1. Who we are
The company responsible for your personal information ("data controller") is Rootessa, Calle Principal, Casa 103, Urb. Palmera Village, Boquerón, Chiriquí 0415, Panama. You can reach us at info@rootessa.com or +507 6000-6708 (phone or WhatsApp). See full details on our Contact page. We do not have a separate Data Protection Officer; privacy requests go directly to this address.
2. Information we collect
| Data | When we collect it |
|---|---|
| Name, email, phone number | When you complete checkout, provide shipping details, or sign up for marketing emails |
| Shipping and billing address | When you complete checkout or provide shipping details |
| Payment information | Entered directly into a form provided by our payment processor. Rootessa's own servers never see or store your full card number. If you activate "Subscribe & Save" or accept a one-click post-purchase offer, the processor may keep a tokenized (not human-readable) reference to your card so it can charge future renewals or that one additional item without asking you to re-enter it. |
| Order details | What you bought, quantities, whether it's a one-time or recurring order, and any discount code used |
| Browsing and device data (pages viewed, IP address, browser identifiers, approximate location by country) | Automatically as you use the site, via cookies, browser storage, and server logs |
3. Cookies, tracking pixels, and browser storage
This site uses the Meta Pixel (Facebook/Instagram), loaded through Cloudflare Zaraz, and Meta's Conversions API, called directly from our own server. Together they may record events such as: that you visited a page, selected a bundle, started checkout, or completed a purchase (including the amount and, hashed so Meta cannot read the original value, your email, phone, name, shipping city/zip/country, plus your IP address and browser identifiers). We use this to measure how effective our ads are and to show you relevant Rootessa ads on Meta's platforms.
This site also stores a small amount of information directly in your browser (cookies and "local storage"), which never leaves your device unless described elsewhere in this policy:
- Cookies
_fbp/_fbc: a random browser identifier and, if you arrived via a Meta ad, that ad's click reference. Sent to Meta as part of the events above so it can match a purchase to the ad that led to it. - Cart and checkout data (
rootessa_cart_v1,rootessa_ref_code,rootessa_attribution_v1,rootessa_ext_id): what's in your shopping cart, an affiliate/referral code from a link you followed, which marketing campaign brought you here, and a random identifier used only to help Meta match your events. None of this is shared with anyone except as described in this policy. - Payment-safety data (keys starting with
rootessa_charge_attempt_androotessa_pending_charge_): technical values that exist only to stop your card from being charged twice for the same order if a page reloads or you have two tabs open. They never contain your card number. - Order-confirmation data (cleared automatically when you close that browser tab): your most recent order number, whether it's paid, and the state of any post-purchase offer, so the confirmation screen still shows correctly if you reload it.
Our Conversions API calls run on our own server and are not controlled by your browser's cookie settings. For visitors located in the European Union/European Economic Area, the United Kingdom, or Switzerland, our system is designed to withhold this server-side data from Meta until you have given consent through a cookie banner. Outside of those regions, blocking third-party cookies or enabling a tracking-prevention feature in your browser reduces what the Meta Pixel itself can record, but does not stop the Conversions API call described above, since that happens directly between our server and Meta's. Meta processes this data under its own privacy policy, and you can also manage your ad preferences directly in your Meta account.
4. How we use your information, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Process, ship, and support your order; run the checkout, cart, and (if you choose it) a recurring subscription | Performance of the purchase contract with you |
| Prevent fraud and abuse (for example, our blocklist for repeat refund abuse) | Our legitimate interest in protecting the business and other customers |
| Measure and improve our advertising (Meta Pixel and Conversions API) | Your consent, where required by your location (EU/EEA, UK, Switzerland); our legitimate interest in understanding whether our advertising works, everywhere else |
| Send you marketing emails about products, tips, or a re-order reminder | Your consent, only if you checked the marketing box at checkout; you can withdraw it at any time (see Section 8) |
| Comply with legal, tax, or accounting obligations | Legal obligation |
5. Who we share your information with
- Payment processors: Rootessa works with BAC (through its payment processor, PowerTranz) and Banco General (through its payment processor, CyberSource/Unified Checkout) to securely process your card payment. Only one of these is active for a given order; your card details are entered directly into a form they provide and processed under their own privacy policies.
- Manufacturing and fulfillment provider: to prepare and ship your order; receives your name and shipping address.
- Cloudflare: our hosting, security, and content-delivery provider (including its Zaraz tool, used to load the Meta Pixel above); processes all traffic to this site under its own privacy policy. Our checkout page also uses Cloudflare Turnstile, an invisible check that confirms a real person (not a bot) is submitting the order. See the Turnstile Privacy Addendum for details on how it processes data.
- Meta (Facebook/Instagram): receives Meta Pixel and Conversions API events for measurement and advertising, as described in Section 3.
- Klaviyo: our email marketing platform. If you complete a purchase, it receives your name, email, phone, and order details so we can send purchase-related emails; if you check the marketing consent box at checkout, it also receives your consent record so it can send you marketing emails, which you can unsubscribe from at any time.
- Fonts: every page on this site loads its typefaces from our own servers. We do not use Google Fonts or any other third-party font service, so loading a page does not share your IP address with a font provider.
We do not sell your personal information to third parties.
6. International data transfers
Rootessa is based in Panama, but several of the providers listed in Section 5 (including our payment processors, Cloudflare, Meta, and Klaviyo) are based in, or process data in, the United States and other countries outside of your own, which may have different data protection laws. Where required, these providers rely on recognized legal safeguards (such as Standard Contractual Clauses) for these transfers.
7. How long we keep your information
We retain your order data for as long as necessary to comply with legal, accounting, or warranty obligations, and to be able to assist you with any future questions about that purchase. You can ask us to erase the personal details (name, email, phone, address) tied to a specific order sooner, using the rights below. We anonymize the order record rather than deleting it outright, so we can still meet those same legal and accounting obligations without being able to identify you from it.
8. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you;
- Correct it if it's inaccurate or incomplete;
- Erase it, subject to the retention needs described in Section 7;
- Restrict or object to certain processing, including profiling for advertising;
- Receive a copy of your data in a portable format;
- Withdraw your consent at any time, for any processing based on consent (this does not affect processing already done before you withdrew it); and
- Lodge a complaint with the data protection supervisory authority in your country of residence. In Panama, this is the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI).
To exercise any of these rights, write to info@rootessa.com. We will respond within one month of receiving your request; for complex requests, this may be extended by up to two further months, in which case we will let you know why.
9. Children
This site is not directed at individuals under 18 years of age, and we do not knowingly collect information from minors.
10. Changes to this policy
We may update this policy at any time. The "Last updated" date above reflects the current version.
11. Contact
For privacy questions or to exercise your rights over your data, write to us at info@rootessa.com, or by post to Rootessa, Calle Principal, Casa 103, Urb. Palmera Village, Boquerón, Chiriquí 0415, Panama.