Privacy Policy
Last Updated and Effective: July 23, 2026
1. Introduction and Scope. This Privacy Policy ("Policy") describes the manner in which Powered by Hercules ("Powered by Hercules," the "Company," "we," "us," or "our") collects, receives, records, organizes, structures, stores, adapts, retrieves, consults, uses, discloses, transmits, disseminates, restricts, erases, and otherwise Processes Personal Information (as defined herein) relating to any natural person ("you," "your," a "Data Subject," or a "Consumer") who accesses, browses, registers with, transacts upon, or otherwise interacts with the website located at poweredbyhercules.com, together with any associated subdomains, checkout flows, application programming interfaces, and services (collectively, the "Site" or "Services"). This Policy is incorporated by reference into, and forms an integral part of, our Terms of Service and constitutes a legally binding instrument. By accessing the Site, submitting information, or completing a transaction, you acknowledge that you have read, understood, and, to the fullest extent permitted by applicable law, consented to the practices described herein. If you do not agree with any provision of this Policy, you must immediately discontinue all use of the Site.
2. Definitions and Interpretive Framework. Capitalized terms not otherwise defined herein shall bear the meanings ascribed to them under applicable data-protection legislation, including without limitation the EU General Data Protection Regulation 2016/679 ("GDPR"), the United Kingdom GDPR and the Data Protection Act 2018, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA/CPRA"), and analogous supranational, federal, and state frameworks. "Personal Information" or "Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation or set of operations performed upon Personal Information, whether or not by automated means. "Controller" means the entity that, alone or jointly, determines the purposes and means of Processing; "Processor" and "Sub-processor" denote entities that Process Personal Information on the Controller's behalf. A "Verifiable Consumer Request" or "Data Subject Access Request" ("DSAR") means a request by which a Data Subject seeks to exercise statutory rights. Headings are inserted for convenience only and shall not affect interpretation.
3. Categories of Personal Information Collected. Consistent with the enumerated statutory categories, we may collect: (a) identifiers and contact data, such as name, postal and billing address, email address, and telephone number; (b) commercial and transactional data, such as products viewed, added to cart, purchased, returned, or considered, order history, and fulfillment records; (c) financial and payment data, limited to tokenized transaction references, billing postal code, and the outcome of payment authorization, it being understood that full primary account numbers are not retained upon our systems; (d) internet and network-activity information, including Internet Protocol (IP) address, device and browser type, operating system, unique device identifiers, referring and exit pages, clickstream data, session duration, and interaction telemetry; (e) approximate geolocation derived from IP address; and (f) inferences drawn from the foregoing to create a profile reflecting preferences, characteristics, and behavior. We do not knowingly collect "special category" or "sensitive" Personal Information as those terms are statutorily defined.
4. Sources of Collection. Personal Information is obtained (i) directly from you when voluntarily submitted at the point of registration, checkout, subscription, survey, or correspondence; (ii) automatically as you navigate the Site through cookies, log files, web beacons, clear GIFs, tags, software development kits, and pixels; and (iii) indirectly from our vendors, payment intermediaries, advertising and analytics partners, and fraud-prevention providers, in each case to the extent permitted by applicable law.
5. Purposes of Processing. We Process Personal Information to: administer, operate, secure, optimize, and maintain the Site; establish and perform our contract with you; accept, authenticate, authorize, process, fulfill, ship, invoice, and service your orders; deliver transactional communications including order and shipping confirmations; furnish customer support and adjudicate returns, refunds, disputes, and chargebacks; detect, investigate, mitigate, and prevent fraudulent, unauthorized, malicious, or unlawful activity; conduct analytics, market research, and product development; deliver, personalize, and measure marketing and advertising subject to consent where required; and discharge legal, regulatory, tax, accounting, and record-keeping obligations.
6. Lawful Bases for Processing. Where the GDPR or UK GDPR applies, we rely upon one or more of the following lawful bases: (a) the necessity of Processing for the performance of a contract to which you are party or to take pre-contractual steps at your request; (b) compliance with a legal obligation to which we are subject; (c) our legitimate interests or those of a third party, save where overridden by your interests or fundamental rights and freedoms, including our interests in operating a secure and commercially viable enterprise and in preventing fraud; and (d) your freely given, specific, informed, and unambiguous consent, which you may withdraw at any time without affecting the lawfulness of prior Processing.
7. Cookies, Pixels, and Similar Tracking Technologies. We and our authorized third parties deploy strictly necessary, performance, functional, and targeting cookies and comparable technologies to persist cart state, remember preferences, measure aggregate traffic, and facilitate interest-based advertising. You may exercise granular control over non-essential technologies through your browser configuration, device settings, or any consent-management interface presented on the Site; however, the disablement of certain technologies may materially impair Site functionality. Owing to the absence of a uniform industry standard, we do not presently respond to browser "Do Not Track" signals, though we will honor recognized opt-out preference signals to the extent legally required.
8. Interest-Based Advertising and Your Choices. We may permit advertising partners, including Meta Platforms, Inc. (Facebook and Instagram) and Google LLC, to collect information via cookies and pixels in order to serve and measure advertisements reasonably tailored to your inferred interests. You may opt out of participating vendors through the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org), and may adjust ad-personalization controls directly within your Meta and Google account settings.
9. Disclosures to Recipients and Sub-processors. We do not sell your Personal Information for monetary consideration. In furtherance of the purposes enumerated above, we may disclose Personal Information to categories of recipients including: e-commerce platform and hosting providers (such as Shopify, Inc.); payment processors and financial intermediaries; logistics, shipping, and fulfillment partners; electronic-communications, help-desk, and analytics providers; advertising networks; and professional advisers, insurers, auditors, and regulators. We may further disclose Personal Information where reasonably necessary to comply with law, respond to lawful process, enforce our agreements, or protect the rights, property, or safety of the Company, our users, or the public, and in connection with any merger, acquisition, reorganization, financing, insolvency, or sale of assets, in which event Personal Information may be transferred as a business asset. The controller responsible for the Processing described in this Policy is Powered by Hercules, whose registered mailing address is 30 N Gould St, Ste R, Sheridan, WY 82801, United States, and which may be reached by telephone at (972) 736-4572; all data-related correspondence, however, should be directed to the electronic address specified in Section 16 below to ensure timely handling.
10. International Transfers. The Company is established in the United States, and Personal Information may be transferred to, stored within, and Processed in the United States and other jurisdictions in which we or our Sub-processors maintain operations, which jurisdictions may afford levels of data protection differing from those of your jurisdiction of residence. Where such transfers are subject to statutory restriction, we implement appropriate safeguards, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or reliance upon a recognized adequacy determination.
11. Data Retention. We retain Personal Information for such period as is necessary to satisfy the purposes for which it was collected, including the maintenance of transactional and order records, the substantiation of tax and accounting positions, the resolution of disputes, the prevention of fraud, and compliance with our legal and regulatory obligations, after which Personal Information is securely deleted, destroyed, de-identified, or anonymized in accordance with our retention schedule.
12. Information Security. We implement and maintain administrative, technical, organizational, and physical safeguards designed to protect the confidentiality, integrity, and availability of Personal Information, including encryption in transit via Transport Layer Security (TLS/SSL) and access controls calibrated to the principle of least privilege. Notwithstanding the foregoing, no method of transmission over the Internet or method of electronic storage is impervious to compromise, and we therefore cannot and do not warrant absolute security. In the event of a Personal Data breach presenting a risk to your rights, we will provide notification in the manner and within the timeframes prescribed by applicable law.
13. Your Rights as a Data Subject. Subject to and in accordance with applicable law, you may possess the rights to: request access to and a copy of your Personal Information; obtain rectification of inaccurate or incomplete data; request erasure ("right to be forgotten"); restrict or object to certain Processing, including Processing predicated upon legitimate interests or undertaken for direct-marketing purposes; obtain data portability; and withdraw previously granted consent. You further have the right not to be subject to a decision producing legal or similarly significant effects that is based solely upon automated Processing, including profiling, absent a lawful basis. We will respond to verified requests within the period mandated by applicable law and reserve the right to undertake reasonable identity-verification measures prior to fulfillment.
14. California Privacy Disclosures. If you are a California resident, the CCPA/CPRA affords you the rights to know the categories and specific pieces of Personal Information collected, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom information is disclosed; to request deletion and correction; and to opt out of any "sale" or "sharing" of Personal Information and of the use of "sensitive" Personal Information for purposes beyond those permitted. We do not sell or share Personal Information as those terms are defined by the CCPA/CPRA and have not done so in the preceding twelve (12) months. You may designate an authorized agent to submit requests on your behalf, and we will not discriminate or retaliate against you for exercising any right. Residents of other U.S. states, including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon, may possess analogous rights under their respective statutes.
15. Children's Privacy. The Site is directed to and intended for adults and is not directed to children. We do not knowingly collect, solicit, or Process Personal Information from any individual under the age of sixteen (16), nor, within the meaning of the Children's Online Privacy Protection Act, from any child under thirteen (13). Should we become aware that Personal Information has been collected from such an individual, we will take commercially reasonable steps to delete it without undue delay.
16. How to Contact Us and Lodge Complaints. All questions, requests to exercise statutory rights, and complaints regarding this Policy or our data-Processing practices should be directed by electronic mail to help@poweredbyhercules.com, which is our designated channel for privacy correspondence and is monitored for such purposes. We will endeavor to acknowledge and resolve all inquiries in a timely and conscientious manner. If you are located in the European Economic Area or the United Kingdom and remain dissatisfied following our response, you are entitled to lodge a complaint with your competent supervisory authority or data-protection regulator.
17. Third-Party Links and Services. The Site may contain hyperlinks to, or integrations with, third-party websites, plug-ins, and applications that we neither control nor operate. This Policy does not govern the practices of such third parties, and we disclaim responsibility for their content, security, and privacy practices. We encourage you to review the privacy notices of any third party before disclosing Personal Information.
18. Amendments and Governing Law. We reserve the right, in our sole discretion, to amend, modify, supplement, or restate this Policy at any time to reflect changes in our practices, technologies, legal requirements, or business operations. Revisions become effective upon posting of the updated Policy bearing a revised "Last Updated" date, and your continued use of the Site thereafter constitutes acceptance of the amended terms. This Policy shall be governed by and construed in accordance with the laws of the State in which the Company maintains its principal place of business, without regard to conflict-of-laws principles, save where mandatory provisions of your local law apply.