Privacy Policy

These policies apply to every order placed on The Amazonia. If anything here is unclear, write to hello@theamazonia.shop and a person will answer.

• Waitlist signup: your email address, the language you were reading in, whether you ticked the marketing box, and how you found us (the referring page and any campaign tags in the link).
• Orders: your name, shipping address, email, and what you bought. Payment happens on a Stripe page, not ours. We never see or store your full card number.
• Site preferences: your language choice, whether you dismissed the privacy notice, and whether the opening animation has already played. These sit in your own browser, not on our servers.
• Request logs: Cloudflare records the usual server data (IP address, browser string, timestamp, path) to block abuse and keep the site up.

There is no account to create, so there is no password, no order history behind a login, and no profile of you sitting on our side.

• To take payment, pack your order, and ship it.
• To email you about that order: confirmation, tracking, a problem with your address.
• To email you about launches and new products, but only if you ticked the box. That consent is stored with your row under version wl-2026-09-02, so we can show what you agreed to and when.
• To answer you when you write to us.
• To spot fraud, abuse, and bot traffic.
• To meet tax, accounting, and cosmetic recordkeeping obligations.

We do not build advertising profiles, we do not score you, and no automated system makes a decision about you that carries a legal effect.

This site runs no analytics scripts, no advertising pixels, and no third-party trackers. What we store lives in your browser and does almost nothing:

• amz-locale: your language choice, so the site opens in the language you picked.
• cookie-consent: a record that you dismissed the privacy notice, so it stops reappearing.
• amz-descended: a session flag so the opening sequence plays in full once instead of every page load.
• amz_inv: a cookie set only if you enter the investor passphrase. It unlocks that one section and nothing else.
• Stripe sets its own cookies on the Stripe checkout page, which is governed by Stripe's privacy policy, not ours.

We honor the Global Privacy Control signal. Some browsers also send a Do Not Track header; we treat it the same way we treat GPC. Since we run no advertising and share nothing for cross-context behavioral advertising, there is nothing for either signal to switch off, and it stays that way.

• Stripe, for payment processing and fraud checks.
• Cloudflare, for hosting, the D1 database that stores waitlist and order rows (western North America), and email routing.
• Our email delivery provider, for order mail and, if you opted in, launch mail.
• The shipping carrier, which needs your name and address to deliver the box.
• A court, regulator, or law enforcement body when a valid legal order requires it.

Each of them is a service provider under contract and may use your data only to do the job we hired them for. We do not sell your personal information, we do not hand it to data brokers or advertising networks, and we do not share it with any agency for immigration enforcement.

• Waitlist rows: until you unsubscribe or ask us to delete them.
• Order records: seven years, because tax and sales records have to survive that long. After that we delete or anonymize them.
• Cosmetic safety reports: for the period federal cosmetic recordkeeping rules require, kept separately from marketing data.
• Server logs: only as long as Cloudflare's own log retention window, which is short.
• Support email: two years, then deleted.

State privacy laws across the US give residents a set of rights over their data, and the list of states keeps growing. Rather than check your address before answering, we extend all of it to everyone who writes to us, wherever you live:

• Know what we hold about you and why.
• Get a copy of it in a portable format.
• Correct anything wrong.
• Delete it, unless a tax or safety rule forces us to keep a specific record.
• Opt out of sale or targeted advertising. We do neither, so this one is already satisfied.
• Be treated the same either way. Asking never costs you a discount or a service.

Write to hello@theamazonia.shop from the address you gave us and say what you want done. We answer within 45 days and can extend once by another 45 where the law allows, and we will tell you if we do. We may ask you to confirm the address before we delete anything. An authorized agent can act for you with written permission. If we turn a request down, reply and we will look again, and several states also let you complain to your attorney general.

This site is not directed to children under 16 and we do not knowingly collect anything from them. If you are a parent or guardian and think we have a child's data, write to hello@theamazonia.shop and we will delete it.

Traffic runs over TLS, stored rows are encrypted at rest on Cloudflare, and access is limited to the people who need it to run the shop. No setup is perfect. If a breach ever reaches your data, we will tell you and the regulators that require telling, and we will say what happened rather than what sounds best.

Our database and our processors operate in the United States. If you write to us or place an order from outside the US, you are sending your information to the US, where privacy law works differently than it may where you live.

When this policy changes we update the date at the top of the page. If a change affects how we use data you already gave us, we email the people it touches before it takes effect.

Privacy questions and data requests: hello@theamazonia.shop. Order questions: orders@theamazonia.shop. We are The Amazonia, and we operate from Los Angeles, California. Our registered postal address is printed on this page the moment it is on file. Until then every letter, notice, and request reaches us fastest at hello@theamazonia.shop, and a person in Los Angeles answers it.