Privacy Policy

---

Rooted Source Herbs · Source Enterprises LLC
Last Updated: March 24th 2026

Your privacy is important to Rooted Source Herbs ("RSH," "we," "us," or "our"). This Privacy Policy explains how we collect, use, protect, and handle your personal information when you visit our website at www.rootedsourceherbs.com (the "Site") or purchase our products. By using this Site, you agree to the practices described in this policy.

· · ·

1 Information We Collect

We collect only the minimum personal information necessary to process your order and communicate with you. This may include:

Information You Provide Directly: Your name, email address, shipping address, billing address, and phone number — collected when you place an order or create an account. Payment information (credit card or debit card number, expiration date, and billing details) — collected and processed securely at checkout through our third-party payment processor.

Information Collected Automatically: When you visit our Site, we may automatically collect certain technical information through cookies and similar tracking technologies, including your IP address, browser type, device type, pages viewed, and referring URL. This data is used solely to analyze website traffic and improve your experience. For more details, see Section 6 (Cookies) below.

Email Subscription Information: If you subscribe to our newsletter or mailing list, we collect your email address to send you updates about upcoming products, promotions, and discounts offered by RSH.

· · ·

2 How We Use Your Information

We use the personal information we collect for the following purposes only:

To process and fulfill your orders, including shipping, payment processing, and order confirmation. To communicate with you regarding your orders, account, or customer service inquiries. To send periodic email updates about new products, promotions, and discounts — only if you have opted in to receive such communications. To improve our website, products, and customer experience. To comply with applicable legal obligations.

We do not sell, trade, rent, or otherwise share your personal information with third parties for their marketing purposes.

· · ·

3 How We Protect Your Information

We take the security of your personal information seriously. Your data is protected using industry-standard encryption technology (SSL/TLS) during transmission. Payment information is processed through PCI-DSS compliant third-party payment processors and is not stored on our servers. We maintain reasonable administrative, technical, and physical safeguards designed to protect the personal information we collect against unauthorized access, disclosure, alteration, or destruction.

While we strive to use commercially acceptable means to protect your information, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

· · ·

4 Third-Party Service Providers

We may share your personal information with trusted third-party service providers who assist us in operating our website, processing payments, and fulfilling orders. These providers include:

Payment processors (e.g., Stripe, PayPal, Square, or the processor integrated with our website platform) to securely handle credit card and payment transactions. Shipping carriers (e.g., USPS, UPS, FedEx) to deliver your orders. Website hosting and platform provider (e.g., GoDaddy) to host and maintain our website. Email marketing service (e.g., Mailchimp, Constant Contact, or the email tool integrated with our platform) to distribute newsletters and promotional communications.

These service providers are authorized to use your personal information only as necessary to perform services on our behalf and are contractually obligated to protect your data. We do not sell your personal information to any third party.

· · ·

5 Email Communications & Your Choices

If you subscribe to our email list, you will receive periodic updates about upcoming products, promotions, and discounts from RSH. You may opt out of receiving marketing emails at any time by clicking the "Unsubscribe" link at the bottom of any email or by contacting us at [insert email address].

Please note that even if you opt out of marketing communications, we may still send you transactional emails related to your orders (such as order confirmations and shipping notifications).

Our email marketing practices comply with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.), which requires that commercial emails clearly identify the sender, include a valid physical mailing address, and provide a clear mechanism to opt out of future messages.

· · ·

6 Cookies & Tracking Technologies

Our Site uses cookies — small text files stored on your device — to analyze website traffic and optimize your browsing experience. Cookies help us understand how visitors interact with our Site so we can improve content, functionality, and performance.

We use the following types of cookies:

Essential cookies: Required for the Site to function properly (e.g., shopping cart, checkout). Analytics cookies: Used to collect aggregated, anonymous data about how visitors use the Site (e.g., pages visited, time spent). We do not use cookies to personally identify you or to serve targeted advertising.

You may control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Site, including the checkout process. By continuing to use our Site after being presented with our cookie notice, you consent to the use of cookies as described in this policy.

· · ·

7 Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Order records may be retained for [insert number, e.g., 5] years to comply with tax and business recordkeeping obligations. If you request deletion of your data, we will honor that request within a reasonable timeframe, subject to any legal obligations that require us to retain certain records.

· · ·

8 Your Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal information under applicable state privacy laws. These rights may include:

Right to Know / Access: You may request that we disclose what personal information we have collected about you. Right to Delete: You may request that we delete the personal information we have collected from you, subject to certain exceptions. Right to Correct: You may request correction of inaccurate personal information. Right to Opt Out: You may opt out of the sale of your personal information. As stated above, RSH does not sell your personal information. Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, please contact us at [insert email address] or [insert mailing address]. We will respond to verified requests within 45 days, as required by applicable law.

Virginia Residents: The Virginia Consumer Data Protection Act (VCDPA), Va. Code § 59.1-575 et seq., grants Virginia residents certain privacy rights, including the right to access, correct, delete, and obtain a copy of personal data, and the right to opt out of the processing of personal data for targeted advertising or the sale of personal data. To submit a request, contact us using the information above. If we decline your request, you have the right to appeal by contacting us, and if unsatisfied with our response, you may file a complaint with the Virginia Attorney General.

California Residents: If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), Cal. Civ. Code § 1798.100 et seq. However, the CCPA generally applies to businesses meeting certain thresholds (e.g., annual gross revenue exceeding $26.625 million, or processing data of 100,000+ consumers). While RSH may not currently meet these thresholds, we are committed to honoring consumer privacy requests from all customers regardless of location.

· · ·

9 Children's Privacy

Our Site is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe we have collected information from a child under 13, please contact us immediately at [insert email address].

This practice is in compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.

· · ·

10 Third-Party Links

Our Site may contain links to third-party websites, including social media platforms. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policy of any third-party site you visit.

· · ·

11 Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of the Site after any changes constitutes your acceptance of the updated policy.

· · ·

12 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact us at:

Rooted Source Herbs
Source Enterprises LLC

POB 1048

Chesapeake, VA 23323

Website: www.rootedsourceherbs.com

© 2026 Source Enterprises LLC — All Rights Reserved

The following federal and state laws are referenced in or applicable to this privacy policy:

CAN-SPAM Act (2003)
Governs all commercial email communications. Requires a clear opt-out mechanism, a valid physical mailing address in every commercial email, truthful subject lines, and prompt honoring of unsubscribe requests (within 10 business days).

15 U.S.C. § 7701 et seq. 16 CFR Part 316

Children's Online Privacy Protection Act (COPPA)
Prohibits the collection of personal information from children under 13 without verifiable parental consent. Applies to websites and online services directed to children or that knowingly collect data from children under 13.

15 U.S.C. § 6501 et seq. 16 CFR Part 312

Federal Trade Commission Act (FTC Act)
Prohibits unfair or deceptive acts or practices in commerce, including deceptive privacy practices. The FTC enforces privacy commitments made in privacy policies — meaning that failing to follow your own stated privacy practices can result in an FTC enforcement action.

15 U.S.C. §§ 41–58

Payment Card Industry Data Security Standard (PCI DSS)
While not a federal law, PCI DSS is an industry-mandated security standard for any business that accepts, processes, stores, or transmits credit card information. Compliance is required by all major credit card networks. Referenced in this policy regarding payment data security.

PCI DSS v4.0 (effective March 2025)

Virginia Consumer Data Protection Act (VCDPA)
Virginia's comprehensive consumer privacy law, effective January 1, 2023 (amended 2025, with additional amendments effective January 1, 2026). Grants Virginia residents rights to access, correct, delete, and obtain copies of personal data, and to opt out of the sale of personal data and targeted advertising. Applies to entities doing business in Virginia that control or process data of 100,000+ Virginia residents, or 25,000+ residents if deriving 50%+ of revenue from data sales. Although RSH may not meet these thresholds, the policy voluntarily honors these rights for all customers.

Va. Code § 59.1-575 et seq.

California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
California's comprehensive privacy law, with updated regulations effective January 1, 2026. Applies to for-profit businesses with annual gross revenue exceeding $26.625 million, that process data of 100,000+ California consumers, or derive 50%+ of revenue from data sales. While RSH may not meet these thresholds, the policy acknowledges California residents' rights as a best practice.

Cal. Civ. Code § 1798.100 et seq. 21 CFR § 101.93 (CCPA Regulations, effective January 1, 2026)

Virginia Data Breach Notification Law
Requires businesses to notify Virginia residents and the Virginia Attorney General in the event of a data breach involving personal information.

Va. Code § 18.2-186.6

Other State Privacy Laws (2026 Landscape)
As of 2026, over 20 states have enacted comprehensive consumer privacy laws. Since RSH sells online to customers nationwide, the policy is designed to meet the most common requirements across state privacy laws, including rights to access, delete, correct, and opt out of data sales.

Including but not limited to: CO CPA, CT CTDPA, UT UCPA, DE DPDPA, IN ICDPA, KY KCDPA, RI RIDTPPA