders, subscriptions, reviews); internet activity (pages viewed, products viewed, cart events, session recordings); approximate location (from IP address); inferences (for example, that you are interested in a product because you viewed it). Sources: you, your device, and the partners named above. Purposes: as set out in "How we use it". Who receives each category: as set out in "Who we share it with". How long we keep it: as set out in "How long we keep it".

Sensitive personal information. Some of what we collect, such as the products you view or buy, can suggest something about your health or habits, for example an interest in a sleep formula or in cutting down on vaping. We regard that as sensitive personal information. We use it to fill your orders, run your account and subscription, answer you, prevent fraud and keep the site secure and, if you have signed up for our marketing, to choose which of our own emails and texts to send you. We do not use it to infer anything else about you, and we do not use it for advertising on other sites: the events our site sends to advertising partners do not say which products you viewed or bought. Apart from Shopify's possible use through Shopify Network Intelligence, described under "Who we share it with", we do not sell or share it. We do not collect other sensitive personal information: we never see your full card number, and we do not collect government ID numbers, precise location or biometric data.

Selling and sharing. We do not sell personal information for money. Our use of the Meta, TikTok and Google pixels and advertising tools may count as a "sale" or as "sharing" for cross-context behavioral advertising under California law, and so may Shopify's use of store information through Shopify Network Intelligence, so we count both as sales and sharing. For the advertising partners, the categories involved are identifiers (such as cookie IDs, IP address and hashed email address), internet activity (such as visits to our site) and commercial information (that you added something to your cart or placed an order, and the order value, but not which products). Through Shopify Network Intelligence, Shopify may receive identifiers, commercial information and internet activity from our store. The recipients are Meta, TikTok, Google and Shopify. You can opt out through the "Your Privacy Choices" link in the footer, by turning on Global Privacy Control in your browser (where Shopify supports it), or by emailing hello@cilialabs.com. We do not knowingly sell or share the personal information of anyone under 16.

Your rights: to know what we collect and how we use and disclose it; to access a copy; to delete it; to correct it; to opt out of sale and sharing; to limit the use of sensitive personal information to what is needed to provide the products and services you ask for; and not to be discriminated against for using any of these rights. To exercise them, email hello@cilialabs.com. To opt out of sale and sharing, you can also use the "Your Privacy Choices" link in the footer or turn on Global Privacy Control. We confirm that we have received your request within 10 business days and tell you how we will verify it. We verify requests by matching your email address and recent order details, and we may ask for one more piece of information; we do not ask you to verify a request to opt out or to limit. An authorized agent may act for you with your written permission, which we will check with you. We act on a request to opt out of sale or sharing, or to limit the use of sensitive personal information, within 15 business days. We respond to other requests within the times set out at the start of "Your privacy rights" above.

Notice of financial incentive. When you join our email list through our signup popup or form, we send you the code WELCOME10: 10% off a one-time purchase, usable once per customer. It does not apply to subscriptions and cannot be combined with another code. In return we receive your email address, permission to send you marketing email, and the activity on our site that our email provider then links to that address. If the form also asks for a mobile number, giving it is optional and is not needed for the code. We value this information at the value of the discount itself: 10% of the order you use it on, for example $6.00 on The Clear Kit at $59.99. To opt in, enter your email address in the popup or form. Joining is your choice. You can withdraw at any time by unsubscribing, and a code you already received stays valid. We offer no other financial incentive in exchange for personal information.

Residents of other US states

If you live in a state with a consumer privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others), you may have rights to access, correct and delete your personal information, to get a copy of it in a portable format, and to opt out of targeted advertising and of the sale of your personal information. We offer all of these rights to every US customer, whether or not your state's law applies to us. Email hello@cilialabs.com. Where the "Your Privacy Choices" link appears in the footer for your state, you can also use it to opt out of targeted advertising and sale. We reply within the times set out at the start of "Your privacy rights" above.

If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line. We will review the decision and reply in writing within 45 days, explaining what we decided and why. If we deny your appeal, you can complain to your state attorney general, and our reply will tell you how.

Consumer Health Data Privacy Policy (Washington, Nevada and similar laws)

Washington's My Health My Data Act, Nevada's consumer health data law and similar laws in other states, such as Connecticut, protect consumer health data: information linked or reasonably linkable to you that identifies your past, present or future physical or mental health status. For us, that can include which supplements you view, add to your cart, buy or subscribe to, what you tell us about them in messages, and the reviews you write.

What we collect, from where, and why: the information just described, from you and your device, to fill your orders, run your account and subscription, answer you, prevent fraud and keep the site secure and, if you have signed up for our marketing, to choose which of our own emails and texts to send you.
Who receives it: the service providers that process it for us: Shopify, Supliful and the carriers, our payment providers, Klaviyo, Judge.me, ReConvert and Microsoft (Clarity). Shopify may also use it for its own services through Shopify Network Intelligence, described under "Who we share it with"; we count that as a possible sale or sharing, and your opt-out applies to it. Otherwise we do not sell or share consumer health data, and we never share it with advertising partners.
Consent: where your state's law requires your consent before we collect, use or share consumer health data for a purpose beyond providing what you asked for, we ask for it first, separately from anything else, and you can withdraw it at any time.
Your rights: you can ask us to confirm whether we collect, share or sell your consumer health data, to see it together with a list of the companies we have shared it with, to delete it, and to withdraw any consent you gave. Email hello@cilialabs.com. We reply within the times set out at the start of "Your privacy rights" above. You can appeal a refusal as described above, and if we deny your appeal you can complain to your state attorney general.

UK data protection law (applies to everyone)

IZEE LTD is a UK company, so UK data protection law (the UK GDPR and the Data Protection Act 2018) applies to all the personal information we handle, including that of our customers in the United States. You have the rights in this section wherever you live, in addition to any rights your state's law gives you. IZEE LTD is the controller. Our legal bases are: performance of a contract (orders, subscriptions, customer service); consent (marketing email you sign up for through our forms, all marketing text messages, and cookies where the law requires consent); legal obligation (tax and accounting records); and legitimate interests (marketing email to customers who leave the checkout box checked, which you can stop at any time by unsubscribing; fraud prevention and applying our offer limits; security; measuring and improving the site and our advertising; and running the business). You can object at any time to processing based on legitimate interests, and we always stop marketing when you object. You have the right to access, correct, delete and port your information, to object to or restrict processing, to withdraw consent at any time, and to complain to the Information Commissioner's Office (ico.org.uk). We reply within the times set out at the start of "Your privacy rights" above.

You need to give us your name, delivery address, email address and phone number to place an order; without them we cannot take or deliver it. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing; a person reviews any order our tools flag for fraud before we cancel it. Payment providers may also decline a payment under their own fraud checks. If you have a complaint about how we use your information, tell us first at hello@cilialabs.com; we acknowledge it within 30 days and tell you the outcome. You can complain to the ICO at any time.

We do not offer goods or services to people in the European Union or the European Economic Area, and we do not aim our advertising or tracking at people there, so we have not appointed a representative there.

International transfers

Our service providers (Shopify, Supliful, Klaviyo, Judge.me, ReConvert, Microsoft, Meta, TikTok and Google) process personal information mainly in the United States, and some also process it in other countries, such as Canada, under their own safeguards. Personal information about US customers is processed in the US, and we access it from the United Kingdom. For transfers out of the UK we rely on UK adequacy regulations where they cover the destination (for Canada, these cover commercial organizations subject to Canada's federal private-sector privacy law), on the UK Extension to the EU-US Data Privacy Framework where a US provider is certified under it, and otherwise on the standard contractual clauses in the provider's data processing terms together with the UK International Data Transfer Addendum. You can ask for a copy of the safeguard for any provider at hello@cilialabs.com.

Changes

When we change this policy we change the effective date at the top. For a change that matters, we also email customers. We review and update this policy at least once every 12 months. The current version is always at cilialabs.com/policies/privacy-policy.