Privacy Policy

Last Updated: 24/08/2026 

This Privacy Policy (the “Policy”) governs your use of habitone.co (the “Website”). This Privacy Policy explains how we collect, use, and protect your personal information when you visit our Website, purchase our Products, or interact with us in other ways. It also describes certain legal rights you may have, subject to applicable law, and how you can exercise them.

By accessing, using the Website, submitting your personal information to us, or otherwise interacting with HabitONE you agree to any processing and transfer of your personal information in accordance with this Policy. Please be sure to carefully read the entirety of this Policy.

For the purposes of this Policy, “personal information” and/or “personal data” refers to data about identified or identifiable individuals (such as their name, mobile phone number, email address, etc.); it may also include, where required by applicable law, the scope of the definition provided therein, e.g., as per the relevant U.S. federal or state legislation.

Check HabitONE Terms of Use & Service (the “Terms”) for the meaning of defined words (those with capital letters) not explicitly defined in the Policy.

1. Personal data controller

The following companies act as controllers of your personal data, each in respect of the processing activities attributed to it below:

1.1. Alovira Corp, with registered office at 3753 Howard Hughes Parkway, Suite 200, Las Vegas, NV 89169, United States — controller of personal data processed for orders, payments, subscriptions, fulfillment, shipping, returns, refunds and chargebacks, and for related tax and record-keeping obligations.

1.2. Monzima Limited, with a registered office at Georgiou A, 83, Shop 17, Germasogeia, Limassol, 4047, Cyprus — controller of personal data processed in connection with your use of the Website and your account, marketing communications, and cookies, analytics and advertising technologies.

Each company determines the purposes and means of the processing attributed to it and acts as a separate and independent controller.

2. What categories of personal data do we collect?

We collect data you make available to us voluntarily (for example, email address, phone number, name, date of birth). We also collect data automatically when you use the Website (for example, your IP address, device type) and data from third parties.

2.1. Data you provide to us

You provide us data about yourself when you register for and/or use the Website, for example, when you create a user profile (“Profile”), respond to our emails, or report a problem. The data that you provide to us includes:

Profile data and other materials you post on the Website. This includes your name, username, date of birth, email address, shipping address and phone number. You may also provide us picture image (in any content you upload) and additional data on your Profile. 

Additional data may include, but is not limited to: your gender and age, other personal characteristics and demographic data, any ideas, comments, testimonials you share and post, health preferences, dietary needs, as well as images, photographs, and videos. By providing this information you agree and understand that this data may be publicly available (unless otherwise explicitly stated in a particular case). Please do not provide personal data to your profile that you would not want to be publicly available. 

2.2. Data we collect automatically

Data about how you found us. We collect data about your referring URL (that is, the place on the Web where you were when you tapped on our ad).

Cookies and other similar technologies. Our Website uses cookies that record data about the use of our website to distinguish you from other users. You can control cookies through your browser settings.

Browser and Device data. We collect data from or about the devices from which you access the Website, depending on the permissions you've granted. We may associate the data we collect from your different devices, which helps us provide consistent services across your devices. 

Examples of such data include language settings, IP address, location, time zone, type and model of a device, device settings, operating system, Internet service provider, mobile carrier, hardware ID, and Facebook ID.

We also collect your Apple Identifier for Advertising (“IDFA”) or Google Advertising ID (“AAID”) (depending on the operating system of your device). You can typically reset these numbers through the settings of your device's operating system (but we do not control this).

Transaction data. When you make payments through the Website, you need to provide financial account data, such as your credit card number, to our third-party service providers. We do not collect or store full credit card number data, though we may receive credit card-related data and data about the transaction, including date, time, and amount of the transaction, and the type of payment method used.

Usage data. We record how you interact with our Website. For example, we log the features, and content you interact with, how often and long you use the Website, what sections you use, and other interactions.

2.3. Data we receive from third parties

We may receive information about you from third parties, such as payment processors verifying transactions and marketing partners who help us deliver targeted advertisements.

2.4. Content you submit to our programs

When you take part in a program that invites you to send us content — for example the 90-Day Challenge, where you can send us a photo at day 30, day 60 and day 90, and a video at day 90 — we collect the photos, video, audio and written responses you submit, together with your name and the email address linked to your subscription.

Where that content shows or records you, it includes your image, your likeness and your voice. We use it as described in Section 3 and in the release you agree to when you submit it.

You choose what to send. If a photo shows your body or physical changes, we treat that content as sensitive personal information — see Section 12.

We do not run facial recognition, face-matching or voice-matching on submitted content, and we do not create biometric templates from it. We also ask our service providers not to.

3. For what purposes do we process your personal data?

We process your personal data:

To provide services to you. This includes enabling you to use the Website, buy our Products, process and fulfill your orders in a seamless manner, as well as preventing or addressing Website errors or technical issues. For example, we use your data to authenticate you and authorize access to our Website.

To personalize our recommendations. If you provide details about your health preferences or dietary needs, or provide information through customer service inquiries, surveys, or feedback forms, we may collect and use this information to personalize our recommendations. This includes tailoring product recommendations, offering customized content, and improving our overall services to better meet your needs.

To research and analyze your use of the Website. This helps us to better understand our business, analyze our operations, maintain, improve, innovate, plan, design, and develop the Website and our new products. We conduct surveys, research, and test features in development. We analyze the data we have to evaluate our Website, and conduct audits and troubleshooting activities to improve our Website content and layouts. As a consequence, we often decide how to improve the Website based on the results obtained from this processing. For example, if we discover that users do not often use certain sections of the Website, we may focus on improving this sections.

To customize the Website for you. We select the payment processor available to you; we may also use your data to determine your eligibility for promotions, sweepstakes, and contests.

To process your payments. We provide paid products and/or services within the Website. For this purpose, we use third-party services for payment processing (for example, payment processors). As a result of this processing, you will be able to make a payment for paid features of the Website.

To enforce the Terms and to prevent, detect, investigate, and resolve disputes and/or remediate malicious activities, fraud, other cybercrimes, take legally-required actions, or make sure you are a real person and avoid the creation of fake accounts. 

We use personal data to enforce our agreements and contractual commitments, to detect, prevent, and combat fraud. As a result of such processing, we may share your information with others, including law enforcement agencies (in particular, if a dispute arises in connection with the Terms).

To communicate with you regarding your use of our Website. We may communicate with you, for example, by email or directly on the Website, including through push notifications. 

To show and/or send you marketing communications. We process your personal data for our marketing campaigns. We may add your email address to our marketing list. As a result, you will receive information about our Website, features, offers, promotions, contests, and events or provide other news or information about third-party services that may be of interest to you. You can opt out of advertisements and/or commercial emails by clicking unsubscribe.

To run our reward programs. If you take part in a program such as the 90-Day Challenge, we use your email address to confirm your order date and subscription status, we review the photos and videos you submit against the published requirements, and we deliver the reward — a discount code by email, or a free product applied to your subscription order. If your submission is approved, we may use the content, together with your name, image, likeness and voice, in our marketing and advertising, in line with the release you agreed to when submitting. 

To provide you customer service and support. As a result of such processing, we will send you messages about the availability of our Website security, payment transactions, the status of your orders, legal notices, or other Website-related information.

To personalize our ads. We and our partners use your personal data to tailor ads and possibly even show them to you at the relevant time.

To comply with legal obligations. We may process, use, or share your data when the law requires it, in particular, if a law enforcement agency requests your data by available legal means.

4. Legal basis for data processing

The laws in some jurisdictions require providing information with respect to the legal grounds for the usage and/or disclosure of personal information. To the extent those laws apply, our legal grounds are as follows:

A. Consent.

Where required by law, as well as in other cases, we handle personal information on the basis of implied or express consent.

B. To perform our contract with you.

We process your personal information on this basis in order to:

• provide the services;

• customize your experience;

• communicate with you regarding your use of the Service;

• manage your account;

• provide you customer service and support;

• process your payments.

C. Legal compliance.

We may need to use and disclose personal information in certain ways to comply with our legal obligations.

D. Legitimate interest.

For our (or others’) legitimate interests unless those interests are overridden by your interests or fundamental rights and freedoms that require protection of personal data:

• to communicate with you regarding your use of our Service;

• to research and analyze your use of the Service;

• to send you marketing communications;

• to personalize our ads;

• to enforce our Terms of Service and to prevent and counteract fraud.

5. Data retention

We will retain personal data for the period necessary to fulfill the purposes outlined in the Policy unless a longer retention period is required or permitted by law.

Please note that we have a variety of obligations to retain the data that you provide to us, including to ensure that transactions can be appropriately processed, settled, refunded, or charged back, to help identify fraud and to comply with anti-money laundering and other laws and rules that apply to us and to our financial service providers. Accordingly, even if you disable/delete your Profile, we will retain certain data to meet our obligations.

Where we can state a specific period, we do:

• Content you submit to our programs (video, images, audio, written responses): up to 3 years from the date you submit it, or until you ask us to stop using it, whichever comes first. Copies already published in live materials, and copies we keep to evidence the permission you gave us, may be retained beyond that period.

• Records of your participation (that you claimed, when, and the outcome): up to 3 years, so that we can administer the one-reward-per-account limit and answer questions about your claim.

• Order, payment and subscription records: for as long as your subscription is active and then for 7 years, to meet tax, accounting and chargeback obligations.

• Account and profile data: for as long as your account exists, and for 12 months after you close it.

• Marketing contact data: until you unsubscribe, and then a minimal record of your unsubscribe so that we don't contact you again.

• Support correspondence: 3 years from the date the conversation closed.

• Website and advertising analytics data: up to 26 months.

Ask us to stop using your content at any time by emailing help@habitone.co.

6. With whom do we share your personal data?

We share information with third parties that help us operate, provide, improve, integrate, customize, support, and market our Service. We may share some sets of personal data, in particular, for purposes indicated in the Policy. 

The types of third parties we share information with include, in particular:

6.1. Service providers

We share personal data with third parties that we hire to provide services or perform business functions on our behalf, based on our instructions. We may share your personal information with the following types of service providers:

• cloud storage providers (Google Cloud Platform, servers.com);

• data analytics providers (Facebook, Google, Amplitude);

• marketing partners (in particular, social media networks, marketing agencies, email delivery services);

• support services providers;

• shipping services providers;

• video hosting, storage and content review providers;

• payment processing contractors.

6.2. Law enforcement agencies and other public authorities

We may use and disclose personal data to enforce the Terms and this Policy, to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others, and to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, or in other cases provided for by law.

6.3. Third parties as part of a merger or acquisition

As we develop our business, we may buy or sell assets or business offerings. Customers’ information is generally one of the transferred business assets in these types of transactions. We may also share such information with any affiliated entity (e.g. parent company or subsidiary) and may transfer such information in the course of a corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

7. Links to Other Websites and Third-Party Content 

We may provide links to third-party websites, services, and applications that are not operated or controlled by HabitONE. This Policy does not apply to the privacy practices of those third parties. 

The fact that we link to a website, service, or application is not an endorsement, authorization, or representation of our affiliation with that third party. We encourage you to review the privacy policies of any third-party service before providing any personal information to or through them.

8. International data transfers

Personal data may be transferred to, and processed in, countries other than the country in which it was originally collected, including countries outside the European Economic Area, in order to provide the Website and for the purposes indicated in this Policy.
Where personal data is transferred from the European Economic Area to a country that has not been recognised by the European Commission as providing an adequate level of protection, such transfers are made on the basis of the European Commission's Standard Contractual Clauses or another transfer mechanism permitted under Chapter V of the GDPR. You may request further information about the safeguards applied by contacting us at the email address indicated at the end of this Policy.

9. Reward programs and financial incentives

Some of our programs give you something of value in exchange for information you share with us. Under California law, this is called a financial incentive, and we have to explain how it works before you take part.

The program. The 90-Day Challenge. If you have an active HabitONE subscription and you send us content that meets our published requirements: at day 30, day 60 and day 90 we email you a discount code for your next order; and at day 90, if you also send a video, we make one product in your next subscription order free and cover shipping on that order. 

What we collect for it. The email address linked to your subscription; the photos, video, audio and written responses you submit; and your name, image, likeness and voice where they appear in that content. We also use your order date and subscription status, which we already hold. 

How to take part. Participation is voluntary. You opt in by checking the box and submitting your content in the claim form. You are not enrolled unless you do that, and nothing happens automatically.

How to withdraw. You can withdraw at any time by emailing help@habitone.co. If you withdraw before we apply the reward, we won't apply it. If you withdraw afterward, you keep the reward, and we'll stop using your content in new materials — see Section 5 for what may remain.

The value, and how we worked it out. The two kinds of reward have different values.

At each 30-day milestone, the value is the discount itself. It is a percentage of the order you apply it to, currently between 5% and 15% as at the date at the top of this Policу. We may set a different percentage for future claims; the amount that applies to you is the one stated in the email we send you.

At day 90, the value is the retail price of one product in your subscription — typically $28 or $29 as at the date at the top of this Policy, depending on the product — plus the shipping cost we absorb on that order.

In each case we calculate the value as the actual amount we don't charge you. We consider that reasonably related to the value of the information you give us, which we estimate on the same basis: what we would otherwise pay to obtain comparable content and permissions, which is at least the amount we forgo.

Taking part, or not taking part, has no effect on the price you pay for your subscription or on any other part of the service.

10. Privacy Rights of the Residents of Certain States of the U.S. 

If you are a resident of a U.S. state that has enacted applicable consumer data privacy laws, which include, but might not be limited to: California, Colorado, Connecticut, Utah, and Virginia, you may be entitled to specific rights, including those regarding access to your personal information. 

However, please note that such laws usually have certain applicability thresholds, and, thus, may not be fully applicable to HabitONE. For more information, please contact our support team at the email address listed at the end of the Policy below.

11. Residents of the European Union (EU) and European Economic Area (EEA)

If you are a resident of a country within the European Union (EU) or the European Economic Area (EEA), you are subject to the General Data Protection Regulation (GDPR) and any other applicable laws. In particular, under the GDPR, you may enjoy specific rights and guarantees with respect to your personal information. Should you have any questions or require further information please contact us at the email address of our support team indicated at the end of the Policy below.

12. Sensitive personal information 

Some of what you tell us — for example your answers about sleep, energy, digestion or dietary needs — may count as sensitive personal information under U.S. state privacy laws, because it relates to your health.

We use it for one thing only: to recommend products and content that fit what you told us. Specifically, we do not:

• sell it, or share it with advertising platforms for targeted advertising;

• use it to build profiles for advertising purposes;

• infer characteristics about you beyond the recommendation you asked for.

Because we limit our use of sensitive personal information to providing what you asked for, California's right to limit its use doesn't add anything here — but if you'd like us to delete it, email help@habitone.co and we will.

If a photo you send us shows your body or otherwise relates to your health, we treat it as sensitive personal information. We store it with the same protections as the rest of your submission; we don't use it for advertising targeting, profiling or audience building; and we don't sell it. We may decline to use it in marketing at all. You can ask us to delete it at any time by emailing help@habitone.co, and we will.

13. Changes to the Policy

We may from time to time update this Policy to reflect changes to our practices. If such changes take place, we will post an updated version of the Policy on the Website and indicate when the revision took place. In case of material changes to this Policy, we may also notify you through the Service or by other available means.

By continuing to access or use the Website after those changes become effective, you agree to be bound by the revised Policy. You are advised to regularly check the Policy to stay up-to-date.

14. Age limitation

We do not knowingly process personal data from persons under 18 years of age. If you learn that anyone younger than 18 has provided us with personal data, please contact us at the email address of our support team indicated at the end of the Policy below.

This applies to content submitted to our programs as well: we do not accept submissions from anyone under 18, and we do not use content in our marketing that features someone who does not appear to be an adult. 

15. Privacy rights

To be in control of your personal data, you have the following rights:

Accessing / reviewing / updating / correcting your personal data. You may review, edit, or change the personal data that you had previously provided to us. You control your profile; thus, you may access your profile data at any time and correct or update it by logging in to the Website. 

Deleting your personal data. When you request the deletion of your personal data, we will use reasonable efforts to honor your request. In some cases, we may be legally required to keep some of the data for a certain time; in such an event, we will fulfill your request after we have complied with our obligations.

If you have submitted content to one of our programs, deleting your data means we stop using that content in new materials and remove the source file we hold; materials already published or distributed, and records we keep to evidence the permission you gave, may remain. 

Objecting to or restricting the use of your personal data. You can ask us to stop using all or some of your personal data or limit our use thereof. For example, you can opt out of email marketing or restrict the use of cookies on your device.

The right to lodge a complaint with supervisory authority. We would love you to contact us directly, so we could address your concerns. Nevertheless, you have the right to lodge a complaint with a competent data protection supervisory authority.

The right to data portability. If you wish to receive your personal data in a machine-readable format, you can send a respective request.

You may exercise your privacy rights by emailing us at the email address of our support team indicated at the end of the Policy below.

You may submit requests through an authorized agent, in which case we will need to verify the agent’s identity, your identity, and their authority to act on your behalf before we can process the request. Depending on the applicable legislation, you may also be entitled to other/additional rights in relation to your personal data.

16. How do we handle “do not track” requests?

Except as otherwise stipulated in the Policy, the Website does not support “Do Not Track” requests. To determine whether any of the third-party services it uses honor the “Do Not Track” requests, please read their privacy policies.

17. Contact us

Please contact our support team with any questions regarding the Policy.

E-mail: help@habitone.co.