Privacy Policy

1. Scope of this policy

This policy applies to the Haven platform — a business software service that lets organizations manage inventory, stock rooms, deliveries, team members, and related operations — and to the Haven marketing website. It does not cover the separate Earth Store retail shop or any third-party website that links to or from the Services. Haven does not process payment card information; we do not collect or store credit or debit card numbers through the Services.

2. Information we collect

We collect the following categories of personal information:

• Account and profile information — your name, email address, job title or position, assigned role, and the organization and locations you belong to. Accounts are created when an organization administrator invites you.
• Organization information — for business customers, we process the organization name, locations, team roster, and the operational data your team enters into the platform (for example, inventory items, stock-room layouts, notes, reminders, and uploaded files).
• Communications — information you provide when you contact us or submit our contact form, such as your name, email, and message.
• Technical and usage information — collected automatically when you use the Services, such as your IP address, browser and device information, and request logs (method, path, timestamp) used for security and reliability.
• Cookies — we use strictly necessary cookies for authentication and session management and, with your consent, first-party analytics and session-replay cookies (see Section 5).

3. How we use information

We use personal information to:

• provide, operate, secure, and maintain the Services;
• authenticate users and manage accounts and permissions;
• send service and transactional messages (for example, invitations, password resets, and operational notifications);
• respond to your inquiries and provide support;
• monitor, debug, and improve the reliability and performance of the Services;
• where you have consented, analyze product usage and record session replays to understand how the Services are used and improve them; and
• comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

4. How we share information

We share personal information only as needed to run the Services:

• Service providers (sub-processors) that process data on our behalf under contract, including Supabase (database and authentication), Vercel (application hosting), Amazon Web Services (file storage), Resend (transactional email), PostHog (first-party product analytics and session replay, used only with your consent), and Google (maps and address lookup, where used). They may only use the information to provide services to us.
• Within your organization — for business accounts, information you enter may be visible to other authorized members and administrators of your organization according to their roles.
• Legal and safety — when required by law, legal process, or to protect the rights, property, or safety of Earth Brands, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

5. Cookies and tracking

We use strictly necessary cookies to keep you signed in and to secure your session. Because these cookies are essential to operate the Services, they cannot be turned off through our consent banner, but you can control cookies through your browser settings; disabling essential cookies may prevent you from signing in. With your consent, we also use first-party analytics and session-replay cookies (PostHog) to understand product usage and improve the Services; these load only after you accept them through our consent banner. We do not use advertising or cross-site tracking cookies, and we do not sell your personal information. For more detail, see our Cookie Policy.

6. Business accounts and our role

When we provide the Services to an organization, we generally process that organization's member and operational data on the organization's behalf as a service provider (processor). The organization is responsible for its own privacy practices and for handling requests from its members. If you are a member of an organization and wish to exercise privacy rights over data your organization controls, we may direct your request to your organization administrator.

7. Your U.S. privacy rights

Depending on your state of residence, you may have some or all of the following rights regarding personal information we control:

• the right to know or access the personal information we hold about you;
• the right to request correction of inaccurate information;
• the right to request deletion of your personal information;
• the right to a portable copy of your information; and
• the right to opt out of the sale or sharing of personal information and certain profiling.

California residents have these rights under the CCPA/CPRA, including the right to non-discrimination for exercising them. Because we do not sell or share personal information for cross-context behavioral advertising, no "Do Not Sell or Share My Personal Information" action is necessary. Residents of other U.S. states (such as Virginia, Colorado, Connecticut, Utah, and others with comprehensive privacy laws) may have comparable rights.

To exercise any of these rights, submit our privacy rights request form or contact us using Section 11. We will verify your request and respond within the timeframe required by applicable law. You may use an authorized agent where the law permits.

8. Data retention and security

We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements, after which we delete or de-identify it. We use reasonable administrative, technical, and organizational safeguards, including encryption of data in transit (TLS), to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

The Services are intended for business use and are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date and, where required by law, communicated to you directly.

11. Contact us

For privacy questions or to exercise your rights, submit our privacy rights request form, email us at hello@earthbrands.earth, or use our contact page.

Earth Brands Inc.
108 1st Ave. #235
New York, NY 10009