Privacy policy

Last updated: October 23, 2026

This policy explains what personal information PROTOKODE, operated by MMMK Vista LLC ("PROTOKODE", "we", "us"), collects, why, who we share it with, and the choices you have. It covers our website (tryprotokode.com), our emails and our customer support.

The short version

We collect what we need to sell you our products, deliver them, support you, and improve our store.
We don't sell your personal information for money.
We use analytics and marketing cookies to run our site and measure our ads. You can turn them off at any time on our Your Privacy Choices page or with a Global Privacy Control signal.
Some advertising tools count as "sharing" or "selling" under some state laws. You can opt out at any time on our Your Privacy Choices page, and we honor Global Privacy Control (GPC) signals.
You can ask to see, correct or delete your information.

Notice at Collection

We collect the categories of personal information listed below, for the purposes listed below. In short:

What we collect: identifiers (name, email, phone, address, IP address), customer records (billing and shipping details), commercial information (what you buy), internet activity (pages viewed, clicks and session recordings), approximate location, photos you send us, and health details if you report a product reaction.
Why: to process and deliver orders, support you, prevent fraud, send emails you've agreed to, measure and show our ads, improve our site and meet our legal duties.
Selling and sharing: we don't sell personal information for money. Unless you opt out, some of it (identifiers, internet activity and purchase events) is shared with advertising partners, which some state laws count as "selling" or "sharing". You can opt out at any time on our Your Privacy Choices page.
How long we keep it: see "How long we keep information" below.
Sensitive information: we only collect it if you choose to report a product reaction or tell us about a health matter, and we only use it for that purpose. See our Consumer Health Data Privacy Policy.

Information we collect

Information you give us

Contact and order details: name, email, phone number, shipping and billing address, order history.
Payment details: your card or wallet is processed by our payment providers. We see only limited details, such as the card type, the last four digits and the billing address. We never see or store your full card number.
Messages: emails and anything you choose to tell us, including photos you send about a damaged, wrong or missing item.
Reviews: if you leave a review, your name, rating, review text and any photos you add.
Reaction reports: if you tell us about a reaction to a product, the details you share, which may include health information.
Email choices: whether you've signed up for our emails, and when.

Information collected automatically

Device and usage data: IP address, browser, device type, pages viewed, links clicked, referring site and time on page.
Session recordings and heatmaps: unless you opt out, our session-recording and heatmap tools record how you scroll, click and move around our pages so we can find what's confusing or broken. Form fields are masked, so what you type isn't recorded.
Approximate location: your general area (such as city or state) based on your IP address. We don't collect your precise location.
Cookies, pixels and similar tools: see the Cookies section below.
Email engagement: whether you opened an email or clicked a link.

Information from others

Payment and checkout providers: confirmation that a payment went through, and fraud checks.
Carriers: delivery status, tracking updates and proof of delivery.
Advertising and analytics partners: information about how you found us, such as the ad you clicked.

How we use your information

To process, prepare, ship and track your orders.
To answer your questions and review reports about damaged, wrong, missing or lost items with our service providers and carriers.
To keep our store, our customers and our offers safe from fraud and misuse.
To send order and shipping emails.
To send marketing emails, if you've signed up.
To show you post-purchase offers right after checkout.
To collect product reviews.
To show you our ads on other sites and apps and measure how they perform, unless you've opted out.
To understand how people use our site and make it better, unless you've opted out.
To meet our legal duties, including tax records and keeping and reporting product-reaction records where the law requires.
To protect our rights and the safety of our customers.

Reaction reports and health information

If you report a reaction to one of our products, we use what you tell us to help you, look into the product, and meet our legal duty as a cosmetics company to keep records and report serious reactions to the US Food and Drug Administration. We keep these records for 6 years, as the law requires. We don't use this information for marketing or advertising.

Residents of Washington, Nevada and Connecticut have extra rights over consumer health data, and we apply them to all US customers. Our Consumer Health Data Privacy Policy explains what we collect, why, who receives it and how to make a request. We never sell consumer health data or use it for advertising.

Who we share information with

We share personal information only as described here.

Service providers who work for us under contract and may only use the information to provide their services to us:

Shopify, which hosts our store and checkout. Shopify's own privacy policy also applies to Shop Pay and the Shop app.
Payment providers, including Shopify Payments, Shop Pay, Apple Pay and Google Pay.
The partners who make and ship our products. They receive your name, shipping address, phone number and the items ordered.
Carriers, such as USPS and UPS.
Our email platform, which sends our emails and tracks email sign-ups and engagement.
Our customer support platform, which stores the emails and social media messages you send us so we can answer them.
Our reviews platform, which collects product reviews and sends review-request emails.
A post-purchase offers tool, which shows one-time offers right after checkout.
Session-recording and heatmap tools, for session recordings and heatmaps (unless you opt out).
Google Analytics, for site analytics (unless you opt out).
Our business email provider.
Our accountants, lawyers and insurers, when needed.

Advertising partners: Meta (Facebook and Instagram) receives information collected by the Meta pixel on our site and, through Meta's Conversions API, from our servers. This can include your IP address, device data, pages viewed and purchase events, and a scrambled (hashed) version of your email or phone number so Meta can match and measure our ads. We don't send this if you've opted out.

Legal and safety reasons: if the law requires it, to respond to valid legal requests, or to protect our rights, our customers or the public. If you dispute a charge, we may share proof of delivery, your order records and the terms agreed at checkout with your bank or card provider.

Business transfers: if our business or brand is sold or merged, your information may transfer to the new owner, who must respect this policy.

We don't share personal information with third parties for their own direct marketing.

Selling, sharing and targeted advertising

We don't sell your personal information for money.

When we use advertising tools from Meta, or measure ads with Google, some state laws count that as "selling" or "sharing" personal information, or as "targeted advertising". In the past 12 months we've done this with identifiers, internet activity and commercial information (such as purchase events).

You can opt out:

visit our Your Privacy Choices page (link in our footer). This takes effect for that browser right away, or
turn on Global Privacy Control (GPC) in your browser. We honor a GPC signal as an opt-out for that browser automatically, or
email support@tryprotokode.com with the subject "Do not sell or share". Include the email and phone number you use with us so we can apply your choice to your contact details.

We act on every opt-out request within 15 business days. Opting out doesn't change your prices or your orders.

We don't knowingly sell or share the personal information of anyone under 16.

We don't use sensitive personal information to infer things about you, and we only use it for purposes the law allows, so we don't offer a separate "limit the use" option.

Cookies

Cookies are small files that sites place on your device. Pixels, tags and scripts do a similar job. Analytics and marketing cookies run unless you opt out. You can opt out at any time on our Your Privacy Choices page (link in our footer), and we honor Global Privacy Control signals automatically.

Essential (always on)

Keep your cart, run checkout and post-purchase offers, keep the site secure and remember your cookie choice.
Examples: Shopify (such as cart, _shopify_y, _tracking_consent, _cmp_a), our post-purchase offers tool and our reviews platform.

Analytics

Help us see how people use the site so we can make it better.
Examples: Shopify Analytics, Google Analytics (_ga, _ga_*), session recordings and heatmaps (_clck, _clsk, CLID).

Marketing

Measure our ads, show you our ads on other sites and apps, and connect your visits to our emails.
Examples: Meta pixel and Conversions API (_fbp, _fbc), our email platform (__kla_id).

Cookie names can change as providers update their tools.

Your choices

Opt out of analytics and marketing cookies at any time on our Your Privacy Choices page.
If your browser sends a Global Privacy Control signal, we turn off marketing cookies and pixels for that browser automatically.
You can also block or delete cookies in your browser settings. Some parts of the store, such as the cart, need cookies to work.
Other "Do Not Track" browser signals have no common standard, so we don't respond to them. We do honor GPC.

Emails

If you sign up, we send scalp-care notes, routines, reminders before you run out, new launches and offers. You can unsubscribe at any time with the link in any email. We still send order and shipping emails, because they're about your order. We don't currently send marketing text messages.

Your privacy rights

We honor the following rights for all US customers, wherever you live. Residents of California and of states with consumer privacy laws (such as Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) have these rights by law.

Know and access: ask what personal information we have about you, where it came from, why we use it and who we share it with, and get a copy.
Correct: ask us to fix information that's inaccurate.
Delete: ask us to delete your information. We may keep some records where the law requires it, such as tax records or product-reaction records.
Portability: get your information in a format you can take elsewhere.
Opt out: of selling, sharing and targeted advertising (see above), and of profiling that has legal or similarly significant effects. We don't do that kind of profiling.
Fair and equal service: we won't charge you a different price or serve you differently for using your rights.

How to make a request: email support@tryprotokode.com with the subject "Privacy request".

We'll ask you to confirm your request from the email address on your orders, or to give us details that match our records, so we can verify it's you. Opt-out requests don't need verification. We respond within 45 days. If we need more time, we'll tell you why and take up to 45 more days.

Authorized agents. You can ask someone to make a request for you. We'll ask for your signed permission and may ask you to confirm your identity directly with us.

Appeals. If we decline your request, you can appeal by replying with the subject "Privacy appeal". We'll answer within 45 days and explain our decision. If you're not satisfied, you can contact your state Attorney General.

California "Shine the Light". We don't share personal information with third parties for their own direct marketing.

Nevada residents. We don't sell covered information as Nevada law defines it. You can still send an opt-out request to support@tryprotokode.com.

Consumer health data (Washington, Nevada and Connecticut). See our Consumer Health Data Privacy Policy for how we handle health information and how to make a request with the subject "Consumer health data request".

Personal information we collected in the past 12 months

Identifiers (name, email, phone, address, IP address, order number). Source: you and your device. Used for orders, support, emails and ads. Shared with service providers, carriers and, unless you opt out, advertising partners.
Customer records (billing and shipping address, limited payment details). Source: you and payment providers. Used for orders, refunds and fraud checks. Shared with service providers and payment providers.
Commercial information (products bought, order history). Source: you. Used for orders, emails and ads. Shared with service providers and, unless you opt out, advertising partners.
Internet activity (pages viewed, clicks, session recordings, email opens). Source: your device. Used to improve the site, for emails and for ads. Shared with analytics and advertising partners, unless you opt out.
Approximate location (city or state from your IP address). Source: your device. Used for shipping, fraud checks and analytics. Shared with service providers and analytics partners.
Audio and visual (photos you send about a damaged, wrong or missing item, or add to a review). Source: you. Used to review your report or your review. Shared with our service providers.
Sensitive information (health details in a reaction report). Source: you. Used for support, product safety and legal reporting. Shared with our service providers and, where required, the FDA.
Inferences (interests based on your activity on our site). Source: our analytics. Used for emails and ads. Shared with advertising partners, unless you opt out.

How long we keep information

Orders, payments and refunds: 7 years, for tax and accounting.
Reaction reports: 6 years, as cosmetics law requires.
Support messages and photos: 3 years.
Email subscriber data: until you unsubscribe, then we keep a do-not-contact record so we honor your choice.
Analytics data: up to 14 months.
Session recordings: about 30 days, unless we save a specific recording to fix a problem on our site.

How we protect your information

We use trusted providers, encrypted connections (HTTPS), access controls and two-step sign-in on our business accounts. Only people who need your information to do their job can see it. No system is perfectly secure, so please contact us right away if you think something is wrong.

Where your information is handled

Our store and most of our service providers are in the United States. Some of our team and service providers may access information from outside the United States. Wherever it's handled, we protect it as this policy describes.

Children

Our products are for adults. You must be 18 or older to buy from us. We don't knowingly collect personal information from children under 13. If you think a child has given us information, email us and we'll delete it.

Changes to this policy

We may update this policy. We'll change the date at the top and, for important changes, tell you by email or with a notice on our site.

Contact us

Email support@tryprotokode.com (subject "Privacy request"), or write to MMMK Vista LLC, 1914 Thomes Ave Ste 2 #3430, Cheyenne, WY 82001, United States.