Privacy policy

Effective date: September 2, 2026 | Last updated: September 10, 2026 | Version: 1.1

This Privacy Policy explains how Ariva Pharma, LLC, a California limited liability company and the owner and operator of the HYLOR brand (HYLOR, we, us, or our), collects, uses, discloses, and protects personal information. It also explains the privacy choices and rights that may be available to you.

To manage available cookie, sale, sharing, targeted-advertising, and consumer-rights choices, visit HYLOR Your Privacy Choices. The HYLOR Terms of Use and Sale govern use of the Site and transactions; this Policy governs how HYLOR handles personal information.

12-Month Practices Disclosure

This disclosure describes HYLOR's practices during the 12 months ending September 10, 2026. The HYLOR store remained password-protected and had not yet begun collecting email addresses through a public prelaunch or launch list during that period. Shopify Network Intelligence was enabled as of September 10, 2026. Meta, TikTok, Google, and Klaviyo advertising or behavioral-tracking tools had not been installed as of that date. Feature-dependent descriptions elsewhere in this Policy apply only when the corresponding feature becomes available and a person uses it.

Disclosure	Practices during the 12 months ending September 10, 2026
Personal information collected	IP addresses and browser or device identifiers; internet or other electronic-network activity, including request logs, security information, pages or content viewed, referral information, and Site interactions; approximate geolocation derived from IP address; privacy settings or signals; and communications or contact information a person chose to send directly to HYLOR.
Sources and purposes	Automatically from a browser or device; from Shopify and website, hosting, security, anti-abuse, and communication service providers; and directly from people who chose to contact HYLOR. HYLOR used the information to operate and secure the prelaunch Site, prevent abuse, troubleshoot, respond to messages, provide Shopify services and Enhanced Services, and comply with law.
Disclosed for business or commercial purposes	Identifiers, internet or electronic-network activity, approximate geolocation, privacy settings or signals, and communications were disclosed as applicable to Shopify and website hosting, security, anti-abuse, and communication providers for Site operation, security, customer service, Enhanced Services, and legal compliance.
Sold, shared, or used for targeted advertising	HYLOR did not sell personal information for money. During any portion of the period in which Shopify Network Intelligence was enabled, HYLOR treats identifiers, commercial information if collected, internet or electronic-network activity, approximate geolocation, and nonsensitive inferences used across HYLOR, other Shopify merchants, and Shopify for advertising as shared or used for targeted advertising where applicable law defines the activity that way. Meta, TikTok, and Google advertising pixels were not installed as of September 10, 2026.
Sensitive personal information	HYLOR did not use or disclose sensitive personal information for purposes that trigger a right to limit its use or disclosure.
Consumers under 16	HYLOR does not have actual knowledge that it sold or shared personal information of consumers under 16.

Feature-dependent practices. The remaining sections describe information HYLOR may process when a corresponding feature is available and you use it. References to orders, accounts, checkout, subscriptions, reviews, promotions, loyalty programs, analytics, or advertising do not mean that every feature is currently active or that HYLOR collects every example from every person. Before beginning a materially different collection or use that is not described here, HYLOR will provide any additional notice and choice required by law.

Scope

This Policy applies to drinkhylor.myshopify.com, drinkhylor.com, and any other HYLOR website, page, form, or online service that links to this Policy (collectively, the Site); HYLOR email lists and customer service; surveys, events, sampling programs, promotions, and consumer research; direct purchases from HYLOR; and other interactions in which you provide personal information to HYLOR.

It also applies to personal information we receive in connection with HYLOR purchases or interactions on a marketplace, social network, retailer platform, or delivery service when that third party provides the information to us. The third party's own privacy policy also applies to information it independently collects and controls.

This Policy does not apply to workforce or job-applicant information governed by a separate notice, information processed solely on behalf of another business under its instructions, or a third-party service that does not link to this Policy.

For purposes of privacy laws, Ariva Pharma, LLC is the business or controller of the personal information described here, except where another notice says otherwise.

Shopify Hosting and Network Intelligence

The Site and HYLOR online store are hosted by Shopify. Shopify collects and processes personal information when you visit, interact with, submit information to, or make a purchase from HYLOR to provide ecommerce hosting, checkout, payment-related services, security, fraud prevention, analytics, personalization, advertising, and related services.

As of September 10, 2026, Shopify Network Intelligence is enabled for the HYLOR store. Shopify may use personal information from your interactions and transactions with HYLOR together with information from your interactions with other Shopify merchants and with Shopify to provide Enhanced Services to HYLOR and other merchants. Enhanced Services may include advanced security and fraud prevention, store or product personalization, analytics, and advertising. Depending on applicable law, advertising based on activity with HYLOR, other Shopify merchants, and Shopify may be treated as sale, sharing, or targeted advertising.

Depending on how you interact with the Site, Shopify may process identifiers and contact information; commercial and transaction information; device, cookie, and advertising identifiers; internet or other electronic-network activity; approximate location; privacy settings and signals; and nonsensitive inferences. Information submitted to HYLOR, and information collected through use of the Site, may be shared with Shopify and other service providers and partners, including recipients located in countries other than the country where you live, to provide these services and Enhanced Services.

Learn more in the Shopify Consumer Privacy Policy. You may exercise applicable choices through HYLOR Your Privacy Choices, a recognized Global Privacy Control signal, and the Shopify Privacy Portal. The Shopify portal provides choices concerning certain processing handled directly by Shopify and does not replace a request submitted to HYLOR.

At a Glance

When you join a HYLOR email list, we collect the information requested on the form, such as your email address, to send launch, product, and marketing emails. You may unsubscribe at any time.

If you use shopping, account, checkout, customer-service, survey, promotion, sampling, or other features, we collect the information needed to provide that feature. Payment providers process complete payment credentials, while HYLOR receives transaction-related and limited payment information as described below.

The Site and providers supporting hosting, security, commerce, communications, analytics, or advertising may automatically collect device and interaction information. The technologies in use depend on active Site features and your privacy choices.

We do not sell personal information for money. Some analytics or advertising disclosures may be treated as a sale, sharing, or targeted advertising under state privacy laws even when no money changes hands.

When regulated advertising practices are active, you may use Your Privacy Choices to exercise applicable browser- or device-level choices. We honor legally recognized universal opt-out signals, such as Global Privacy Control, where applicable law requires and the relevant processing is active.

We do not use sensitive personal information to infer characteristics about you, and we do not sell sensitive personal information. Do not send medical or health information through a general HYLOR form.

Personal Information We Collect

The information we collect depends on how you interact with HYLOR and which Site features are active.

Information You Provide

Contact and list information. Email address and, when requested by a particular form, name, telephone number, postal address, company, and communication preferences. Each form identifies the information it requires.

Order and account information. Where orders and accounts are available: name, email, telephone number, billing and shipping addresses, account identifier, credentials or authentication data, order history, delivery instructions, product-issue and resolution information (including replacements, courtesy accommodations, refunds when applicable, and related communications), and preferences.

Payment information. Payment method and transaction details. Shopify, a payment processor, digital wallet, or marketplace may collect complete card or other payment credentials directly. HYLOR may receive a payment token, transaction status, card brand, expiration information, billing details, or limited digits, depending on the service. Do not send payment-card information by ordinary email.

Communications. Messages, attachments, photographs, call or chat details, and other information you provide to customer service, quality or safety teams, or through social media.

Feedback and public content. Reviews, ratings, recipes, survey answers, contest entries, testimonials, comments, images, videos, or other content you choose to submit. Content posted to a public feature may be visible to others.

Promotions and programs. Information needed for a sampling program, event, sweepstakes, referral, loyalty, ambassador, affiliate, or other program if offered, together with eligibility, tax, fulfillment, and participation records.

Professional and business information. Company, title, business contact details, and inquiry information when you contact us as a retailer, distributor, supplier, investor, service provider, media representative, or other business partner.

Other information you choose to provide. Please do not submit Social Security numbers, government identification, precise location, medical diagnoses, medications, GLP-1 use, bariatric or diabetes status, weight history, genetic data, or other sensitive or consumer health data through a general HYLOR form unless we specifically request it under an appropriate notice and consent process.

Information Collected Automatically

Depending on the Site features and technologies in use, we and providers acting for us may use cookies, pixels, tags, local storage, scripts, server logs, and similar technologies to collect:

IP address and approximate location derived from it;
browser, device type, operating system, language, time zone, network, and identifiers;
pages and content viewed, links clicked, searches, referral URL, date and time, session duration, and navigation;
interaction with forms, carts, checkout, accounts, emails, and advertisements;
cookie, advertising, and device identifiers;
security, fraud, diagnostic, performance, and error information; and
purchase and account events associated with a browser, device, or profile.

We may combine information across sessions, devices, Site features, service providers, and business records as permitted by law.

Information from Other Sources

We may receive information from:

Commerce and payment providers, such as Shopify and payment or fraud-prevention services;
Marketplaces and retailers, when they provide order, support, or promotion information relating to HYLOR;
Shipping and fulfillment providers, including delivery status, address corrections, and damage or loss information;
Email, customer-service, analytics, and advertising providers, including campaign delivery, engagement, conversion, and audience information;
Social networks and public sources, when you interact with HYLOR or make information public;
Business partners, in connection with a disclosed co-sponsored event, promotion, wholesale relationship, or service; and
Another person, if that person sends you a gift or lawfully provides your information. We ask users not to provide another person's information without permission or lawful authority.

How We Use Personal Information

We may use personal information to:

provide the Site, lists, requested information, Products, accounts, and customer service;
process and fulfill orders, payments, and deliveries; and address non-delivery, damage, product-quality, safety, replacement, courtesy accommodation, refund, and other customer-service matters;
authenticate users, maintain accounts and preferences, and communicate about transactions or service changes;
send marketing communications you request or that law permits, and record and honor opt-outs;
personalize content, product recommendations, and offers using nonsensitive information and your interactions, subject to available privacy choices;
measure and improve the Site, products, operations, advertising, and customer experience;
conduct voluntary surveys, events, promotions, sampling, product research, and business-development activities;
protect consumers, HYLOR, the Site, and our partners; prevent fraud, abuse, diversion, and security incidents; and enforce applicable terms;
maintain records, perform accounting and audits, manage vendors, and operate our business;
comply with food-safety, product-quality, tax, consumer-protection, privacy, legal-process, and other legal obligations; and
establish, exercise, or defend legal rights and complete a corporate transaction.

We may use information for another compatible purpose or with notice and consent when required. We may use aggregated or de-identified information for lawful purposes. Where law applies, we maintain de-identified information in de-identified form, use reasonable safeguards against reidentification, do not attempt to reidentify it except as permitted to test our process, and require recipients to maintain it in de-identified form and not attempt to reidentify it.

How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described above:

Service providers and processors. Hosting, ecommerce, payment, fraud prevention, customer service, email, shipping, warehousing, tax, accounting, analytics, security, information technology, data storage, legal, insurance, and other providers that process information to provide services to us.
Advertising and analytics partners. Providers that measure Site and campaign performance or help deliver advertising. When enabled, these providers may collect online identifiers, device information, and Site interactions and may combine them with information they independently maintain under their own privacy policies. Their activities may be treated as a sale, sharing, or targeted advertising under applicable state law. HYLOR does not provide information submitted to us about an individual's diagnosis, medication use, treatment, or medical procedure for advertising or audience creation. Applicable choices are available through Your Privacy Choices.
Marketplaces, retailers, and transaction partners. A marketplace, retailer, delivery service, co-sponsor, or other party involved in a transaction, program, or interaction you request. The other party may independently control information under its own policy.
Professional advisers and business partners. Lawyers, accountants, auditors, insurers, consultants, banks, and potential commercial partners where reasonably necessary and subject to appropriate duties.
Government, regulators, and rights holders. When we reasonably believe disclosure is required by law or legal process; needed to investigate fraud, security, or illegal activity; or necessary to protect rights, safety, consumers, or property.
Corporate-transaction parties. Prospective or actual buyers, investors, lenders, advisers, successors, and related parties in a financing, merger, reorganization, acquisition, bankruptcy, or sale of all or part of our business or assets.
At your direction or with your consent. When you ask us to disclose information or consent to a disclosure.

Cookies, Analytics, and Advertising

Depending on active Site features and your choices, we may use:

Essential technologies for security, network management, checkout, accounts, load balancing, fraud prevention, and features you request.
Functional technologies for preferences, embedded features, and enhanced functionality.
Analytics technologies to measure visits, interactions, campaign performance, and Site operation.
Advertising technologies to measure, personalize, retarget, or limit advertising across websites, apps, devices, or services.

Depending on the integrations HYLOR activates, advertising, analytics, and customer-engagement providers may include Shopify, Meta, Google, TikTok, and Klaviyo. When a corresponding feature is enabled, a provider may receive identifiers, including an email address or telephone number in hashed form when a matching feature is used; IP address; cookie, device, advertising, and customer identifiers; referring URLs; pages and products viewed; searches; clicks; ad interactions; cart, checkout, purchase, and order-value events; approximate location; marketing preferences; and nonsensitive audience or interest inferences. HYLOR may use this information for analytics, campaign measurement, attribution, personalization, retargeting, audience creation or suppression, advertising delivery, and fraud prevention. Not every listed provider, data element, or function is active at all times.

Klaviyo may support email signup, email delivery, marketing automation, and related analytics. If HYLOR enables Klaviyo onsite tracking or advertising-audience synchronization, Klaviyo may also process device, Site-interaction, and profile information as described in this Policy. Consent to receive HYLOR email does not by itself authorize sale, sharing, or targeted advertising where a separate choice is required.

Where the Site provides cookie or privacy settings, you may use them at any time to manage available nonessential technologies. These settings do not disable technologies that are strictly necessary to operate and secure the Site, process transactions, provide requested features, or remember your privacy choices. Browser controls may also block or delete cookies, but doing so may affect Site functions and may remove a stored preference.

Some analytics and advertising providers may collect identifiers and activity directly from your browser or device and may combine that information with activity collected across other websites, apps, devices, or services. We do not sell personal information for money. However, allowing an advertising provider to collect or receive identifiers or activity for cross-context behavioral advertising may be treated as a sale or sharing under California law or targeted advertising under other state laws. When these practices are active and applicable law grants an opt-out right, use Your Privacy Choices. Where applicable law requires us to recognize an opt-out preference signal, we treat a recognized signal such as Global Privacy Control (GPC) as a request to opt out for the browser or device sending the signal and any profile we associate with it. If you are logged in or otherwise known to HYLOR, we also apply the opt-out to the associated account and offline records where required by law. We do not require identity verification or account creation for a browser- or device-level opt-out. The later absence of a signal is not treated as consent to reverse a stored or associated opt-out.

Because legacy browser Do Not Track signals are not standardized, we do not currently respond to them as legal privacy preference signals. This does not affect our handling of GPC or another legally recognized universal opt-out mechanism.

HYLOR may advertise in broad or contextual food, nutrition, fitness, and general-wellness settings. We do not create or supply advertising audiences from health information submitted to HYLOR. Receiving or viewing a HYLOR advertisement does not mean HYLOR knows or has determined anything about your health.

Email, Text, and Communication Choices

You can unsubscribe from marketing emails through the link in an email. We may retain limited information on a suppression list so that we continue to honor your choice. Transactional, safety, legal, and service messages may still be sent.

Where HYLOR offers a marketing text-message program, enrollment is governed by program-specific consent disclosures and Mobile Terms. Consent to receive marketing texts is not a condition of purchase. You may reply STOP or use another reasonable method identified in the message to revoke consent. A privacy request is not required to stop marketing texts.

Mobile information, text-message opt-in data, and consent will not be sold or disclosed to third parties or affiliates for their own marketing or promotional purposes. We may provide this information to messaging providers and carriers that help deliver the program, or disclose it when required by law.

Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide a requested service; maintain accounts and transaction records; honor preferences; meet tax, accounting, food-safety, product-quality, consumer-protection, and legal obligations; prevent fraud and security incidents; resolve disputes; and establish or defend claims.

Retention varies by category and context. We consider the amount and sensitivity of the information, the risk of harm, the original purpose, whether the purpose can be achieved another way, legal requirements, contractual commitments, and expected disputes. When retention is no longer appropriate, we delete, anonymize, or securely isolate the information as reasonably practicable. Service providers may retain information under their own legal obligations and contracts.

Security

We use reasonable administrative, technical, and physical safeguards appropriate to the information and our operations. No method of transmission or storage is completely secure, and we cannot guarantee security. Use a unique password if accounts are offered, do not send sensitive payment or medical information through ordinary email, and contact hello@drinkhylor.com if you suspect unauthorized activity.

Children and Teens

Generally available Site content may be viewed without creating an account. HYLOR accounts, marketing lists and waitlists, reviews and other user content, promotions, sampling requests, purchases, preorders, subscriptions, and other interactive or transactional features are intended only for people who are at least 18 years old.

We do not knowingly collect personal information directly from anyone under 18 through those features. If we learn that a person under 18 provided personal information through one of those features, we will review the matter and delete or otherwise handle the information as required by law. An adult parent or legal guardian may contact HYLOR about a product purchased for a minor or a child-privacy concern.

We do not knowingly sell or share the personal information of a person under 16, or process a known minor's information for targeted advertising, without the affirmative authorization required by law. If you believe a child or teenager provided information inconsistently with this section, contact hello@drinkhylor.com with the subject Child Privacy. This section does not require a visitor to provide a birth date merely to browse generally available Site content.

Consumer Health and Sensitive Information

HYLOR is a food and beverage brand, not a healthcare provider. The Site is not intended to diagnose or treat a health condition or provide individualized medical advice. Site content may discuss protein, nutrition, fitness, or general wellness. Viewing that content or receiving a HYLOR advertisement does not mean HYLOR knows or has determined that you have a particular medical condition, use a medication, or have undergone a medical procedure.

General Site forms, accounts, reviews, and marketing programs are not designed to request medical diagnoses, medication or GLP-1 use, diabetes or bariatric status, weight history, symptoms, treatment information, genetic information, or other consumer health data. Please do not submit that information through a general form or public review. If you voluntarily include health information in a private customer-service or product-quality communication, we may use it only as reasonably necessary to respond, investigate or address the matter, comply with law, and establish or defend legal rights. We do not use that information to create advertising audiences or personalize advertising, and we disclose it only to service providers, professional advisers, or authorities supporting those purposes.

HYLOR does not sell consumer health data or disclose it to third parties for their own advertising. Before HYLOR activates a form, quiz, program, customer segment, or other feature designed to request, derive, or associate an identifiable consumer with a diagnosis, medication use, procedure, symptom, treatment, or other consumer health data, we will provide any separate consumer-health privacy notice, obtain consent required before collection or sharing, and provide applicable access, withdrawal, deletion, and appeal rights. For California purposes, standard ecommerce may involve account credentials or payment-related information that law defines as sensitive personal information. We use those categories only for account access, payment, order fulfillment, security, and fraud prevention and not to infer characteristics. Based on those practices, HYLOR does not currently provide a separate Limit the Use of My Sensitive Personal Information control. We will provide the required notice and control before using or disclosing sensitive personal information for a purpose that triggers that right.

International Use

The Site and HYLOR's direct consumer offering are intended for the United States. Personal information may be processed in the United States and other countries where we or our providers operate. Those countries may have different privacy laws. If we intentionally offer Products or services in another country, we will provide additional notices or safeguards required for that offering.

Your Privacy Rights

Depending on your state and whether a law applies to HYLOR, you may have the right to:

confirm whether we process your personal information and access or know that information;
correct inaccurate personal information;
delete personal information, subject to legal exceptions;
obtain a portable copy of information you provided or of personal data maintained about you;
obtain information about categories or, where required, specific third parties to which personal data was disclosed;
opt out of the sale of personal information, California sharing, targeted advertising, or qualifying profiling in furtherance of significant decisions;
withdraw consent for processing that relies on consent;
limit certain use or disclosure of sensitive personal information, if that right is triggered;
appeal a denial of a request where applicable; and
receive equal service and not be unlawfully discriminated against for exercising a right.

Residents of states with applicable consumer privacy laws may have some or all of the rights listed above, subject to each law's scope, definitions, thresholds, exemptions, and exceptions. Other generally applicable website, consumer, consumer-health, and data-security laws may also apply.

You may contact us from any U.S. state. We will process a request in accordance with applicable law and may honor a request voluntarily when reasonably practicable. This statement does not create a legal right where one does not otherwise exist.

How to Exercise a Right

To submit a request to know, access, correct, delete, or obtain a portable copy of personal information, use the online form on Your Privacy Choices, email hello@drinkhylor.com with the subject Privacy Request, or call 949-272-8214. Tell us the right you wish to exercise and provide the email address or other information you used with HYLOR only to the extent needed to locate the relevant records.

To opt out of a legally regulated sale, sharing, or targeted advertising through cookies or similar technologies, use Your Privacy Choices when those technologies are active or send a recognized universal opt-out signal such as GPC. You may also contact us using the methods above to request that an opt-out apply to identifiable account, email, or offline records. Do not send a government identification document or sensitive information with your initial request. We may ask for additional information when reasonably necessary to authenticate an access, correction, deletion, portability, or account-level request. We use request information only to process, document, and secure the request and prevent fraud relating to it.

We generally respond to verified rights requests within 45 days, subject to an extension where law permits. Where California law applies, we acknowledge covered access, correction, and deletion requests within 10 business days and process covered sale or sharing opt-outs as soon as feasibly possible and no later than 15 business days. Other timelines may apply under a particular law.

We may deny or limit a request when law permits, such as when we cannot authenticate it, an exception applies, the request would adversely affect another person's rights, or it is manifestly unfounded or excessive. We will explain a denial when required.

Authorized Agents, Parents, and Appeals

An authorized agent may submit a request when applicable law permits. We may ask for proof of the agent's authority and may contact the consumer directly to authenticate or confirm an access, correction, deletion, or portability request. A valid power of attorney will be handled as required by law. We do not require signed agent permission for an opt-out communicated through a legally recognized universal opt-out signal.

An adult parent or legal guardian may contact us regarding personal information relating to a person under 18 or a product matter involving a minor, where applicable.

To appeal a denied request, email hello@drinkhylor.com with the subject Privacy Appeal and include the earlier request or ticket number, date, and reason for appeal. We respond within the time required by applicable law and generally aim to respond within 45 days. If we deny an appeal, we will provide a method to contact the appropriate state regulator when required.

U.S. State Privacy Notice

The 12-Month Practices Disclosure near the beginning of this Policy separately describes HYLOR's practices during the 12 months ending September 10, 2026.

Identifiers and Contact Information

Examples: Name, email, telephone number, postal or delivery address, account or customer identifier, IP address, and social handle.

Sources: You; your device; commerce, marketplace, retailer, social-media, and service providers; another person acting at your direction.

Purposes: Lists and communications; accounts; orders and delivery; support; security; marketing; analytics; legal compliance.

Business-purpose disclosures: Ecommerce, hosting, payment, fraud, email, customer-service, fulfillment, shipping, analytics, security, professional, and transaction providers.

Sale, sharing, or targeted advertising: Online identifiers and contact or audience information may be disclosed to advertising partners in a manner treated as sale, sharing, or targeted advertising. Not sold for money. Opt-out available where applicable.

Retention criterion: List information is retained while you remain subscribed and in a limited suppression record after opt-out; account, security, and request records are retained for the period reasonably needed for the applicable purpose and legal obligations.

Customer Records and Payment-Related Information

Examples: Contact and account details, billing and shipping information, payment token, card brand or limited digits, transaction status, and signature or request records.

Sources: You; Shopify, payment, marketplace, fraud, and commerce providers.

Purposes: Payment, fulfillment, account administration, fraud prevention, accounting, product-issue claims, replacements, courtesy accommodations, refunds when applicable, and legal compliance.

Business-purpose disclosures: Payment, ecommerce, tax, accounting, fraud, fulfillment, shipping, customer-service, and professional providers.

Sale, sharing, or targeted advertising: Complete payment credentials are not sold or shared for targeted advertising. HYLOR does not sell sensitive financial information.

Retention criterion: Transaction, accounting, tax, fraud, product-issue, remedy, refund, and dispute records are retained for the period reasonably needed to complete the transaction and satisfy legal, accounting, safety, and claims obligations. Complete payment credentials remain subject to the payment provider's schedule.

Commercial Information

Examples: Products viewed or purchased, order and delivery history, cart activity, subscription details if offered, product-issue claims, replacements or other resolutions, refunds when applicable, discounts, preferences, and customer-service history.

Sources: You; Site and device activity; commerce, marketplace, retailer, fulfillment, shipping, and support providers.

Purposes: Transactions, support, personalization, forecasting, product improvement, security, analytics, and marketing.

Business-purpose disclosures: Commerce, payment, fulfillment, customer-service, analytics, marketing, accounting, and professional providers.

Sale, sharing, or targeted advertising: Purchase or activity events may be disclosed to advertising partners for measurement or targeted advertising where enabled. Not sold for money. Opt-out available where applicable.

Retention criterion: Order and commercial records are retained for fulfillment, support, forecasting, accounting, tax, food-safety, product-quality, fraud, and claims periods, then deleted or de-identified when no longer reasonably necessary.

Internet or Electronic Network Activity

Examples: IP address, browser and device data, identifiers, cookies, page and ad interactions, referral URL, searches, session and diagnostic data, and email engagement.

Sources: Your device; Site; hosting, security, commerce, analytics, email, and advertising providers.

Purposes: Site operation, security, fraud prevention, analytics, personalization, debugging, and advertising.

Business-purpose disclosures: Hosting, security, ecommerce, information-technology, analytics, customer-service, email, and advertising providers.

Sale, sharing, or targeted advertising: Some identifiers and activity may be disclosed for cross-context or targeted advertising. Not sold for money. Cookie controls and recognized universal opt-out signals apply where required.

Retention criterion: Cookie duration depends on the technology and the choice stored in the preference center. Security and diagnostic logs are retained for the period reasonably needed to protect and operate the Site. Analytics and advertising records are retained for the period reasonably needed for measurement, security, opt-out, and legal obligations, subject to applicable provider controls.

Approximate Geolocation

Examples: City, region, or ZIP-level location inferred from IP address or delivery address. HYLOR does not seek precise geolocation through the general Site.

Sources: Device or IP address; you; shipping, fraud, analytics, and advertising providers.

Purposes: Delivery, localization, security, fraud prevention, analytics, and advertising.

Business-purpose disclosures: Shipping, ecommerce, fraud, security, analytics, and advertising providers.

Sale, sharing, or targeted advertising: Approximate location may be used with advertising partners for targeted advertising where enabled. Precise geolocation is not sold.

Retention criterion: Approximate location is retained with the transaction, security, analytics, or advertising record that generated it and follows that record's retention criterion.

Inferences and Preferences

Examples: Flavor, product, content, and marketing preferences inferred from nonsensitive interactions or purchases. These preferences are not designed to identify a medical diagnosis, medication use, procedure, or treatment.

Sources: Your choices and Site, purchase, email, and campaign interactions.

Purposes: Personalization, product planning, analytics, and marketing.

Business-purpose disclosures: Analytics, commerce, email, customer-service, and advertising providers.

Sale, sharing, or targeted advertising: Nonsensitive audience or preference information may be used for targeted advertising where enabled. Opt-out available where applicable.

Retention criterion: Preferences and nonsensitive inferences are retained while reasonably useful for the active customer or marketing relationship, subject to opt-out, deletion, and suppression obligations.

Communications and User Content

Examples: Emails, support messages, reviews, survey answers, comments, attachments, photos, videos, testimonials, or social-media interactions.

Sources: You; social networks; customer-service and research providers.

Purposes: Responding, quality and safety, moderation, research, Site operation, marketing with appropriate permission, security, and legal compliance.

Business-purpose disclosures: Customer-service, research, legal, security, content-hosting, and program providers.

Sale, sharing, or targeted advertising: Not sold for money. Public content is visible as described when submitted. Paid-advertising use of a name, likeness, or testimonial will receive any additional permission required.

Retention criterion: Communications and content are retained for the period reasonably needed to respond, document permission, administer the feature, address quality or safety, moderate content, meet legal duties, and resolve claims.

Professional or Business Information

Examples: Employer, title, company, business contact details, and business inquiry.

Sources: You; your company; public professional sources; business partners.

Purposes: Wholesale, supplier, investor, media, partnership, and business communications and administration.

Business-purpose disclosures: Business systems, professional advisers, and providers supporting the relationship.

Sale, sharing, or targeted advertising: Not sold for money or used for consumer targeted advertising unless separately disclosed.

Retention criterion: Business contact and relationship records are retained for the relationship and a reasonable period afterward for administration, legal obligations, and disputes.

Sensitive Personal Information

Examples: Account credentials and payment-related information processed for ecommerce, and health information a person voluntarily includes in a private customer-service or product-quality communication. General Site features are not designed to request precise geolocation, government identifiers, biometric data, genetics, racial or ethnic origin, religious beliefs, sexual orientation, or consumer health data.

Sources: You and account, commerce, payment, fraud, security, customer-service, and product-quality providers.

Purposes: Access, payment, order fulfillment, security, fraud prevention, responding to a product-quality or safety matter, legal compliance, and establishing or defending legal rights.

Business-purpose disclosures: Account, commerce, payment, fraud, security, customer-service, product-quality, professional-adviser, and authority recipients as reasonably necessary and subject to appropriate restrictions.

Sale, sharing, or targeted advertising: Not sold or used to infer characteristics. Health information submitted to HYLOR is not used to create or supply advertising audiences. HYLOR provides a limitation control whenever its processing of sensitive personal information triggers that right.

Retention criterion: Credentials and payment-related information are retained only as needed for authentication, the transaction, security, fraud prevention, and applicable legal obligations, subject to the account and payment provider's controls.

We disclose the categories above to service providers or processors for business purposes as applicable. We do not sell personal information for money. If advertising technologies are enabled, disclosures of identifiers, commercial information, internet activity, approximate location, or nonsensitive inferences may be treated as sale, sharing, or targeted advertising under state law. When an applicable opt-out is required, Your Privacy Choices provides the relevant control.

California-Specific Disclosures

The California Consumer Privacy Act and California Privacy Rights Act (CCPA) apply only if HYLOR meets a statutory business threshold. When the CCPA applies, California residents have the rights described in this Policy, including rights to know, access, correct, delete, portability, opt out of sale or sharing, limit certain sensitive-information use, and nondiscrimination, subject to exceptions.

Notice at collection. The sections above describe the categories of personal information HYLOR collects or may collect through active features, the purposes for which it is used, recipient categories, whether it may be sold or shared, and applicable retention criteria. Where applicable law requires notice at or before collection, HYLOR provides or links directly to the relevant disclosure at that collection point. Any collection-point notice supplements this Policy.

Sale and sharing. We do not sell personal information for money. Advertising disclosures may constitute sale or sharing. Use Your Privacy Choices or a recognized opt-out preference signal such as GPC.

Sensitive information. We do not use sensitive personal information to infer characteristics or for purposes that require a limit-use link. If that changes, we will provide the required notice and control before the new processing begins.

Consumers under 16. We do not have actual knowledge that we sell or share personal information of consumers under 16 without required affirmative authorization.

Financial incentives. HYLOR may offer a discount, sample, loyalty benefit, referral benefit, or promotion. If an offer is a financial incentive or price or service difference under California law, we will provide an offer-specific Notice of Financial Incentive at enrollment that states the material terms, information involved, value methodology, opt-in method, and withdrawal method. This general Policy does not substitute for that notice. Participation will be voluntary.

Shine the Light. We do not disclose personal information to third parties for those third parties' own direct marketing as defined by California Civil Code section 1798.83 without a legally sufficient choice or consent. California customers may send questions with the subject California Shine the Light to hello@drinkhylor.com.

Nevada-Specific Disclosure

Nevada residents may request to opt out of a sale of covered information as narrowly defined by Nevada law. HYLOR does not sell covered information for monetary consideration to a person for that person's licensing or sale to additional persons. Submit a request through Your Privacy Choices or email hello@drinkhylor.com with the subject Nevada Privacy Request.

Rhode Island Website Disclosure

Ariva Pharma, LLC is the controller of personal information covered by this Policy. Depending on the services enabled, HYLOR may disclose personal information to Shopify Inc. for website, ecommerce, checkout, payment-related, Enhanced Services, and related services; Klaviyo, Inc. for email delivery, marketing automation, and related analytics; Meta Platforms, Inc. for Meta, Facebook, and Instagram advertising and measurement; Google LLC for Google analytics, advertising, and measurement; and TikTok USDS Joint Venture LLC or the applicable TikTok advertising affiliate for TikTok advertising and measurement. Not every listed service is active at all times. Shopify may act as a service provider or processor for core commerce services and may process information for Enhanced Services as described in the Shopify Hosting and Network Intelligence section. Klaviyo generally acts as a service provider or processor for HYLOR. Meta, Google, and TikTok may act as advertising or analytics partners, and a disclosure to them may be treated as a sale, sharing, or targeted advertising depending on the service and configuration. HYLOR does not sell personal information for money. We will update this list before making a covered sale to another third party. Applicable choices are available through Your Privacy Choices.

Discounts and Notices of Financial Incentive

An ordinary marketing message, discount, or free sample does not always create a regulated financial incentive, but some programs can. If HYLOR offers a First Taste benefit, founder program, welcome discount, loyalty program, referral credit, ambassador commission, or similar program that qualifies as a financial incentive, the enrollment page will provide a separate Notice of Financial Incentive. Any required value estimate will be based on HYLOR's own good-faith calculation.

Changes to This Policy

We may update this Policy to reflect changes in our practices, technology, Products, or law. We will post the updated Policy and change the Last updated date. If a change is material, we will provide additional notice or obtain consent when required. We will not use previously collected personal information for a materially different, incompatible purpose without the notice and choice required by law.

Contact Us

For privacy questions or requests, contact:

Ariva Pharma, LLC (owner and operator of the HYLOR brand)

Attn: Privacy

Mail: 620 Newport Center Drive, Suite 1100, Newport Beach, CA 92660

Email: hello@drinkhylor.com

Telephone: 949-272-8214

Subject: Privacy Request

For browser- or device-level advertising choices when applicable technologies are active, use Your Privacy Choices. When emailing about a privacy right, use the subject Privacy Request.