Privacy Policy

Information the website uses

• Orders: your email address, selected country, language, products, amount, order time and status, and payment identifiers. We use this information to process orders, confirm payments, deliver materials, and provide support.
• Genetic test orders also request a full name, phone number, and Telegram handle for communication and order arrangements. This form is not intended for laboratory results or raw genetic data.
• Email inquiries: the sender’s address, message, and any documents voluntarily included. Please do not send passwords, access codes, full payment-card details, or unnecessary medical information. You can hide unrelated information on payment receipts.

Order information is used to fulfill orders; inquiries are used to respond to your request. Security and transaction records support website operations and applicable obligations. Visiting the website or making a purchase does not, by itself, constitute consent to marketing emails.

Email and Google access

Valentina Recipes Mail connects the service mailbox valentina.recipes@gmail.com through Google OAuth with send-only permission (gmail.send). An administrator establishes this connection. Customers do not need to grant access to their Google accounts. The application does not request access to incoming emails, contacts, or Google Drive files.

The website sends Google the recipient address, subject, body, and any attachments of an outgoing message. Authorization is stored on the server as an encrypted token; the website does not store the Gmail password. A technical sending status is recorded. Mini collections requested using the gift form are sent automatically as PDF attachments. This feature does not enable automatic paid-order delivery or abandoned-cart reminders.

For a gift request, we store an encrypted email address, the selected gift, form language, request date, and sending result. If you separately request occasional news, we record the date and version of that consent. New subscriptions are activated when the form is submitted with the optional checkbox selected; no additional email confirmation is required. Without that checkbox, no new subscription is created. Previous opt-outs are preserved. You can unsubscribe using the link at the bottom of the email or by contacting us. Receiving a gift does not require a subscription.

To protect the form from bulk requests, we use short-lived counters with keyed hashes of connection addresses and emails. These counters do not contain the original IP address and expire within 24 hours; expired records are removed on subsequent requests. Contact and sending records are kept separately from orders for delivery, duplicate prevention, and support. You can request deletion using the contact address above.

Data received through Google APIs is used only for the disclosed email features and their security. It is not sold or used for advertising or AI model training. Use of this data adheres to the Google API Services User Data Policy, including its Limited Use requirements.

The service mailbox owner can revoke access in Google account connection settings. Revocation prevents sending under that authorization. To request removal of the stored connection from the website, contact the privacy address above. Revocation does not remove previously sent messages from mailboxes.

Cart storage and analytics

Your browser stores your cart and selected country. You can remove this information in your browser settings. Pages without the /en/ prefix default to Russian; language can be switched manually.

The website counts visits, page views, cart additions, and traffic-source categories. It uses a random visit identifier, renewed after 30 minutes without recorded activity. Analytics records include this identifier, start time, source category, and daily counters. They do not contain email addresses, IP addresses, full referrer URLs, or device fingerprints, and are not linked to orders. Sources are classified using utm_source tags or browser referrer information. This analytics data is not sent to advertising platforms. Browser analytics is disabled when Do Not Track or Global Privacy Control is enabled.

The administrator dashboard uses a secure session cookie lasting up to eight hours, with a 30-minute inactivity limit. Login protection temporarily stores a hash of the connection address and an attempt counter. An administrator’s browser also stores a flag excluding its visits from analytics.

Service providers and access

Orders and operational records are stored in OpenAI Sites / Cloudflare hosting infrastructure. Google processes messages sent through Gmail. PayPal processes payment information when you use PayPal; the website receives information needed to confirm an order but does not store full card numbers or card security codes. Documents supplied for manual transfer confirmation are used to check payment.

Access to order records and mail connections is restricted through the administrator dashboard. If you follow a Telegram or social-media link, that service’s policies apply. The providers listed above may process information outside your country of residence. We do not sell our contact database.

Retention and your requests

Order and payment records are retained for fulfillment, support, transaction disputes, and recordkeeping. No general automatic deletion period is currently configured for these records or accumulated analytics. Expired login records are cleaned up separately. The Gmail token remains until the connection is replaced or removed. Gmail messages are stored separately from the website database.

Contact glutenfreerus@gmail.com to request access, correction, deletion, restrictions on use, or withdrawal of previously given consent. We may need to verify that you control the email address or order. Requests are considered subject to applicable rights and obligations; some records may be needed for recordkeeping or resolving claims. Retention needs are assessed when a request is reviewed.

We update this page when our data practices change. Where a new use requires separate consent, we request it before starting that processing.