Stacked Routine
Privacy Policy
Effective: March 6, 2026 | Last Revised: March 6, 2026 | www.stackedroutine.com
At Stacked Routine, LLC ('Stacked Routine', 'we', 'us', 'our'), protecting your privacy is fundamental to our business. This Privacy Policy explains how we collect, use, disclose, protect, and retain personal information when you visit www.stackedroutine.com ('Website'), create an account, purchase Products (including DOZE), or otherwise interact with our Services. This Policy is incorporated by reference into our Terms and Conditions of Service and Sale.
By accessing or using our Website or Services, you acknowledge that you have read this Privacy Policy and consent to the practices described herein. If you do not agree, discontinue use of the Website.
1. Information We Collect
1.1 Information You Provide Directly
- Identity and contact data: name, email address, telephone number, billing and shipping address
- Account credentials: username, password, account preferences
- Order and transaction data: products purchased, order history, subscription preferences
- Payment information: billing address and payment card details. Full payment card numbers are processed directly by our payment processor (Stripe, Inc.) and are NOT stored by Stacked Routine
- Health and wellness information you voluntarily share: sleep concerns, wellness goals, health conditions, or medications disclosed in surveys, quizzes, or customer support communications. This constitutes sensitive personal information (see Section 8)
- Communications: messages, emails, feedback, testimonials, reviews, and support requests
- Marketing preferences: opt-in and opt-out choices
- Post-purchase survey responses: answers to questions about your product experience, satisfaction ratings, reasons for purchasing, and how you learned about our products. See Section 1.5 for full details on how this data is collected, used, and retained.
1.2 Information Collected Automatically
- Device and browser data: IP address, device type, operating system and version, browser type, screen resolution, language settings
- Usage and activity data: pages visited, time on pages, links clicked, navigation paths, referring URLs, access times
1.3 CCPA Category Disclosure — Information Collected in the Past 12 Months
In compliance with the California Consumer Privacy Act (CCPA/CPRA), we disclose the following categories of personal information collected in the preceding 12 months:
- Identifiers: name, email address, postal address, IP address, account username, device identifiers
- Customer records information: name, address, telephone number, payment card information (via processor), purchase history
- Protected classification characteristics: age (18+ verification only); no other protected classification data collected
- Commercial information: products purchased, subscription history, purchase preferences
- Internet or other electronic network activity: Website browsing history, interaction with our site, search history on our site
- Geolocation data: approximate (IP-derived, city/region level)
- Sensitive personal information: health and wellness data voluntarily provided (see Section 8)
- Inferences: product preferences and wellness interests derived from the above
- Post-purchase survey data: product satisfaction responses, purchase motivation, and marketing attribution data (how you heard about us) collected via voluntary post-purchase surveys
We do NOT collect: Social Security numbers; driver's license or passport numbers; precise geolocation; financial account numbers; biometric information; contents of mail or text messages (except support communications)
1.4 Information From Third Parties
- Social media platforms: if you connect a social account or interact with our social content
- Advertising partners: audience matching and campaign performance data (hashed identifiers only)
- Payment processors: transaction confirmation and fraud signals from Stripe
- Analytics providers: aggregated behavioral analytics from Google Analytics
1.5 Post-Purchase Survey Data
Following a purchase, we may contact you by email or SMS (where you have provided prior express written consent for SMS) to ask voluntary questions about your product experience. Participation is entirely optional and your response or non-response will not affect your order, account status, or any future purchases.
What We Ask
- Product experience: how DOZE has worked for you, your satisfaction with results, and your overall product experience
- Use of the product: how you use DOZE and your usage patterns (e.g., timing, frequency)
- Purchase motivation: why you chose Stacked Routine products, your sleep concerns or wellness goals at the time of purchase
- Marketing attribution: where you heard about Stacked Routine or DOZE (e.g., social media, search engine, friend referral, podcast, advertisement)
How We Use Survey Responses
- Product improvement: to understand how DOZE performs for real customers and to guide future formulation and product development
- Customer support: to follow up on product concerns raised in survey responses, and to provide personalized product guidance
- Aggregated research: to compile anonymized, de-identified insights about how customers discover and use our products — this aggregated data cannot be linked back to you individually
- Marketing attribution analysis: to understand which channels and messages bring customers to Stacked Routine, so we can allocate marketing resources responsibly
What We Do NOT Do With Survey Responses
- We do NOT sell or share survey responses with third-party advertisers, data brokers, or marketing partners
- We do NOT use survey responses to make automated decisions that affect your account, pricing, or eligibility for services
- We do NOT selectively invite only satisfied customers to post public reviews based on survey scores. All survey participants are equally invited to share honest feedback on third-party review platforms if they choose to do so (see FTC Consumer Review Rule compliance)
- Any health or wellness information you voluntarily share in survey responses is subject to the additional protections described in Section 8 (Sensitive Personal Information)
Retention of Survey Data
Individually identifiable survey responses are retained for 24 months from the date of collection, after which they are permanently deleted or irreversibly de-identified. De-identified and aggregated survey data (which cannot be linked to any individual) may be retained indefinitely for product research and development purposes. Survey data linked to an open customer support case will be retained until that case is resolved plus 12 months. You may request deletion of your survey responses at any time by contacting privacy@stackedroutine.com; requests will be honored within 45 days.
Legal Basis and Opt-Out
Survey outreach emails are commercial communications subject to CAN-SPAM. Every survey invitation email includes a one-click unsubscribe link. You can also opt out of all post-purchase survey communications at any time by: (a) clicking the unsubscribe link in any survey email; (b) replying STOP to any survey SMS; or (c) emailing privacy@stackedroutine.com with "Survey Opt-Out" in the subject line. Opting out of surveys will not affect your order confirmation emails, shipping notifications, or other transactional communications.
2. How We Use Your Information
2.1 Service Delivery (Contractual Necessity)
- Processing, fulfilling, and shipping orders and subscriptions
- Managing your account and subscription preferences
- Sending order confirmations, shipping notifications, and delivery updates
- Processing returns, refunds, and satisfaction guarantee claims
- Providing customer support and responding to inquiries and adverse event reports
2.2 Improvement and Personalization (Legitimate Interests)
- Analyzing Website usage and customer behavior to improve products and user experience
- Personalizing content, recommendations, and promotions based on purchase history
- Conducting surveys and user research
- Developing new Products and improving existing formulations
2.3 Marketing (Consent or Legitimate Interests)
- Sending promotional emails and newsletters (with consent where required)
- Sending SMS marketing messages (with TCPA-compliant consent — see Section 11)
- Delivering interest-based advertising on third-party platforms (e.g., Meta, Google) — this constitutes 'sharing' under CPRA (see Section 3.2 and Section 7)
- Operating referral programs and promotional campaigns
2.4 Legal Compliance and Protection (Legal Obligation / Legitimate Interests)
- Complying with applicable laws, regulations, and legal processes, including FDA adverse event reporting
- Enforcing our Terms and Conditions and protecting our intellectual property
- Detecting, preventing, and investigating fraud, security incidents, and illegal activity
- Protecting the rights, safety, and property of Stacked Routine, our customers, and others
4. Data Retention
We retain personal information for as long as your account is active or as necessary to fulfill our contractual and legal obligations. Specific retention periods:
- Account and identity data: Duration of active account + 3 years after account closure
- Transaction and purchase records: 7 years (tax and legal compliance)
- Payment processing records: 7 years (financial recordkeeping requirements)
- Marketing opt-out records: Indefinitely (to honor your opt-out)
- Subscription consent records: 3 years (FTC Negative Option Rule requirement)
- Health and wellness data (voluntarily provided): Duration of active account; deleted upon account deletion request unless required for safety or legal purposes
- Customer support communications: 3 years from last interaction
- Website analytics data: 26 months (Google Analytics standard retention)
- Post-purchase survey responses (individually identifiable): 24 months from date of collection, then permanently deleted or irreversibly de-identified; de-identified/aggregated survey data retained indefinitely for product research
Upon account deletion or a verified deletion request, we will delete or anonymize your personal information within 45 days, except where retention is required by law or legitimate business purposes (e.g., tax records, fraud prevention, pending disputes).
6. Your Privacy Rights and Choices
Subject to applicable law and identity verification, you may have the following rights:
- Right of Access: Request a copy of personal information we hold about you
- Right to Correct: Request correction of inaccurate or incomplete information
- Right to Delete: Request deletion of your personal information (subject to legal retention obligations)
- Right to Portability: Receive your information in a structured, machine-readable format
- Right to Opt Out of Selling/Sharing: Opt out of sale or sharing for behavioral advertising
- Right to Limit Sensitive Data Use: Limit use of sensitive personal information to permitted purposes
- Right to Object: Object to certain processing, including direct marketing
- Right to Restrict Processing: Request that we limit how we process your information
- Right to Withdraw Consent: Withdraw consent where processing is consent-based
To exercise rights: email privacy@stackedroutine.com with the subject 'Privacy Rights Request' stating your name, email, state of residence, and the right you wish to exercise. We will respond within 45 days (extendable by 45 additional days with notice). We may require identity verification. We will not discriminate against you for exercising your rights. If we deny your request, we will provide a reason and information about your right to appeal. To appeal a denial, email privacy@stackedroutine.com with 'Privacy Rights Appeal' in the subject line. We will respond to appeals within 45 days.
7. California Residents — CCPA / CPRA Rights (As Amended 2026)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) and the CPPA's 2025/2026 regulations:
- Right to Know: What personal information we collect, use, disclose, and share (see Section 1.3)
- Right to Delete: Delete personal information we have collected (subject to exceptions)
- Right to Correct: Correct inaccurate personal information
- Right to Opt Out of Sale or Sharing: Opt out of the sale of personal information and sharing for cross-context behavioral advertising — click 'Do Not Sell or Share My Personal Information' in our Website footer or email privacy@stackedroutine.com
- Right to Limit Sensitive Personal Information: Limit use of sensitive personal information (including health data you provide) to the purpose for which it was collected
- Right to Non-Discrimination: We will not deny you goods or services, charge different prices, or provide a different level of service for exercising your CCPA/CPRA rights
- DELETE Act / DROP System: Beginning January 1, 2026, California consumers may use California's Delete Request and Opt-Out Platform (DROP) to submit deletion requests to multiple businesses. We comply with DELETE Act requirements
- ADMT Rights: We do not currently use automated decision-making technology (ADMT) that renders significant decisions affecting you. If we implement such technology in the future, we will provide pre-use notice and opt-out rights as required by CPPA regulations effective January 1, 2026
To submit a CCPA/CPRA request: email privacy@stackedroutine.com or use the 'Do Not Sell or Share My Personal Information' link in our Website footer. We will respond within 45 days (extendable by 45 days with notice). Authorized agents may submit requests on your behalf with proper documentation.
8. Sensitive Personal Information — Health and Wellness Data
Health and wellness information you voluntarily provide (including sleep conditions, medications, and wellness goals) constitutes sensitive personal information under the CPRA and is subject to heightened protections under multiple state privacy laws. We use your health and wellness data ONLY to: (a) provide personalized product recommendations and customer support; and (b) improve our Products and Services in an aggregated, de-identified manner.
We do NOT: (a) sell or share your health data with advertising platforms for behavioral advertising; (b) use your health data for automated decision-making; (c) share your health data with third parties other than service providers necessary to deliver our Services; or (d) use health data in any manner beyond the purposes for which it was collected. California, Colorado, Connecticut, Virginia, and Texas residents have the right to limit the use and disclosure of sensitive personal information. To exercise this right, contact privacy@stackedroutine.com.
9. Other U.S. State Privacy Rights
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Florida (FDBR), Montana, Oregon, and other states with comprehensive data privacy legislation have the right to access, correct, delete, and opt out of certain processing of their personal information. To exercise any right under applicable state law, contact privacy@stackedroutine.com with your state of residence.
10. Children's Privacy — COPPA and General
10.1 Under-13 Users (COPPA)
We do not knowingly collect, maintain, or use personal information from children under 13 years of age without verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq. Our Website is not directed to children under 13. If we discover that a child under 13 has provided personal information without verifiable parental consent, we will promptly delete such information. If you believe a child under 13 has provided us personal information, contact privacy@stackedroutine.com.
10.2 Under-18 Users
Our Products and Services are directed to adults 18 years of age and older. We do not knowingly sell to or collect personal information from individuals under 18. If we discover an account was created by or a purchase made by someone under 18, we will cancel the order and delete the associated information.
11. SMS Marketing and TCPA Compliance
If you provide a mobile phone number and consent to receive SMS marketing messages, you consent to receive recurring automated marketing text messages from Stacked Routine at the number provided. Consent is NOT a condition of purchase. We use an automated telephone dialing system (ATDS) or similar technology to send SMS marketing messages. Message frequency varies (typically 2–4 messages per month). Standard message and data rates may apply — check with your carrier.
To opt out: text STOP to any marketing SMS at any time. After texting STOP, you will receive one confirmation message and no further marketing texts. To get help: text HELP to any marketing SMS. For full terms, contact support@stackedroutine.com. You may still receive transactional SMS messages (e.g., order confirmations) after opting out of marketing SMS.
12. Data Security and Breach Response
We implement the following security measures to protect your personal information: (a) SSL/TLS encryption for data in transit; (b) encryption for sensitive data at rest; (c) access controls and role-based authentication limiting data access to authorized personnel; (d) regular security assessments and vulnerability testing; (e) vendor security screening and contractual data protection obligations; and (f) employee training on data protection and privacy.
Despite these measures, no method of data transmission or storage is 100% secure. We cannot guarantee the absolute security of your information. We are not responsible for unauthorized access resulting from circumstances outside our reasonable control, including user-side security failures.
Data Breach Response: In the event of a data breach affecting your personal information, we will notify affected users as required by applicable law — including California Civil Code § 1798.29 (California), and the breach notification laws of other applicable states — within the required timeframe (generally 72 hours to relevant authorities and without undue delay to affected individuals). Notification will include the nature of the breach, categories of data affected, steps taken, and recommended protective actions.
13. Third-Party Websites and Links
Our Website may contain links to third-party websites, social media platforms, and other services not operated by Stacked Routine. This Privacy Policy does not apply to those sites. We are not responsible for their privacy practices or content. We encourage you to review the privacy policy of any third-party website you visit.
14. International Data Transfers
Stacked Routine is based in the United States. If you access our Services from outside the United States, your personal information may be transferred to, stored, and processed in the United States or other countries where data protection laws may differ. For EU or UK residents, where we transfer personal data, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms under applicable law. By using our Services, you consent to such transfer and processing.
15. Changes to This Policy and Contact Us
15.1 Policy Updates
We may update this Privacy Policy from time to time. We will update the 'Last Revised' date and, for material changes, use reasonable efforts to notify you — such as by email or prominent Website notice. Your continued use of our Services after such notice constitutes acceptance of the updated Policy.
15.2 Contact Us — Privacy Inquiries
Stacked Routine, LLC — Privacy Team
Email: privacy@stackedroutine.com
Website: www.stackedroutine.com/privacy
Response Timelines: We will respond to verifiable privacy requests within 45 days. We may extend by an additional 45 days with notice. If we deny your request, we will explain the reason and your right to appeal. If you are not satisfied with our response, you may lodge a complaint with the relevant data protection authority in your jurisdiction — for California residents, the California Privacy Protection Agency (CPPA) at cppa.ca.gov; for EU/EEA residents, your local data protection authority.
© 2026 Stacked Routine, LLC. All Rights Reserved.
Privacy Policy last updated: March 6, 2026