PRANA Beauty & Wellness ("PRANA", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and your rights in relation to it. It applies to all visitors to www.pranabeauty.com and customers who purchase our products.

By using our Website or purchasing our products, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our Website or services.

1. Who We Are

PRANA Beauty & Wellness is a direct-to-consumer Ayurvedic skincare brand headquartered in New York, USA. We operate the website at www.pranabeauty.com and sell our products through our website and authorised third-party marketplaces. For privacy enquiries, contact us at admin@pranawellness.shop.

2. Information We Collect

Information you give us directly

Information collected automatically

When you visit our Website, we and our service providers automatically collect certain technical information:

• IP address and approximate geographic location (city/state level)
• Browser type and version, operating system, device type
• Pages visited, time spent on pages, links clicked, referring URL
• Cookie identifiers and session data (see Section 5)
• Purchase history and browsing behaviour on our Website

Information from third parties

We may receive information about you from third parties including:

• Shopify — order and payment processing data
• Amazon — if you purchase through Amazon (subject to Amazon's privacy policy)
• Klaviyo — email engagement data (opens, clicks, unsubscribes)
• Meta (Facebook/Instagram) — if you interact with our ads and have consented to Meta's data sharing
• Google — if you find us through Google Search or Google Ads

3. How We Use Your Information

We do not use your personal information for automated individual decision-making that produces legal or similarly significant effects on you, except where you have explicitly requested a personalised recommendation (such as through the AI Skin Scanner or Dosha Quiz).

4. AI Skin Scanner — Biometric Data

When you use the AI Skin Scanner, a single image frame from your camera or an uploaded photo is converted to a base64 string in your browser and transmitted directly to Anthropic's Claude Vision API over an encrypted HTTPS connection. The API returns skin marker scores (a text result) which is used to display your ritual recommendation. The image data is then permanently discarded.

Consent requirement

You must provide explicit written consent before the Scanner will process your image. This consent satisfies:

• Illinois BIPA (740 ILCS 14) — written release requirement
• California CCPA/CPRA — sensitive personal information consent
• Federal COPPA — age verification (18+ required)

What is retained

The only data retained from a Scanner session is: (a) the text result (your dosha classification and skin marker labels), held in browser session memory only; and (b) if you voluntarily provide your email address, that email address and your dosha result are stored in Klaviyo with your consent. No image or biometric data is retained under any circumstances.

Full details are set out in our AI Skin Scanner Addendum, which forms part of this Privacy Policy.

5. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to operate the Website, remember your preferences, analyse traffic, and deliver relevant advertising.

You can control cookie preferences through your browser settings or through the cookie preference centre on our Website. Note that opting out of certain cookies may affect Website functionality. For information on opting out of Meta's advertising cookies, visit facebook.com/settings. For Google, visit myaccount.google.com.

6. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share your information only in the following limited circumstances:

• Service providers who help us operate our business (see Section 7) — only to the extent necessary for the service they provide
• Legal requirements — if required by law, court order, or governmental authority
• Business transfers — in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, with notice provided to you
• Protection of rights — where necessary to protect the rights, property, or safety of PRANA, our customers, or the public
• With your consent — for any other purpose with your explicit consent

7. Third-Party Service Providers

All third-party service providers are contractually required to process your data only for the purposes we specify, to maintain appropriate security standards, and to comply with applicable privacy law.

8. Data Retention

When data is no longer needed, we securely delete or anonymise it. You may request earlier deletion of your personal data by contacting admin@pranawellness.shop — see Section 10 for your rights.

9. Security

We implement industry-standard security measures to protect your personal information including:

• HTTPS/TLS encryption for all data transmitted between your browser and our Website
• Payment card data processed entirely by Shopify Payments — PRANA never receives or stores full card numbers
• Access controls limiting which team members can access customer data
• Shopify's PCI DSS-compliant infrastructure for all payment and order data

No method of internet transmission or electronic storage is 100% secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at admin@pranawellness.shop.

10. Your Privacy Rights

Regardless of your location, all PRANA customers have the following baseline rights:

To exercise any of these rights, contact us at admin@pranawellness.shop with your name, email address, and the specific right you wish to exercise. We will respond within 1–3 business days and fulfil verified requests within the applicable legal timeframe.

11. California Residents — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you specific rights regarding your personal information.

Categories of personal information collected in the last 12 months

• Identifiers (name, email, IP address, account ID)
• Commercial information (purchase history, products considered)
• Internet and electronic activity (browsing behaviour on our Website)
• Sensitive personal information (facial image data — transient, never stored; payment card data — handled by processor only)
• Inferences drawn to create a profile (dosha type, skin type, product preferences)

Your California rights

• Right to know — request disclosure of the categories and specific pieces of personal information collected about you in the past 12 months
• Right to delete — request deletion of personal information we have collected, subject to exceptions
• Right to correct — request correction of inaccurate personal information
• Right to opt out of sale/sharing — PRANA does not sell personal information. We do share hashed email data with Meta and Google for advertising purposes; California residents may opt out of this by contacting us or adjusting ad platform settings
• Right to limit use of sensitive personal information — our zero-retention architecture for facial image data satisfies this by default
• Right to non-discrimination — we will not discriminate against you for exercising any CCPA right

To submit a California privacy rights request: email admin@pranawellness.shop with subject line "California Privacy Rights Request". We will respond within 45 days (with one 45-day extension available if required).

12. Illinois Residents — BIPA

If you are an Illinois resident and use our AI Skin Scanner, the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14) gives you specific rights.

Our BIPA compliance commitments:

• We obtain your explicit written consent (via the consent checkbox) before processing any facial image
• We maintain this publicly available written policy establishing our retention and destruction schedule
• We do not sell, lease, trade, or profit from your biometric data
• We do not disclose biometric data to any third party without consent, except as required by law
• Your facial image is destroyed immediately upon completion of each scan — zero retention
• Data in transit is protected by HTTPS/TLS encryption

For BIPA-specific enquiries, contact admin@pranawellness.shop with subject line "BIPA Privacy Request".

13. Children's Privacy — COPPA

Our Website and AI Skin Scanner are not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13. Users of the AI Skin Scanner must confirm they are 18 or older before the feature will operate.

If we learn that we have inadvertently collected personal information from a child under 13, we will delete it immediately. If you believe a child under 13 has provided us with personal information, please contact us at admin@pranawellness.shop with subject line "COPPA Notice" and we will respond within 1–3 business days.

14. Email & Marketing Communications

We send two types of email:

• Transactional emails — order confirmations, shipping notifications, ritual guides requested by you. These are sent as part of our service and do not require separate marketing consent.
• Marketing emails — new products, ritual guidance, seasonal recommendations, promotional offers. These are sent only with your explicit opt-in consent and you can unsubscribe at any time.

Every marketing email includes a clear unsubscribe link. You can also unsubscribe by emailing admin@pranawellness.shop. We comply with the CAN-SPAM Act: all marketing emails identify PRANA as the sender, include our contact address, and provide a functioning unsubscribe mechanism honoured within 10 business days.

We do not share or sell your email address to any third party for their own marketing purposes.

15. Links to Third-Party Websites

Our Website may contain links to third-party websites including social media platforms, media publications, and partner retailers. These links are provided for your convenience. PRANA has no control over the content or privacy practices of third-party sites and is not responsible for their privacy policies. We encourage you to review the privacy policy of any third-party site you visit.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email or by a prominent notice on our Website.

Your continued use of our Website or services after the effective date of any revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

17. Contact Us & Rights Requests

When submitting a rights request, please include your full name, the email address associated with your account, and a clear description of your request. We will verify your identity before processing any access, deletion, or correction request.