Privacy policy

 

Endora | VictoriamRoas LLC        Effective: May 2026

This Privacy Policy explains what personal information VictoriamRoas LLC, doing business as Endora ("Endora," "we," "us," or "our"), collects, how we use it, and what rights you have in relation to it. It applies to all visitors and customers of endora-us.com.

Please read this policy carefully. Your rights and our obligations vary depending on your location. If you have questions, contact us at help@endora-us.com before using the site.

 

VictoriamRoas LLC is the legal entity operating Endora. Our registered address is Thirty North Gould Street, Suite R, Sheridan, WY 82801, United States.

For all privacy-related questions or requests: help@endora-us.com

We collect two categories of information:

 

a) Order and Account Information

When you make a purchase or create an account, we collect:

•      Full name and contact details (email address, phone number)

•      Billing and shipping address

•      Payment information (processed securely via Shopify Payments; we do not store full card numbers)

•      Order history and purchase records

•      Communications with our customer support team

 

b) Device and Usage Information

When you browse our website, we automatically collect certain technical information:

•      IP address and approximate location

•      Browser type, operating system, and device identifiers

•      Pages viewed, time on site, and referring URLs

•      Cookies and similar tracking technologies (see Section 5)

 

c) Health-Related Information (Sensitive Data)

Customers sometimes share health-related information in support communications, such as their diagnosis, symptoms, medications, or surgical history. We recognize this as sensitive personal data. We process this information solely for the purpose of responding to your support request. It is not used for marketing, profiling, or shared with third parties for commercial purposes. Under GDPR, this constitutes special category data processed under Article 9(2)(a) (explicit consent provided in the course of your communication with us) or Article 9(2)(f) (necessary for legal claims or support obligations).

We use the information we collect to:

•      Process and fulfill your orders, including arranging shipping and sending order confirmations

•      Communicate with you about your order, account, or support requests

•      Screen orders for potential fraud or unauthorized transactions

•      Send marketing communications, where you have given us explicit permission to do so

•      Improve and optimize our website and product offerings

•      Comply with legal and regulatory obligations

 

We do not sell your personal information to third parties. We do not use health-related information shared in support communications for marketing purposes.

We share your information only as necessary to operate our business and serve you. This includes:

 

Service providers we work with: Shopify – online store and payment processing (shopify.com/legal/privacy) Google Analytics – website usage analysis (policies.google.com/privacy) Meta (Facebook/Instagram) – advertising and retargeting (facebook.com/privacy/policy) Email marketing platforms – order confirmations and, where opted in, promotional emails Shipping and logistics providers – to deliver your order

 

Please note: we share certain device and browsing data with Meta (Facebook/Instagram) for advertising and retargeting purposes. Under the California Consumer Privacy Act (CCPA), this may constitute "sharing" of personal information for cross-context behavioral advertising. California residents have the right to opt out of this. See Section 10 for how to exercise that right.

We may also disclose your information if required to do so by law, in response to a valid legal request, or to protect the rights, property, or safety of Endora, our customers, or others.

We do not share your personal information with unaffiliated third parties for their own independent marketing purposes.

Our website uses cookies and similar tracking technologies. These include:

•      Essential cookies: required for the site to function (shopping cart, login sessions). These are always active.

•      Analytics cookies: help us understand traffic patterns and page performance (e.g. Google Analytics)

•      Marketing cookies: used to deliver relevant advertising on third-party platforms, including Meta (Facebook/Instagram)

 

Non-essential cookies, including Google Analytics and the Meta pixel, are only activated after you provide consent. EU and UK visitors will be presented with a cookie consent banner before any non-essential cookies or tracking pixels are placed on their device. Until consent is given, these technologies remain inactive.

You can manage or withdraw your cookie consent at any time through the cookie preference settings on our site. You can also manage cookies through your browser settings. To opt out of Google Analytics across all sites, visit tools.google.com/dlpage/gaoptout. To opt out of targeted advertising, visit optout.networkadvertising.org.

We only send marketing emails or SMS messages where you have explicitly opted in during checkout or account registration. You can opt out at any time by clicking the unsubscribe link in any marketing email, or by replying STOP to any SMS message from us.

Opting out of marketing communications does not affect transactional emails related to your orders (order confirmations, shipping updates, support replies).

We retain your personal information for as long as necessary to fulfil the purposes described in this policy, including providing customer support, complying with legal obligations, resolving disputes, and enforcing our agreements. Order records are retained for a minimum of 7 years to meet tax and accounting requirements.

Health-related information shared in support communications is retained only as long as necessary to resolve the relevant support matter, after which it may be anonymised or deleted on request.

You may request deletion of your personal information at any time (see Section 9). We may be required to retain certain information even after a deletion request to comply with legal obligations.

We use industry-standard security measures to protect your personal information, including SSL/TLS encryption for all data transmitted through our website. Payment information is processed by Shopify’s PCI-compliant infrastructure; we do not have access to your full card details.

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals without undue delay and, where required by law, will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Notifications will describe the nature of the breach, the likely consequences, and the measures we are taking to address it.

Depending on your location, you may have the following rights regarding your personal information:

•      Access: request a copy of the personal information we hold about you

•      Correction: request that we correct inaccurate or incomplete information

•      Deletion: request that we delete your personal information, subject to legal retention requirements

•      Portability: request your data in a structured, machine-readable format

•      Opt-out of marketing: unsubscribe from marketing communications at any time

•      Restriction: request that we limit how we use your information in certain circumstances

•      Objection: object to processing based on legitimate interests

 

To exercise any of these rights, contact us at help@endora-us.com. We will respond within one calendar month of receiving your request. We may ask you to verify your identity before processing certain requests.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

•      The right to know what personal information we collect, use, disclose, and sell or share

•      The right to delete your personal information

•      The right to correct inaccurate personal information

•      The right to opt out of the sale or sharing of your personal information

•      The right to limit use of sensitive personal information

•      The right to non-discrimination for exercising your privacy rights

 

Endora does not sell personal information for monetary consideration. However, we do share certain browsing and device data with Meta (Facebook/Instagram) for advertising purposes, which may constitute "sharing" under the CPRA. To opt out of this sharing, you may:

•      Visit our Do Not Sell or Share My Personal Information page at endora-us.com/pages/privacy-opt-out

•      Email help@endora-us.com with the subject line "CCPA Opt-Out" and your full name and email address used at checkout

 

We will process your opt-out request within 15 business days. To submit any other privacy request as a California resident, contact us at help@endora-us.com. We will respond within 45 days as required under the CCPA, with a possible 45-day extension where reasonably necessary.

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal information. Our legal bases for processing are:

•      Contract performance: processing necessary to fulfil your order (Article 6(1)(b))

•      Legitimate interests: fraud prevention, website security, and business operations (Article 6(1)(f))

•      Consent: marketing communications and non-essential cookies, where you have opted in (Article 6(1)(a))

•      Legal obligation: where we are required to process data by law (Article 6(1)(c))

 

You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. You also have the right to lodge a complaint with your local data protection authority. For EU residents, this is your national supervisory authority. For UK residents, this is the Information Commissioner’s Office (ico.org.uk).

Where we make material changes to how we process your personal information under a consent basis, we will provide at least 14 days’ advance notice before the change takes effect, giving you the opportunity to withdraw consent before the new processing begins.

Our website may contain links to third-party websites, including research publications and social media platforms. This Privacy Policy applies only to endora-us.com. We are not responsible for the privacy practices of any third-party sites and encourage you to review their policies before providing any personal information.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. For non-material changes (such as corrections or clarifications), we will update the policy without specific notice.

For material changes, meaning changes that affect how we collect, use, or share your personal information or that alter your rights, we will provide at least 14 days’ advance notice by email or by a prominent notice on our website before the changes take effect. For EU and UK residents, where the change affects consent-based processing, continued use of the site after the notice period constitutes acceptance. You may withdraw consent before the change takes effect by contacting us at help@endora-us.com.

For all privacy questions, rights requests, or data breach concerns: help@endora-us.com