Legal
Privacy
What we collect, who touches it, how long it stays, and how to make us delete it.
In short
Four numbers, before the eight sections
Each one is set out with its conditions further down.
5
Service providers
The providers that handle data for the live shop are named below.
30
Days per account session
The server-side session period renews when your account session is refreshed.
10
Minutes for sign-in data
Temporary sign-in information expires after ten minutes.
1
Month to answer you
Access, correction, deletion, portability. It costs you nothing.
What this site does today
This site provides shopping and, when enabled, customer accounts. It carries no advertising. Account access uses one necessary session cookie; visit measurement remains cookieless. The cookie notice explains the browser and server-side storage involved.
If you write to info@shilajatu.com, that email sits in an inbox read by one person and is used to answer you.
Who is responsible
The controller is Nico Jaroszewski, Schlosstalstrasse 202, 8408 Winterthur, Switzerland, trading as Shilajatu. Questions about data go to info@shilajatu.com and are answered by a person, not a ticket queue.
What we collect and why
To provide your account and saved products. Shopify supplies the customer identity and stores the product handles saved to your customer record. Our hosting provider holds the server-side account session for up to 30 days per renewed session period, and temporary sign-in information for up to ten minutes. The legal basis is performance of the account service you request.
To send you an order. Your name, delivery address, email address and, if you give one, a phone number for the carrier. The legal basis is performance of the contract. Without this there is no order.
To take the money. The payment provider handles the card details. We see the amount, the currency, the last four digits and whether it worked. Legal basis: performance of the contract.
To keep the books. The invoice and the order record, because tax law says to. Legal basis: a legal obligation.
To answer you. Whatever you put in an email or the contact form. Legal basis: our legitimate interest in replying to someone who wrote to us, or the contract if you are asking about an order.
To record Newsletter interest. Your email address, optional name, the date, source page and wording version are stored in Cloudflare D1. The form sends no email and creates no Shopify account. Legal basis: your consent, which you can withdraw by writing to us.
To keep the site up. Server logs with the IP address, the page requested and the time. Legal basis: our legitimate interest in a site that works and is not being attacked.
To count visits. Which page was asked for, what kind of page it is, the language, whether the device is a phone, a tablet or a computer, the country your network reports, and the site that sent you if there was one. This is our own measurement on our own domain: no cookie, nothing stored on your device, and no IP address retained in the analytics dataset. Your IP, browser string and language header are combined with a secret that changes at midnight and turned into a short one way hash, which counts you once a day and cannot be linked to yesterday, to an order, or to anything else here. Legal basis: our legitimate interest in knowing which pages are read. Global Privacy Control is honoured: a visit that sends it is counted in the total with no visitor value at all.
We do not profile you, we do not sell anything to anybody, and there is no automated decision making with legal effects for you. We ask for no special category data and you should not send us any.
Who processes it for us
These providers handle personal data to operate the live shop. Shopify and Cloudflare publish the data-processing terms incorporated into their services. Google provides the existing contact inbox under its consumer privacy terms.
- Shopify
- Runs checkout and customer accounts and holds order, payment-status, delivery and account records.
- Pure Shilajit UK
- Supplies the products and receives delivery details when it dispatches an order directly.
- Delivery carrier
- Receives the details needed to deliver and provide delivery updates.
- Cloudflare
- Hosts and protects the site and stores account sessions, newsletter interest and limited site analytics.
- Provides the existing email inbox used to receive and answer messages sent to our contact address.
Where the data goes
Shopify, Cloudflare and Google operate internationally, so personal data may be processed outside Switzerland or your country. Shopify's Data Processing Addendum and Cloudflare's Data Processing Addendum describe their transfer safeguards. Google applies the safeguards stated in its consumer privacy terms to the existing contact inbox. Pure Shilajit UK and delivery carriers receive the information needed to supply or deliver an order.
How long we keep it
- Order and invoice records: for the period required for accounting, tax, disputes and legal obligations.
- Delivery information at the supplier and carrier: retained for fulfilment and each recipient's applicable operational and legal retention period.
- Emails you send us: while needed to answer or manage the matter, then deleted unless a legal obligation or dispute requires longer retention.
- Newsletter interest: until you ask us to delete it. This includes the address, optional name, date, source page and wording version.
- Security and service logs: for the period available in the relevant Cloudflare service and as needed to protect and operate the site.
- Account session: up to 30 days per session period, renewed when the account session is refreshed.
- Temporary sign-in information: up to ten minutes.
- Saved product handles in your Shopify customer record: until you remove them or ask us to delete them.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing based on legitimate interest, and ask for your data in a portable file. Where processing rests on consent you can withdraw it at any time.
Write to info@shilajatu.com. We answer within one month and it costs you nothing. We may ask a question to confirm it is really you, and that question will never be more intrusive than the data you are asking about. Deleting an order record is the one request we can partly refuse, because tax law makes us keep it, and if that happens we say which record and for how long.
How to complain
Tell us first, because we can usually fix it faster. If that does not satisfy you, you can complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner, and if you live in the EU or the UK, the authority for the country you live in. You do not need our permission and you do not have to tell us you are doing it.
The questions everyone asks
What is shilajit, actually?
A dark resin that seeps out of rock at altitude in the Himalaya, made of plant matter pressed and broken down over a very long time. What comes off the rock is not the product. Shodhana, the purification step, is what separates the resin from everything it was sitting in, and that is the step worth asking a seller about.
Why does fulvic acid matter?
Fulvic acid is a carrier molecule. It binds trace minerals and is studied as a way of getting them across a cell membrane, which is why the interesting question about a mineral is not how much is in the jar but how much of it arrives. That is the mechanism the research is built on. It is a line of study, not a settled fact, and nobody should sell it to you as one.
How much do I take, and when would I notice anything?
A rice-grain portion, dissolved in warm water or under the tongue, once a day. A 30g jar lasts two to three months at that dose. Shilajit is not a stimulant and nothing here works like one, so the honest unit of time is a month rather than an afternoon. If you want the caffeine experience this will disappoint you.
Resin or capsules?
The range includes resin and six distinct capsule formulas in vegan HPMC shells. Ingredient amounts are listed for each product rather than reduced to one formula for the whole range. One caution: the Sea Moss and Bladderwrack blend contains iodine, so if you have Hashimoto’s or any diagnosed thyroid condition, take that one to your doctor rather than to the checkout.
Where does it come from, and how do I know it is clean?
Our products come from the white-label range offered by established UK supplier Pure Shilajit UK. The supplier describes its resin as Himalayan-sourced. Certificate of Analysis 63849 from Alex Stewart Agriculture, Liverpool (ISO 17025 accredited analyses) covers the February 2026 resin batch: arsenic 0.02, cadmium under 0.2, lead 0.44 and mercury 0.03 mg/kg. It covers the resin only; the capsules are not independently tested.
Do you ship outside Europe?
We ship worldwide, with one exception: not to the United States. Orders to the United Kingdom pay GBP 7.00, free for orders of GBP 140 or more. Switzerland and Europe pay CHF 6.90, free from CHF 150; every other country CHF 14.90, free from CHF 200, converted at checkout.
