Privacy policy

Last updated: October 21, 2026

Drainae, operated by HKG Lab, is the controller of personal data collected on the Site and the app. This policy explains what data we collect, why, for how long and what your rights are, in accordance with the EU General Data Protection Regulation (GDPR) and, for US residents, applicable state privacy laws (including the CCPA/CPRA).

1. Data we collect

Identity and contact: name, email, phone number, shipping and billing addresses.
Orders and subscriptions: products, amounts, history, subscription status, customer service exchanges.
Payment: handled by our payment providers (Shopify Payments/Stripe, PayPal); we never store full card numbers.
Browsing: IP address, device, browser, pages viewed, traffic source, cookies and similar identifiers.
Optional data: quiz answers, reviews and photos you post, marketing preferences.

We do not knowingly collect health data; please do not send us more than needed to handle your request.

2. Purposes and legal bases

Processing and delivering orders, managing subscriptions and customer service: performance of contract.
Preventing fraud, securing payments, handling disputes and chargebacks: legitimate interest.
Complying with accounting, tax and consumer law obligations: legal obligation.
Sending offers by email or SMS: your consent (or, for customers, legitimate interest for similar products, with one-click unsubscribe).
Measuring audience, improving the Site and personalizing advertising (Meta, Google, TikTok, Microsoft Clarity): your consent where required by law.

3. Recipients

Your data is accessible to our authorized staff and to our processors within the scope of their services: hosting and e-commerce platform (Shopify), payments (Shopify Payments/Stripe, PayPal), subscription management (Appstle), post-purchase offers (AOV.ai), carriers, email, analytics and advertising tools (Meta, Google, TikTok, Microsoft). We do not sell your personal data for money. Some browsing data shared with advertising platforms may constitute "sharing" under certain US laws: you can opt out (Section 7).

4. International transfers

Some providers are located outside the European Union, notably in the United States and Canada. These transfers rely on adequacy decisions (including the EU-US Data Privacy Framework for certified companies) or the European Commission's standard contractual clauses.

5. Retention

Customers: duration of the relationship, then 3 years for marketing; accounting records: 10 years.
Prospects: 3 years from last contact.
Cookies: up to 13 months; cookie choices: 6 months.
Data related to a dispute or chargeback: until it is resolved and appeal periods have expired.

6. Cookies

We use cookies necessary for the Site to work (cart, checkout, security, language) and, where permitted by law or with your consent, analytics and advertising cookies. In the European Economic Area and the United Kingdom, non-essential cookies are only set after your consent, which you can withdraw at any time from the "Cookie preferences" link in the footer or your browser settings.

7. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object (including to marketing, at any time and without reason), to withdraw consent and, in France, to set post-mortem instructions. Residents of certain US states also have the right to know, delete, correct and opt out of the sale or sharing of their data and of targeted advertising, via the Do Not Sell or Share My Personal Information page; we honor the Global Privacy Control signal. To exercise your rights, use our contact form or at contact@drainae.co; we may ask you to verify your identity. We respond within one month (45 days for US requests). You may lodge a complaint with the CNIL (www.cnil.fr) or your local authority. We will not discriminate against you for exercising your rights.

8. Marketing communications

Promotional emails and SMS are only sent with your consent or where permitted by law. Consent to SMS is not a condition of purchase; message frequency varies; message and data rates may apply; reply STOP to unsubscribe, HELP for help. Every email includes an unsubscribe link.

9. Security and minors

We use appropriate technical and organizational measures (encrypted connections, restricted access, PCI-DSS certified providers). The Site is not directed at persons under 18.

10. Contact

For any question about your data: contact form or at contact@drainae.co. Controller: HKG Lab, La Maison Bleue, 16 rue Alsace Lorraine, 76000 Rouen, France. You may lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.