Privacy Policy

This policy explains what personal information ThymoCura® collects when you visit thymocura.com, place an order, or contact us; how we use it; who helps us process it; and the choices you have. The short version: we collect what we need to sell and ship your order and to answer you, we use privacy-conscious analytics, and we do not sell your personal information.

1. Who We Are

ThymoCura® is a brand of The Chestnut Supply LLC, Norcross, Georgia, USA (“we”, “us”). This policy covers thymocura.com. Our trade site for wholesale buyers, chestnutsupply.com, has its own policies.

2. Information We Collect

When you place an order

Checkout is handled by our payment processor, Stripe. You enter your card or wallet details directly on Stripe’s secure checkout page — we never receive or store your full card number. From Stripe we receive and keep:

• your name, email address, shipping address and billing address;
• what you ordered (products, quantities, amount paid) and the payment status;
• payment and fraud-screening identifiers that let us match the order to the payment.

When you contact us

Through our contact form we collect your name and email address, anything else you choose to give (such as phone number, company or country), and your message. With the message we also record the page you sent it from, the site or campaign that brought you to us (for example a search engine or an ad tag in the link), and your browser’s language, screen size and time zone, so we can answer in context. We also receive your IP address and the country it comes from (provided by our content-delivery network). We use them to block spam; they are included in the notification we receive and kept with our record of your message.

When you ask to be notified

If you use a “Notify me” form for a product that is not yet on sale, we store your email address, the product you asked about, and the IP address the request came from (to prevent abuse), and use your email only to tell you when that product launches.

When you write a review

We collect the name you enter, your rating, review title and text, and — if you provide it — your order number, which we use only to mark the review “Verified Buyer”. With your consent we publish your first name and your review. We also keep the IP address the review was sent from, to prevent spam and abuse; it is never published.

Automatically, when you browse

• Analytics: pages viewed, how you arrived, device and browser type, and approximate location (country/region/city derived from your IP address) — see Analytics below.
• Traffic source: our site stores the first and most recent way you reached us (for example “Google search” or a campaign tag) in your browser’s local storage. It contains no name, email or other contact details, and is sent to us only together with an order or a message, so we can see which channels work.
• Technical and security data: our hosting provider and content-delivery network process your IP address and request details to deliver the site and protect it from abuse.

3. How We Use Your Information

• to process, ship and support your order, including returns and refunds;
• to send transactional emails about your order (confirmation and shipping updates) and to answer your messages;
• to send the one launch email you asked for through a “Notify me” form;
• to publish reviews you submit, with your consent;
• to prevent fraud, spam and misuse of the site and of our checkout;
• to understand, in aggregate, how the site is used and which channels bring visitors, so we can improve it;
• to meet legal, tax and accounting obligations.

We do not currently send marketing newsletters or promotional email sequences. If we ever offer one, it will be opt-in.

4. Who We Share It With

We share personal information only with service providers that help us run the store, and only what each one needs:

Provider	What they do for us	What they receive
Stripe	Payment processing and payment fraud screening	Checkout details you enter, order amount
UPS	Delivering your order	Name, shipping address, package details
Hostinger	Website hosting and delivery of our emails	Data stored on and sent from our server
Cloudflare	Content delivery, security, cookie-free traffic statistics	IP address and request details
Google	Google Analytics (site statistics), Google Ads conversion measurement (purchases that follow an ad click) and reCAPTCHA (spam protection on forms)	Usage and device data and, if you accept advertising cookies, ad-click and purchase information, as described below

We may also disclose information when required by law or to protect our rights, customers or the public, and to a successor if our business is sold or reorganized.

We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising. We use Google Ads only to measure which of our ads lead to purchases (conversion measurement). If you accept advertising cookies, Google receives ad-click and purchase information (order value, currency and an order reference) for that purpose. If you decline, or your browser sends a Global Privacy Control signal, advertising storage stays off. Ad personalization is always off on this site, whatever you choose. We do not use your information for retargeting audiences unless we update this page.

5. Analytics

We use Google Analytics 4 to understand site traffic in aggregate. It loads after you first interact with a page (or shortly after it loads) and uses first-party cookies (see below). We use Google Consent Mode: advertising storage stays off until you accept, and once you choose Accept All Cookies or Necessary Cookies Only in the cookie notice, analytics storage follows your choice. If you choose Necessary Cookies Only, Google tags may still send limited signals without cookies (for example that a page was viewed or a purchase happened) that do not identify you. We honor the Global Privacy Control signal for advertising. We have turned off Google signals. Our Analytics property is linked to our Google Ads account only so that purchases can be attributed to ad clicks; personalized advertising is turned off for this link. We keep event-level analytics data for two months. You can opt out of Google Analytics on any site with Google’s opt-out browser add-on.

Google Ads conversion measurement. When a visit starts from one of our Google ads, Google may store the ad-click identifier (gclid) in a first-party cookie, but only if you accepted advertising cookies. When you place an order, we tell Google that a purchase happened (value, currency and our order reference) so we can see which ads work. We do not use this measurement to build remarketing audiences.

We also use Cloudflare Web Analytics, which counts visits without cookies and without identifying individual visitors.

Google reCAPTCHA runs on our pages to protect our forms from spam and abuse; it analyzes technical and interaction data such as your IP address and browser information. This site is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

6. Cookies and Similar Technologies

Name	Set by	Purpose	Duration
PHPSESSID	thymocura.com	Essential: keeps your session and protects forms and checkout requests	30 minutes
_ga, _ga_*	Google Analytics	Site statistics (distinguishes visits)	Up to 2 years
tc_consent	thymocura.com	Remembers your cookie choice (a short code, no personal details)	180 days
_gcl_aw, _gcl_au	Google Ads	Measures purchases that follow an ad click (set only if you accept advertising cookies)	Up to 90 days
_GRECAPTCHA	Google reCAPTCHA	Spam and abuse protection on forms	Up to 6 months
tc_attr (local storage)	thymocura.com	How you first/last reached us — no personal details	Until you clear it
Offer and purchase flags (local storage)	thymocura.com	Remembers that you closed the launch offer and prevents counting one purchase twice	Until you clear it

Stripe sets its own cookies on its checkout pages. You can block or delete cookies and local storage in your browser settings; essential ones are needed for checkout and forms to work. A Global Privacy Control signal turns advertising cookies off automatically. A “Do Not Track” signal does not change how we process your data, because we do not sell or share personal information for targeted advertising.

Change your choice any time: use Cookie preferences in the site footer, or clear this site’s cookies in your browser.

7. How Long We Keep It

• Orders: for as long as needed to fulfil and support the order, handle returns and warranty questions, and meet tax and accounting record-keeping laws.
• Messages: for as long as needed to answer you and follow up, typically up to 3 years.
• “Notify me” requests: until the launch email is sent, or earlier if you ask us to remove you.
• Reviews: while the review is published, or until you ask us to remove it.
• Analytics: event-level data for two months in Google Analytics; aggregated reports longer.

8. Your Choices and Rights

Depending on the U.S. state where you live, you may have the right to:

• know and access the personal information we hold about you;
• correct inaccurate information;
• delete your information (we may keep what the law requires, such as order records for tax purposes);
• receive a copy of your information in a portable format;
• opt out of the sale of personal information or targeted advertising — we do neither;
• appeal our decision on your request.

We honor these requests for all customers, whatever state they live in. To make a request, use our contact form and write “Privacy request” in your message. To protect your information we will verify the request, usually by matching the email address used for your order. You may use an authorized agent. We respond within 45 days, and we will never treat you differently for exercising your rights. If we decline a request, you can appeal by replying to our answer.

Visitors outside the United States: we sell and ship only within the U.S., and your information is processed in the United States. Where laws such as the EU/UK GDPR apply, we rely on performance of a contract (orders), our legitimate interests (answering messages, preventing fraud, improving the site), your consent (reviews), and legal obligations (tax records), and you have the rights listed above.

9. Children

This site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

10. Security

The site is served only over HTTPS. Payments are processed by Stripe, a PCI DSS–certified provider, so card data never touches our server. Order and message data are stored outside the public part of our web server, with access limited to the people who need it to run the store. No method of transmission or storage is completely secure, but we work to protect your information and will notify you if the law requires it.

11. Third-Party Links

Our pages link to other websites, such as Stripe checkout and our trade site. Their own privacy policies apply there.

12. Changes to This Policy

We will update this policy when our practices change — for example if we add a new service provider — and change the date at the top of this page. Significant changes will be highlighted on this page.

13. Contact Us

For questions or privacy requests:

The Chestnut Supply LLC (ThymoCura®)
Norcross, Georgia, USA
Contact form — write “Privacy request” in your message