Privacy Policy
We collect your data to ship your supplements and calculate your performance plans. We use Google Cloud / Firebase for secure storage and Stripe for encrypted payments. If you choose to connect Strava, we receive only the training-activity data needed to compute your measured sweat rate. We share limited purchase information with Google and Meta so we can measure our ads (Section 4C). We do not sell your data. You can disconnect, delete, or opt-out at any time.
PRIVACY STATEMENT
Last updated: September 29, 2026
Notice at Collection
SECTION 1 - WHAT DO WE DO WITH YOUR INFORMATION?
When you purchase something from our store, as part of the buying and selling process, we collect the personal information you give us such as your name, address and email address.
When you browse our store, we also automatically receive your computer’s internet protocol (IP) address in order to provide us with information that helps us learn about your browser and operating system.
SECTION 2 - CONSENT
How do you get my consent?
When you provide us with personal information to complete a transaction, verify your credit card, place an order, arrange for a delivery or return a purchase, we imply that you consent to our collecting it and using it for that specific reason only.
If we ask for your personal information for a secondary reason, like marketing, we will either ask you directly for your expressed consent, or provide you with an opportunity to say no.
How do I withdraw my consent?
If after you opt-in, you change your mind, you may withdraw your consent for us to contact you, for the continued collection, use or disclosure of your information, at anytime, by contacting us at support@beetrootpro.com.
SECTION 3 - DISCLOSURE
We may disclose your personal information if we are required by law to do so or if you violate our Terms of Service.
We also share limited information with the analytics and advertising services described in Section 4C.
SECTION 4 - INFRASTRUCTURE & DATA STORAGE
Our platform is built on Google Cloud and Firebase. They provide us with the secure, high-performance hosting, database infrastructure, and authentication services that allow us to deliver your performance plans and manage your orders.
Your data is stored within encrypted Firebase Firestore instances and authenticated via Firebase Auth. These services utilize industry-standard security protocols, including encryption-at-rest and multi-region redundancy.
Payment Processing:
Payment transactions are processed via Stripe. We do not store your raw credit card data on our servers. Stripe is PCI-DSS Level 1 certified and handles all card-data encryption. Your purchase transaction data is stored by Stripe only as long as is necessary to complete your purchase transaction and meet legal/audit retention obligations.
SECTION 4A - THIRD-PARTY DATA INTEGRATIONS
Race Lab Pro features can optionally connect to third-party fitness platforms to derive a measured sweat rate from your real training data. Connection is always opt-in, you can disconnect at any time, and we never post anything back to these platforms.
Strava (live)
When you click Connect with Strava, you authorize Beetroot Pro to read the following data from your Strava account via the Strava API v3:
- Your public and private profile information (name, sex, weight, FTP) under the
profile:read_allscope - Your activity history including private activities (distance, duration, heart rate, power, temperature, cadence, calories, GPS metadata) under the
activity:read_allscope
We use this data exclusively to (a) infer your per-session sweat rate from each activity's actual temperature and intensity, and (b) compute an aggregated measured sweat rate that pre-fills the Race Lab Pro sodium calculator. We do not share Strava data with other athletes, do not display it publicly, and do not use it for marketing or advertising.
Retention: activity data is purged within 24 hours of disconnection. If you click Disconnect Strava on /account/strava, we (1) call Strava's deauthorization endpoint to revoke our access tokens, (2) mark your local connection as disconnected, and (3) clear the activity subcollection on a scheduled basis. Disconnect also fires automatically if you revoke access from within Strava's settings.
Strava is identified as a sub-processor in this policy. Your Strava data remains subject to Strava's own privacy policy at strava.com/legal/privacy.
Garmin (planned)
We are evaluating a Garmin Connect integration that would provide the same measured-sweat-rate inference for athletes who train with Garmin devices but do not sync to Strava. If we ship Garmin Connect support, the same opt-in, opt-out, and retention rules will apply. This policy will be updated and you will receive an email notification before any Garmin data is ingested.
If you are a coach using the Race Lab Coach tier, your athletes grant you read-only access via an explicit consent screen. You see the same aggregated sweat rate, race plans, and post-race feedback they see; you do not see raw activity-level data. Athletes can revoke your access at any time from their /account/coaches page; revocation takes effect immediately.
SECTION 4B - ANONYMOUS PRODUCT ANALYTICS
We measure how our free Performance Lab tools (the sodium, carb, pacing, recovery, and related calculators) are used so we can improve them. When a tool generates a plan, we record an anonymous usage event containing only the tool name, a few non-identifying choices you made in the tool (such as event type or climate), and a timestamp.
This usage log is deliberately free of personal information: it does not include your name, email address, IP address, or any cookie or device identifier, and it is never linked back to your account or shared with third parties. Because it is anonymous, aggregate, first-party measurement and sets no cookies, it is collected on the basis of our legitimate interest in improving our products and does not depend on your cookie-consent choice.
Cookie-based analytics and advertising are separate from this anonymous log and are described in Section 4C.
SECTION 4C - COOKIES, ANALYTICS & ADVERTISING
Our cookie banner offers two choices, Essential Only and Accept All. This section lists every analytics and advertising service on this site and whether your choice controls it.
Only if you choose Accept All
- Google Analytics: the pages you visit and the actions you take on our site, using cookies, with your IP address anonymized.
- Microsoft Clarity: how visitors use our pages, such as clicks, scrolling and mouse movement, so we can find the parts of the site that are broken or confusing.
- Meta Pixel: the pages you visit and shopping actions such as adding to cart and purchasing, sent to Meta to measure our Facebook and Instagram ads.
Choosing Essential Only stops all three. To change your choice later, clear this site's cookies and site data in your browser settings and the banner will appear again.
Regardless of your cookie choice
- Google Ads: our Google Ads tag runs on every page. It sets Google advertising cookies and tells Google which of our pages you visited, so we can measure which ad clicks lead to purchases and show our ads to people who have visited our site. When you complete an order, it also sends Google the order number, amount and currency.
- Purchase record in Google Analytics: when you complete an order, our server records the order number, the products and the amount. This record contains no name, email address or other contact details.
- Purchase record for Meta: when you complete an order, our server sends Meta the order amount and products, together with a hashed version of the email address, phone number, name, city, state, ZIP code and country on the order, your IP address, and Meta's own browser identifiers if your browser holds them. Meta uses this to connect the purchase to an ad you saw or clicked on Facebook or Instagram.
- Ahrefs Web Analytics: counts page visits without setting any cookies.
We may also send Google a hashed version of the email address and phone number on your order, so it can connect the purchase to a Google ad you clicked in the same way.
What "hashed" means: before it leaves our server, each value is converted into a one-way code. Google and Meta compare that code with codes generated from their own account records to find a match.
Google Customer Reviews: after you place an order, our order confirmation page may show an invitation from Google Customer Reviews. If you accept it, Google emails you a short survey about your purchase after the estimated delivery date, and your rating may appear with our store on Google. To show the invitation, the page gives Google's service your order number, the email address on the order, the destination country and the estimated delivery date. Google receives these when the invitation appears, before you choose, and this does not depend on your cookie choice. If you decline, Google does not send you the survey. Google handles survey responses under the Google Privacy Policy.
We never share your payment card details with any analytics or advertising service. Stripe processes every payment, and we never receive your full card number.
You can control how Google and Meta use your information for advertising in Google's My Ad Center and in the Ad Preferences section of your Facebook or Instagram account settings.
SECTION 5 - YOUR 2026 PRIVACY RIGHTS (CCPA/GDPR/VCDPA)
As of 2026, you have the following expanded rights regarding your personal information:
- Right to Know & Access: You may request a report of all data collected since January 1, 2022.
- Right to Deletion: You may request that we purge all non-transactional data from our systems.
- Right to Opt-Out of ADMT: You may opt-out of "Automated Decision-Making Technology" used for performance plan generation or personalized pricing.
- Right to Correction: You may correct inaccurate physiological data in your profile.
To exercise these rights, please email support@beetrootpro.com with the subject line "Data Rights Request."
SECTION 6 - SECURITY
To protect your personal information, we take reasonable precautions and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered or destroyed.
All sensitive data is encrypted using 256-bit AES encryption and transmitted via TLS 1.3 secure socket layers.
SECTION 7 - AGE OF CONSENT & RESTRICTIONS
By using this site, you represent that you are at least the age of majority in your state or province of residence. Furthermore, as per 2026 regulations in specific jurisdictions (including NY, NJ, and MI), you must be 18 years or older to purchase products marketed for athletic performance or muscle building.
QUESTIONS AND CONTACT INFORMATION
If you would like to: access, correct, amend or delete any personal information we have about you, register a complaint, or simply want more information contact our Privacy Compliance Officer at support@beetrootpro.com or by mail:
[Re: Privacy Compliance Officer]
829 W 25 N Clearfield UT 84015