ONE THOUSAND ROADS

PRIVACY NOTICE

Last Updated: March 2, 2026

This Privacy Notice for One Thousand Roads LLC ("Company," "we," "us," or "our") describes how and why we collect, store, use, and share ("process") your information when you use our services ("Services"), such as when you:

•       Visit our website at https://www.onethousandroads.com or any website of ours that links to this Privacy Notice

•       Purchase products from us (including wellness and light therapy products)

•       Subscribe to emails/SMS, request information, or contact support

•       Engage with us through marketing, events, or affiliate referrals

Questions? Contact: hello@onethousandroads.com

QUICK SUMMARY

What we collect: Contact info, order/shipping details, payment-related details (handled by processors), and device/usage data (cookies, pixels, analytics).

Sensitive data: We do not intentionally collect sensitive personal information, but you may voluntarily share health-related details with support. We treat this information carefully and use it only to assist you.

Third parties: Yes — we use service providers (e.g., e-commerce platform, payment processors, marketing/analytics, advertising pixels, affiliate tracking).

Affiliate data: Affiliates and referral partners receive only anonymized or aggregated conversion data unless you separately consent to more. They do not receive personal order or contact details through our affiliate program.

Advertising: We may use cookies/pixels for analytics and advertising measurement and may "share" data for targeted advertising as defined by some privacy laws (even if we do not "sell" data for money).

Your rights: Depending on your location, you may have rights to access, delete, correct, or opt out of targeted advertising/sharing. See Section 11 for details.

1) WHAT INFORMATION DO WE COLLECT?

A. Information you provide

We may collect personal information you voluntarily provide, including:

•       Identifiers & contact details: name, email, phone number, billing/shipping address

•       Order & account details: purchase history, items purchased, returns/exchanges, customer service history

•       Marketing preferences: opt-in/opt-out status, communication preferences

•       Messages to us: emails, chat/support tickets, form submissions

•       Health-related information (if you choose to send it — see note below)

Health-related information: Because we sell wellness-related products, you might share health or condition-related details in customer support messages. We do not request this information. If you provide it voluntarily, we will use it only to assist you, comply with applicable law, or protect our rights. We do not use voluntarily shared health information for advertising or marketing purposes.

B. Payment information

We do not store full payment card numbers. Payments are processed by third-party payment processors (for example: Stripe and PayPal). Buy-now-pay-later options (such as Affirm and PayPal installments) are also available where applicable. These providers handle payment authentication and processing under their own privacy policies.

We may receive limited payment-related information such as payment status, transaction identifiers, and partial account details needed for order management, refunds, fraud prevention, and accounting.

C. Information collected automatically (cookies, pixels, analytics)

When you visit our site, we may automatically collect:

•       Device & browser data: IP address, browser type, device identifiers, operating system, language, approximate location

•       Usage data: pages viewed, clicks, time on site, referring URLs, conversion events (e.g., add-to-cart, purchase)

•       Cookie/pixel data: identifiers used for analytics, personalization, and advertising measurement

We use tools such as Google Analytics (GA4) and advertising pixels (for example: Meta Pixel and Google Ads/Conversion tags) to understand traffic and measure marketing performance.

2) HOW DO WE USE YOUR INFORMATION?

We process your information to:

•       Provide and deliver products and Services (orders, shipping, returns)

•       Create and manage accounts (if you create one)

•       Communicate with you (order confirmations, support, updates)

•       Send marketing messages (email/SMS) if you opt in

•       Measure, improve, and secure our website and Services

•       Detect fraud, abuse, or suspicious activity

•       Comply with legal obligations (tax, accounting, disputes)

3) WHAT LEGAL BASES DO WE RELY ON? (EEA/UK)

If you are in the EEA or UK, we rely on the following legal bases:

•       Contract: to fulfill orders and provide Services

•       Legitimate interests: to improve Services, prevent fraud, run analytics, and market responsibly

•       Consent: for certain marketing communications and certain cookies/trackers where required by law

•       Legal obligation: tax/accounting and other legal requirements

4) WHEN AND WITH WHOM DO WE SHARE INFORMATION?

We may share information with service providers and partners that help us operate, including:

•       E-commerce & hosting: storefront platform, site hosting, checkout

•       Payments & fraud prevention: payment processors and fraud screening tools

•       Shipping & fulfillment: carriers, fulfillment partners, address validation

•       Customer communications: email/SMS platforms (marketing + transactional messaging), support tools

•       Analytics & advertising: analytics providers and advertising platforms (e.g., Meta and Google)

•       Affiliate & referral tracking: affiliate platform providers (conversion data only; see Quick Summary)

•       Professional services: accountants, legal counsel, auditors

Note: This list is representative, not exhaustive. Our vendors may change over time. We require service providers to handle your data in ways consistent with this Privacy Notice.

We may also share information:

•       In a business transfer (merger, acquisition, financing, or sale of assets)

•       To comply with law or respond to lawful requests

•       To enforce our terms, protect rights, prevent fraud, or ensure safety

5) COOKIES, PIXELS, AND TRACKING TECHNOLOGIES

We use cookies and similar technologies (pixels, tags, local storage) for:

•       Site functionality (cart, checkout, preferences)

•       Analytics (understanding how the site is used)

•       Advertising measurement and targeted advertising (where permitted)

Your choices

Depending on your location and our site setup, you may be able to:

•       Manage cookie preferences via our cookie banner/settings (if enabled)

•       Disable cookies in your browser (may affect site functionality)

•       Opt out of certain interest-based advertising via industry tools (e.g., browser/device ad settings)

Global Privacy Control (GPC): Where required by law, we will treat browser-based opt-out signals such as GPC as a request to opt out of certain “sharing” for targeted advertising.

6) HOW LONG DO WE KEEP INFORMATION?

We retain personal information only as long as reasonably necessary for the purposes described in this notice, unless a longer period is required or permitted by law.

Typical retention periods:

•       Order/transaction records: generally at least 7 years (tax/accounting/legal). Basic purchase history may be retained longer for business recordkeeping and customer service, subject to applicable law.

•       Marketing data: until you unsubscribe or opt out. We may retain minimal suppression records to honor your opt-out.

•       Support communications: up to 10 years for service continuity, dispute handling, and recordkeeping.

•       Analytics data: retained according to tool settings and business needs; we periodically review and minimize where feasible.

•       Backups: may persist for a limited period before being overwritten.

If you request deletion, we will delete or de-identify your information unless an exception applies (for example, legal compliance, fraud prevention, or records we are required to keep).

7) HOW DO WE KEEP INFORMATION SAFE?

We use reasonable administrative, technical, and organizational safeguards designed to protect your information. No system is 100% secure, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please notify us promptly at hello@onethousandroads.com.

8) DO WE COLLECT INFORMATION FROM MINORS?

Our Services are not intended for individuals under the age of 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us at hello@onethousandroads.com and we will take steps to delete it.

9) IMPORTANT HEALTH / HIPAA NOTE

One Thousand Roads is not a medical provider, health plan, or covered entity under HIPAA, and our Services are not governed by HIPAA. Please do not send sensitive medical records to us. If you choose to share health-related details in support communications, we will use them only for customer support and operational purposes consistent with this notice, and not for advertising or marketing.

10) DO-NOT-TRACK

Some browsers offer "Do Not Track" signals. Because there is no uniform technical standard for these signals, we do not respond to DNT signals at this time. Where required by applicable law, we honor GPC and similar opt-out signals as described in Section 5.

11) U.S. STATE PRIVACY RIGHTS

Depending on your state of residence, you may have rights to:

•       Access or confirm our processing of your personal data

•       Request deletion of your personal data

•       Request correction of inaccurate personal data

•       Obtain a portable copy of your data

•       Opt out of targeted advertising and certain profiling

•       Opt out of certain “sales” or “sharing” of personal data as defined by applicable law

California (CCPA/CPRA)

We do not sell personal information for money. However, California law defines "sharing" broadly. We may share certain identifiers and internet activity data with advertising partners to measure and improve advertising. This may constitute "sharing" for cross-context behavioral advertising under California law.

Right to opt out: California residents may opt out of such “sharing” via cookie preference controls (where available) or by contacting us directly.

Virginia (VCDPA) / Texas (TDPSA)

Virginia and Texas residents have similar rights, including the right to opt out of targeted advertising and the right to appeal a denied rights request. To submit an appeal, contact us at hello@onethousandroads.com with the subject line "Privacy Rights Appeal."

12) HOW TO EXERCISE YOUR RIGHTS

To submit a privacy rights request, email hello@onethousandroads.com with:

•       Your name

•       The email address you used on our site

•       The type of request (access, delete, correct, opt out, or appeal)

We may need to verify your identity before fulfilling your request. Authorized agents may submit requests on your behalf where permitted by law; we may request proof of authorization.

We will respond to verifiable requests within the timeframes required by applicable law (generally 45 days, with an extension if needed).

13) INTERNATIONAL VISITORS

We operate in the United States. If you access our Services from outside the U.S., your information may be processed and stored in the U.S., where data protection rules may differ from those in your jurisdiction. By using our Services, you acknowledge this transfer.

14) UPDATES TO THIS NOTICE

We may update this notice from time to time to reflect changes in our practices or applicable law. The “Last Updated” date at the top reflects the current version. We encourage you to review this notice periodically.

15) CONTACT

One Thousand Roads LLC

1609 Hart St STE 100

Southlake, TX 76092

United States

Email: hello@onethousandroads.com