Privacy policy

Privacy Policy

This policy explains what information we collect when you shop with us for hydroponics and indoor growing equipment, why we collect it, and the choices you have.

Section 1 — What We Collect

When you buy something from Cultiva Supply, we collect the information needed to complete the sale — things like your name, shipping address, and email address.

When you browse the store, our systems automatically log your device's IP address, along with basic technical details about your browser and operating system. This helps us understand how the site is being used and keep it running smoothly.

If you opt in to marketing, we may email you about new products, restocks, and promotions from Cultiva Supply. You can opt out at any time — every marketing email includes an unsubscribe link.

Section 2 — Consent

How we get it: When you hand over personal information to complete a purchase, verify a payment method, arrange delivery, or process a return, we take that as consent to use the information for that specific purpose.

Asking for more: If we ever want to use your information for something beyond fulfilling an order — like marketing — we'll ask directly, or give you a clear way to decline.

Withdrawing consent: You can change your mind at any time. To withdraw consent for us to contact you, or to stop the collection, use, or disclosure of your information, email us at info@cultivasupply.com.

Section 3 — Disclosure

We disclose personal information only where the law requires it, or where it's necessary to enforce our Terms of Service — for example, in the case of fraud or a violation of our policies.

Section 4 — Shopify & Payment Processing

Cultiva Supply is hosted on Shopify, which provides the e-commerce platform we use to sell our hydroponics and grow equipment to you. Your data is stored within Shopify's systems, behind a firewall, on secure servers.

Payment data: When you check out using a direct payment gateway, your card details are handled and encrypted according to the Payment Card Industry Data Security Standard (PCI-DSS). That information is retained only as long as needed to complete the transaction, then deleted.

All of our payment gateways meet PCI-DSS standards, a framework maintained jointly by Visa, Mastercard, American Express, and Discover to keep card handling secure across the industry.

For more detail on how our platform handles data, you can read Shopify's Terms of Service (shopify.com/legal/terms) or Shopify's Privacy Statement (shopify.com/legal/privacy) directly.

Section 5 — Third-Party Services

We work with a handful of outside providers — payment processors, financing partners, and fraud-prevention tools among them — to run the store. Each one only collects, uses, and discloses your information to the extent needed to do their part of the job.

Some of these providers, particularly payment gateways and transaction processors, maintain their own privacy policies covering how they handle your data. We'd encourage you to review those directly if you want the full picture.

Some providers operate in different jurisdictions than you or Cultiva Supply. If a transaction is routed through a provider based elsewhere, your information may become subject to that jurisdiction's laws.

Links to other sites: Where our store links out to third-party sites, this policy stops applying the moment you leave cultivasupply.com. We aren't responsible for how other sites handle your information, and we'd recommend reading their privacy practices before sharing anything with them.

Section 6 — Security

We take reasonable, industry-standard precautions to keep your personal information from being lost, misused, accessed without authorization, disclosed, altered, or destroyed.

Card details you provide are encrypted using SSL and stored with AES-256 encryption. No method of transmitting data over the internet is ever 100% guaranteed, but we follow PCI-DSS requirements and generally accepted security practices throughout.

Section 7 — Cookies

Here's what we use cookies for, so you can decide whether to opt out of any of them in your browser settings.

  • _session_id — unique token, session-length — lets Shopify store session info like referrer and landing page
  • _shopify_visit — no data held, 30 min from last visit — tracks visit counts for our internal stats
  • _shopify_uniq — no data held, expires at midnight (visitor's time) — counts visits per customer, once per day
  • cart — unique token, 2 weeks — remembers what's in your cart
  • _secure_session_id — unique token, session-length — secure session handling
  • storefront_digest — unique token, indefinite — if the store is password-protected, checks visitor access

Section 8 — Age of Consent

By using this site, you confirm that you're at least the age of majority in your state or province, or that you are and have given consent for any minor dependents in your care to use the site.

Section 9 — Changes to This Policy

We may update this privacy policy from time to time, so it's worth checking back periodically. Any changes take effect as soon as they're posted here. If we make a material change, we'll make sure it's clear on this page so you know what's changed and why.

If Cultiva Supply is ever acquired by or merged with another company, your information may transfer to the new owners so we can continue serving your orders without interruption.

Questions or Requests

To access, correct, amend, or delete any personal information we hold about you, or to register a complaint, contact us at info@cultivasupply.com.

Effective July 17, 2026 — Cultiva Supply · cultivasupply.com