Privacy Policy

This Privacy Policy explains how Strong Back Nutrition Ltd (“Strong Back”, “we”, “us”, or “our”) collects, uses, stores, and shares personal data when you use our website, place orders, contact us, or message us on WhatsApp.

We process personal data in line with applicable privacy laws, including the Trinidad and Tobago Data Protection Act and, where it applies to you, the EU/UK General Data Protection Regulation (GDPR).

1. Who we are

Strong Back Nutrition Ltd
Product of Trinidad and Tobago
Phone: +1 868 706 4131
Website: www.strongbacknutrition.com

For privacy questions or requests, contact us by phone or via our Contact page.

2. Personal data we collect

Depending on how you interact with us, we may collect:

• Identity & contact data — name, email address, phone number, WhatsApp number, and delivery address.
• Account data — login credentials (passwords are stored in hashed form by our authentication provider), account preferences, and customer pricing tier.
• Order & transaction data — products ordered, quantities, delivery windows, payment method (e.g. card or cash on delivery), invoices, and order status.
• Payment data — card payments are processed by Stripe. We do not store full card numbers on our servers. Stripe may provide us with limited payment confirmation details (for example, last four digits or payment status).
• Communications — messages you send us by email, phone, website forms, or WhatsApp (including order commands and support requests).
• Technical data — IP address, browser type, device information, and basic usage logs needed to operate and secure the website.

3. How we collect data

• Directly from you when you register, place an order, update your profile, or contact us.
• Through WhatsApp when you message our business number to register, view the menu, or order.
• Automatically when you browse our site (cookies/session data needed for login, cart, and security).
• From payment providers (Stripe) when you complete a card checkout.

4. Why we use your data (purposes & legal bases)

We use personal data for the following purposes:

• To provide our services — create accounts, process orders, arrange delivery, issue invoices, and respond on WhatsApp or by phone (contract / steps prior to contract).
• To take payment — process card payments via Stripe or record cash-on-delivery orders (contract / legitimate interests).
• Customer support — answer questions and resolve order issues (contract / legitimate interests).
• Security & fraud prevention — protect accounts, systems, and payments (legitimate interests / legal obligation where applicable).
• Legal & accounting — keep records required for tax, accounting, and dispute resolution (legal obligation / legitimate interests).
• Service improvement — understand how the storefront is used in aggregate so we can improve reliability and experience (legitimate interests).

Where we rely on consent (for example, optional marketing messages), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

5. WhatsApp messaging

If you message our WhatsApp Business number, Meta Platforms (WhatsApp) processes the message content and metadata under Meta’s terms and privacy policy. We receive your WhatsApp number and message content so we can identify your customer account (where matched), show product information, and place or update orders on your behalf.

You can stop WhatsApp ordering at any time by simply not messaging us, or by asking us to unlink / close your account through our support channels.

6. Who we share data with

We share personal data only as needed to run the business, including with:

• Infrastructure & hosting — e.g. Vercel (website hosting).
• Database & authentication — Supabase (account and order storage).
• Payments — Stripe (card processing).
• Messaging — Meta / WhatsApp (when you contact us on WhatsApp).
• Professional advisers & authorities — where required by law, or to establish, exercise, or defend legal claims.

We do not sell your personal data.

7. International transfers

Some providers (for example hosting, database, payments, or messaging platforms) may process data outside Trinidad and Tobago, including in the United States or the European Economic Area. Where required, we rely on appropriate safeguards such as the provider’s contractual commitments and standard contractual clauses or equivalent transfer mechanisms.

8. How long we keep data

We keep personal data only as long as needed for the purposes above. Typical retention includes:

• Account and profile data — while your account remains active, and for a reasonable period afterward.
• Order, invoice, and payment records — for the period required by tax and accounting rules.
• WhatsApp conversation state used for ordering — for a limited operational period, then deleted or overwritten.
• Security logs — for a limited period needed to investigate incidents.

9. Your rights

Depending on applicable law (including GDPR where it applies), you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”), subject to legal retention duties
• Restrict or object to certain processing
• Receive a copy of data you provided in a portable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with a competent data protection authority

To exercise these rights, contact us using the details in section 1. We may need to verify your identity before fulfilling a request.

10. Cookies and similar technologies

We use essential cookies and similar technologies for authentication, shopping cart, and security. These are required for the site to function. We do not use them to sell advertising profiles.

11. Children

Our services are directed to businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

12. Security

We use technical and organisational measures appropriate to the risk, including encrypted transport (HTTPS), access controls, and trusted processors for authentication and payments. No method of transmission or storage is completely secure; we work to protect your data but cannot guarantee absolute security.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of our services after an update means you acknowledge the revised policy.

14. Contact

Questions about this policy or your personal data: +1 868 706 4131 · Contact page