Privacy Policy

NABUHA ("NABUHA," "we," "us," or "our") operates nabuha.com and the related community platform (together, the "Site"). This policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It applies to anyone who visits the Site, submits a form, creates an account, or otherwise interacts with NABUHA online.

NABUHA is a Bay Area community and wellness brand offering fragrances, custom garments, merch, workshops, and the Vibe and Thrive community gathering. We collect only what we need to run those offerings and to communicate with the people who reach out to us.

Information you give us directly. When you fill out a form on the Site, we collect what that form asks for:

• Contact form: your name, email address, organization or school (if applicable), your message, which inquiry type you selected, and which community updates you asked to receive.
• Sanctum Select application: your name, business or artist name, category, location, email, phone number, website and social links, a description of your work, your skills and specialties, and your history working with NABUHA.
• Join Our Team application:your name, email address, the areas you're interested in, portfolio or social links (if provided), your availability, and anything you share about what you're hoping to build or learn. Submitting this form also records your agreement to our confidentiality and non-disclosure terms and the date and time you agreed.
• Newsletter / list signup: your email address and, optionally, which topics you want updates on (Vibe and Thrive, product drops, workshops).
• Account creation:if you create an account on the Site, we collect your name, email address, and any profile information you choose to add during onboarding (such as how you heard about us, your general location, or what you're looking for).

Information collected automatically. When you browse the Site, we (and the analytics service we use) automatically collect:

• Pages viewed, links clicked, and how far you scroll on a page.
• General device and browser information (browser type, screen size, device type).
• Approximate location derived from IP address (city/region level, not precise geolocation).
• Referring website or search engine that brought you to the Site.

This automatic collection only happens if you accept analytics cookies through the consent banner, or if your browser does not send a Do Not Track signal. See Cookies and Analytics below.

• To respond to your inquiry, workshop request, Sanctum Select application, or Join Our Team application.
• To send you updates you've opted into (Vibe and Thrive announcements, product drops, workshop openings).
• To operate and improve the Site, including understanding which pages and features people actually use.
• To maintain your account, if you have one.
• To prevent spam, abuse, and fraudulent form submissions.
• To comply with legal obligations.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not use it to serve you targeted third-party advertising.

We do not sell your personal information. We share information only with the service providers that make the Site work, and only for the purpose of running that service:

• Web3Forms — processes and relays form submissions (contact form, Sanctum Select applications, Join Our Team applications, list signups) to our inbox.
• Clerk — manages account creation, sign-in, and authentication if you create an account.
• PostHog— provides the analytics described above, only if you've consented to analytics cookies.
• Vercel — hosts the Site and processes standard server logs (IP address, request timestamps) required to serve web pages.

We may also disclose information if required by law, to protect NABUHA's legal rights, or in connection with a merger, acquisition, or sale of assets (in which case we'll notify you before your information becomes subject to a different privacy policy).

The Site uses two categories of cookies and similar technologies:

• Strictly necessary: used to keep you signed in and to protect the Site from abuse. These are required for the Site to function and are not subject to the consent banner.
• Analytics: used by PostHog to understand how visitors use the Site (pages viewed, scroll depth, clicks). These only load after you accept them in the cookie banner shown on your first visit. You can decline them, and no analytics cookies will be set.

Do Not Track. If your browser sends a Do Not Track (DNT) signal, we honor it automatically: analytics do not load and you will not be shown the cookie banner. We do not currently respond to Global Privacy Control (GPC) signals differently than DNT, since our treatment is the same either way (no tracking without affirmative consent).

You can change your analytics preference at any time by clearing your browser's local storage for this Site and reloading the page, which will show the consent banner again.

• Form submissions (contact, Sanctum Select, list signups): retained for up to 2 years, or until you ask us to delete them.
• Account information: retained until you delete your account or request removal.
• Analytics data: retained by PostHog for up to 1 year.

Regardless of where you live, you can ask us at any time to:

• Tell you what personal information we have about you.
• Correct inaccurate information.
• Delete your personal information.
• Stop sending you marketing emails (every marketing email includes an unsubscribe link).
• Withdraw analytics consent (decline or clear the cookie banner as described above).

To exercise any of these rights, email us at sanctum@nabuha.com. We'll respond within 45 days. We won't discriminate against you, charge you more, or provide a lower level of service for exercising these rights.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Online Privacy Protection Act (CalOPPA) give you these rights specifically with respect to businesses operating in California, and we honor them for every visitor regardless of residency or NABUHA's size. We do not sell or share personal information for cross-context behavioral advertising, so there is no "Do Not Sell or Share My Personal Information" opt-out required beyond the analytics consent choice already described above.

The Site is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13 through the Site's forms or account creation. If NABUHA runs a workshop at a school where students under 13 are present, any information collection for that workshop happens through the school directly under a separate agreement, not through this Site, and is limited to what's necessary for the educational activity.

If you believe a child under 13 has provided us personal information through the Site, contact us at sanctum@nabuha.com and we'll delete it.

We use industry-standard measures to protect your information, including encrypted connections (HTTPS/TLS), security headers, rate limiting on form submissions, and access controls on our hosting and authentication providers. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

We may update this policy as the Site or our practices change. We'll update the effective date at the top of this page when we do. If a change is significant, we'll note it prominently on the Site or notify account holders directly.

Questions about this policy or your personal information? Email sanctum@nabuha.com. NABUHA is based in Union City, CA.