Privacy Policy

• Things you type. If you contact us we receive your name, email address, and message. If you apply for a role we receive your name, contact details, and the resume you attach.
• Your order and cart. Adding something to your basket sets a shopify_cart_id cookie so the basket survives a reload. It lasts 30 days and holds an identifier for the cart, not your payment details.
• Your vote, if you cast one. Voting in the flavour poll stores the flavour you picked in a orcha_flavor_vote cookie for a year, so we do not ask you twice. It holds the flavour and nothing else — no identifier, nothing that follows you anywhere. If you write in a suggestion, we keep the text you typed; we do not record who sent it.
• How the site is used. Pages viewed, products opened, items added to the basket, and when checkout is started — along with the usual technical details a web request carries, such as approximate location from IP address, device, and browser.
• Where you came from. If you arrive from an ad, the click identifier in the link (for example gclid) is stored in your browser for up to 90 days and passed to checkout, so the advertising platform can tell that its ad led to an order.

We do not knowingly collect information from children, and the site is not directed at them.

We never see your card. Checkout happens on Shopify, on a different address to this site, and payment is handled entirely by Shopify and its payment processors. Nothing on drinkorchatea.com touches your card number.

• To take, ship, and support your order, and to answer you when you write to us.
• To understand how the shop is used — which pages people read, where they stop, and whether a change made things better or worse.
• To measure and improve advertising, including telling an ad platform that a purchase happened so it stops showing you an ad for something you already bought.
• To keep the site working and secure, including diagnosing errors.
• To meet our legal and accounting obligations.

We do not sell your personal information for money. We do share it with the services that run the shop, each of which only receives what it needs:

• Shopify — products, baskets, checkout, payment, and order fulfilment.
• Vercel — hosting and delivery of this site.
• PostHog — product analytics, including session recordings that show how pages were used. Requests are proxied through our own domain.
• Sentry — error reporting, so a broken page can be found and fixed.
• Meta — advertising measurement through the Meta pixel, so we can tell whether an ad led to a visit or an order.
• Google — advertising measurement, and Google Maps to draw the stockist map.
• Supabase and Resend — storing and delivering messages you send us through the contact and careers forms.

We may also disclose information where the law requires it, or to a buyer if the business is sold.

Advertising and analytics tools can set cookies or similar identifiers and receive information about your visit. Under California law, disclosing personal information to an advertising platform to show you relevant ads counts as sharing for cross-context behavioural advertising, even though no money changes hands — so we describe it that way rather than claiming we do nothing of the sort.

You can opt out. Email us at founders@drinkorchatea.com with “Do Not Sell or Share” in the subject and we will action it. Your browser’s Global Privacy Control signal, ad-blocking extensions, and the opt-out settings offered by Meta and Google also limit what these tools can collect.

Depending on where you live — and this applies to California residents under the CCPA as amended by the CPRA — you can ask us to:

• Tell you what personal information we hold about you and where it came from.
• Delete it, subject to records we are required to keep.
• Correct it if it is wrong.
• Stop sharing it for advertising, as described above.

Email founders@drinkorchatea.com and we will respond within the time the law allows. We will not treat you differently for asking.

Order records are kept as long as accounting and tax rules require. Messages and applications are kept while they are useful and then deleted. Analytics data is retained by the services above under their own schedules; the ad click identifier in your browser expires after 90 days, and the cart cookie after 30.

If this policy changes we will update the date at the top. If a change materially affects how we use your information, we will say so on the site rather than leave you to notice.

Questions, requests, or complaints: founders@drinkorchatea.com. You can also reach us through the contact page.