Privacy Policy

1.1. Information you provide directly

• Email address — when creating an account, placing an order, or contacting us;
• First and last name — for orders and delivery;
• Delivery address and phone number — for delivering the order;
• For MetaRewards and giveaways: phone number, Instagram username, country, age/rules confirmation, and verification results;
• The content of messages you send us.

1.2. Automatically collected data

• IP address — automatically recorded when you access the Site;
• Browser type, device information, and activity on the Site (pages viewed, access time);
• Technical data collected via cookies.

1.3. Payment and fraud-prevention data: Full card details are not stored on our servers; payments are processed by Stripe. We receive payment status, transaction identifiers, and a non-reversible card fingerprint generated by Stripe to prevent promotion abuse. We also create a non-reversible address fingerprint from the verified delivery address.

3.1. Strictly necessary cookies: login state, cart, language preference, and your cookie choice itself. The Site cannot function without them, and they are not part of the choice.

3.2. Measurement: anonymous counting of page views and traffic sources (Vercel Web Analytics). This measurement sets no cookies, does not track you across websites, and stores no persistent identifier.

3.3. Advertising and conversion measurement: Meta (Facebook/Instagram), Google Ads, and TikTok pixels. These services receive the internal identifier (UUID) of the product viewed, cart and order value, currency, and an event identifier.

3.4. PRODUCT NAMES ARE NOT SENT TO ADVERTISING PLATFORMS. Because the catalogue includes health-related products, only an internal identifier is transmitted instead of a readable product name. When you complete an order, your email and phone number are irreversibly hashed (SHA-256) before being sent for matching — they are never transmitted in clear text.

3.5. The consent regime depends on where you are. In the European Economic Area, the United Kingdom, Switzerland, and in the US states of Washington, Nevada, and California, advertising and measurement cookies load ONLY after you give explicit consent. In other locations they are active and you may opt out at any time.

3.6. To change your choice: delete this Site's `mm_consent` cookie in your browser and the choice panel will appear again. When you opt out, the advertising pixel scripts are not loaded at all.

3.7. You can disable cookies entirely in your browser settings, but in that case some features of the Site (e.g., the cart and account login) may not work properly.

4.1. We do not sell or rent your personal data for money. However, under the broad definition in California law (CCPA/CPRA), the data passed to advertising pixels may qualify as "sharing for cross-context behavioral advertising". To opt out of that sharing, decline in the cookie choice panel (see section 3.6) — this serves as your "Do Not Sell or Share My Personal Information" request.

4.2. Data may be shared only in the following cases:

• Stripe — for processing payments;
• Logistics companies — for delivering the order (name, address, phone);
• Legal requirements — based on a court order or a lawful request from competent state authorities;
• Fraud prevention — during the investigation of security incidents.
• Giveaway results — the winner's Instagram username is published openly on the Site so the draw can be verified. If you would rather not appear, email info@metamuscle.shop and we will remove it.

4.3. Our service partners may use the data only to perform their own functions.

5.1. Account data is stored for as long as your account is active.

5.2. Order and payment records are retained for the necessary period in accordance with accounting and legal requirements.

5.3. IP addresses are kept for 3 months for security and fraud prevention, then deleted automatically by a scheduled daily process — no manual step is involved. Statistical records themselves may be retained, but without the IP address.

5.4. This 3-month period applies to our own database. Our hosting, CDN/security and email providers keep their own technical request logs according to their own schedules, which we cannot shorten. Those providers process the data only to deliver their service.

5.5. For accounts taking part in the contest we store a browser fingerprint — a non-reversible digest built from device and browser characteristics. Its purpose is to stop one person collecting rewards through many accounts. It is kept alongside the IP address and removed after the same 3-month period. It is not used to identify who you are.

6.1. Your data is protected with appropriate technical and organizational measures (SSL encryption, restricted access rights) against unauthorized access, loss, and misuse.

6.2. No internet transmission is 100% secure; absolute security cannot be guaranteed, but we take all reasonable measures to minimize risks.

• Request a copy of the data stored about you;
• Request correction of incorrect data;
• Request deletion of your data (except for records that must be retained by law);
• Opt out of marketing emails at any time (via the “unsubscribe” link in the message or by contacting us).

To exercise these rights, contact info@metamuscle.shop. Requests are answered within a reasonable period.

The Site is not intended for persons under 18, and we do not knowingly collect personal data from them. If such a case is discovered, the data is deleted.

This Policy may be updated from time to time. Changes are published on this page and the “Last updated” date is changed accordingly. You may be notified of significant changes via email.

Email: info@metamuscle.shop

Website: www.metamuscle.shop

Data controller: PAYAM LLC, Garland, Texas 75044, USA