Privacy & Cookie Policy

Who is responsible

Vitasor is operated independently from Hong Kong. For privacy questions or rights requests, contact privacy@vitasor.com. Vitasor currently publishes an email contact only and does not publish a postal correspondence address.

This policy applies to the Vitasor web and mobile-web experiences. It does not cover a merchant, affiliate network, or other third-party website reached through an external link.

Information we process

Vitasor currently does not offer user accounts and does not intentionally maintain a server-side profile containing your health history. Information may nevertheless be processed when needed to deliver a feature.

This may include technical request data such as IP address, browser or device type, requested URL, timestamps, security signals, and a 30-day surface-preference cookie; analytics consent stored in your browser; coarse, consent-based usage events; search text sent to the search service; information you send by email; and temporary tool state stored in your browser when needed to complete a requested feature.

Do not include your name, address, phone number, account numbers, government identifiers, or other identifying details in free-text fields. Vitasor does not request payment-card information and does not receive a merchant's checkout details merely because you follow an affiliate link.

Purposes and legal bases

We process necessary technical data to deliver requested pages and features, maintain security, prevent abuse, and meet legal obligations. Where applicable, these activities rely on performance of the service you request, legitimate interests in operating a secure service, or legal obligations.

We process optional analytics only after you select Allow. In the EEA and UK, consent is the basis for optional analytics and may be withdrawn at any time through Cookie Preferences.

We do not use health answers, raw search text, or email addresses for advertising profiles. We do not sell personal information or consumer health data, and we do not share it for cross-context behavioural advertising.

Search, email, and affiliate links

Search text is sent in the body of a no-store request to the search service and is not included in analytics events. Vitasor does not intentionally save raw search text in its own application database, although infrastructure providers may create limited security or request logs.

Newsletter collection is currently disabled. If subscriptions are enabled later, the form will identify the email provider, explain the purpose and frequency, request any consent required by law, and provide an unsubscribe method before an address is accepted.

Affiliate measurement may process a product identifier, merchant or network label, CTA placement, and non-sensitive referral parameters. Vitasor prohibits putting health answers, search text, email addresses, or other identifying data into affiliate tracking parameters.

Cookies, local storage, and analytics

Strictly necessary storage may remember the selected site surface, preserve a short-lived tool handoff in the current tab, and record your analytics choice. Optional analytics does not initialise until you select Allow. You can decline or later change this choice through Cookie Preferences in the footer.

When allowed and configured, PostHog may receive page and feature events, approximate device or browser information, referral information, and coarse event properties. Vitasor blocks raw search text, health answers, names, and email addresses from analytics. Session recording and autocapture are disabled.

Browser controls can remove local storage and cookies, but removing the consent record may cause the consent prompt to appear again. Disabling necessary storage may affect surface selection or a tool session.

Service providers and international transfers

Information may be processed by hosting and delivery providers, the configured search/database provider, PostHog when analytics is allowed, and affiliate networks or merchants when you follow an external link. These organisations process data under their own contracts, locations, retention rules, and legal obligations.

Because Vitasor serves international readers and uses global infrastructure, information may be processed outside your country, including in the United States. Where required, we seek contractual and organisational safeguards from service providers, but no transfer mechanism can eliminate every jurisdictional risk.

The active processor list and product configuration must be reviewed before each production release. A provider is not represented as active merely because its software exists in the repository.

Retention and security

Vitasor retains only what is needed for the stated purpose. Analytics consent remains in your browser until changed or cleared. Temporary tool state is removed when the feature no longer needs it or when the browser tab session ends. Vitasor does not intentionally retain raw search text in its own database.

Provider security logs may be retained for the provider's documented security period. Rights-request correspondence is retained only as long as reasonably needed to answer the request, document compliance, resolve disputes, or meet legal obligations.

We use transport encryption, data minimisation, restricted event schemas, no-store response directives, and access controls available through our service providers. No online service is completely secure; if a qualifying incident occurs, Vitasor will investigate and provide legally required notices.

Your privacy choices and rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, withdrawal of consent, or information about processing by emailing privacy@vitasor.com. Describe the request and the Vitasor feature involved. We may need limited information to verify and respond to the request.

You may decline optional analytics without losing access to core content, clear temporary browser storage, and stop using a search or tool feature before submitting text. Exercising a privacy right will not result in unlawful discrimination.

EEA and UK residents may complain to their local data protection authority. Residents of applicable US states may have appeal or opt-out rights under local law. Because Vitasor does not sell data or use it for targeted advertising, there is currently no sale or targeted-advertising opt-out flow beyond analytics consent.

Children, changes, and contact

Vitasor is intended for adults and is not directed to children under 13. Users under the age of majority should use health features only with a parent, guardian, or qualified professional where appropriate. If you believe a child submitted personal information, contact us so we can assess and remove data under our control.

We will update the date on this page when this policy changes. If a change materially affects consent-based processing, we will provide an appropriate notice or seek a new choice before applying the change where required.

Questions and privacy requests: privacy@vitasor.com. Email is currently Vitasor's only published contact channel. Some jurisdictions may require additional operator or postal details; this limitation should be reviewed by qualified counsel before broad commercial launch.