Privacy Policy

What we collect

• Your name, email address, delivery address, and phone number if you give us one.
• Your orders: what you bought, when, the delivery day, and any delivery notes you write.
• Delivery photos taken by the driver at drop-off, which may show your door, porch, or hallway.
• Messages you send us through the contact page or to Vega, our on-site assistant.
• Recordings of phone calls with us, and notes our team writes about your calls and orders. Every call tells you it may be recorded before we speak. Recordings are kept privately, heard only by our staff, and used for quality, training and resolving problems with an order.
• Your account password, stored only as a cryptographic hash — we can't read it.
• Your email address and first name if you join our email list, along with whether the consent box was ticked. On the signup form and the signup popup the box starts unticked; at checkout it is ticked for you and you can untick it before you pay. We only send marketing email to an address whose box was ticked, and every one of those emails has an unsubscribe link.
• If you tick the box asking us to text you, we record that you ticked it, when, and the exact wording you were shown. We only text a number that was given to us with that tick.
• When you place an order, your IP address and browser type, saved with that order and used only to tell the advertising services which ad led to it. If you've opted out, we don't collect them at all.

We never see or store your full card number. Card details go directly to Stripe, our payment processor, and we only receive confirmation that a payment succeeded.

Why we hold your address

Beyond delivering to it, we store a simplified version of your address so we can recognise orders that go to the same place. That's how we tell a new customer from a returning one. It's used for that check and for delivery, not for profiling you.

Text messages

We only text a number whose owner asked us to. At checkout there is a box, unticked by default, that reads: “Text me about my order and delivery — a confirmation when I order, a reminder before it's billed, updates on the way and when it's delivered, and a secure payment link if I ask for one.” Leaving it alone is a complete answer — it changes nothing about your order, your price, or your delivery. When you order by phone, we read you the same sentence and record your answer.

The full terms shown beside that box: Alkaid Water Co. Message frequency varies. Msg & data rates may apply. Reply STOP to cancel, HELP for help. Consent is not a condition of purchase.

These are the only messages we send: a reminder about two days before a subscription delivery is billed, so you can skip or change it in time; delivery updates (a text when the driver is on the way); a secure link to pay for an order or to update the card on file, only when you've asked us for it; and, only if we have no email address for you, a confirmation when you order and a note when it has been delivered. No marketing by text. If you agreed to texts before October 7, 2026, when the box didn't mention reminders, your reminder comes by email instead; the confirmation and delivered texts go only to people who agreed on or after October 8, 2026.

Reply STOP to any message to stop them, and HELP to get our contact details. You can also ask us through our contact page. Stopping texts never affects your deliveries — the driver can still call you, and we still email you.

Twilio carries these messages for us and receives your number and the text of the message in order to deliver it. We do not sell your mobile number. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

Who we share it with

Only the services that make the business run, and only the data each one needs:

• Stripe — payments, refunds, and subscription billing.
• Resend — every email we send: order confirmations, delivery notices, password resets, and, if your email box was ticked, marketing email such as a reminder about a cart you left or a review request after a delivery. Each marketing email carries a one-click unsubscribe link.
• Twilio — text messages (only if you asked for them; see “Text messages” above) and phone calls with us, in both directions. Twilio carries the call, records it after the recording notice, and, when we call you, detects whether a person or a voicemail answered.
• Anthropic — powers Vega, our assistant. What you type to Vega is sent to Anthropic to generate a reply, so please don't put payment details or anything sensitive in that chat.
• Convex — the database where your account and orders are stored.
• Vercel — hosting for the website itself.
• Meta (Facebook and Instagram) and Google — advertising and measurement. Their tags tell us which ads led to a visit or an order. They receive pages viewed, products viewed or added to the cart, and the value of a completed order — never your payment details. When you place an order, the Meta tag also receives your email, phone, first and last name, city, state, ZIP and country so Meta can tell that the person who saw an ad is the person who bought. Your browser scrambles (hashes) each of these before it is sent, so Meta never receives them in readable form.
• Meta also receives a confirmation from our server when an order is paid, so a purchase still counts if your browser blocked the tag. That message includes the same details — email, phone, first and last name, city, state, ZIP and country — in scrambled (hashed) form; Meta can compare a hash against accounts it already has, but cannot read the original out of it. It also carries your IP address and browser type, which help it recognise the same visit. Subscriptions send one per renewal. We send nothing at all for anyone who has opted out.
• Our delivery drivers see the name, address, delivery notes, and order contents for the stops on their route.

We may also disclose information if the law requires it. We do not sell personal information for money. Because the Meta and Google advertising tags described above pass browsing activity to those companies, some state privacy laws treat that as “sharing for cross-context behavioural advertising”, and we honour opt-outs of it — see “Your choices” below.

What we store in your browser

We use your browser's local storage to remember your cart, your language preference, whether you've seen the signup popup, whether you've ordered before, the delivery details you typed at checkout so the next order starts filled in, and which ad or link brought you to the site (the campaign tags in the address you arrived on), so the order can be credited to it. Signing in also stores a session so you stay logged in. Clearing your browser data clears all of it.

Separately, the Meta and Google advertising tags set their own cookies. Those cookies can recognise your browser on other websites, which is how we learn that an ad we ran led to an order. The cookies themselves carry browsing and purchase-value information, never your card details. The identifying details described above are not kept in these cookies — they are sent only when you place an order, and only in scrambled (hashed) form.

How long we keep it

We keep order records for as long as we need them for accounting, tax, and warranty purposes. Account details are kept while your account is open. Ask us to close your account and we'll delete what we're not legally required to retain.

Your choices

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Contact us through our contact page and we'll respond. Depending on where you live, you may have additional rights under your state's privacy law; we apply these choices to everyone regardless.

To leave the email list, use the one-click unsubscribe link at the bottom of any of our marketing emails (your mail app's own Unsubscribe button works too), reply "unsubscribe" to one of them, or ask us through our contact page — we remove you and keep a note that you asked, so a later signup form can't quietly put you back. Emails about an order you placed, such as the confirmation and the delivery notice, still arrive.

To opt out of the advertising tags, turn on Global Privacy Control in your browser (Firefox, Brave, and DuckDuckGo have it built in; Chrome and Safari support it through an extension). We check for that signal on every page and load no advertising tag when it's present — nothing to fill in, and it works before the first page finishes loading. If you place an order with it on, the opt-out is recorded with the order, so the server-side confirmation to Meta is skipped as well. You can also ask us directly through our contact page.

Children

This site isn't intended for children under 13, and we don't knowingly collect their information. If you believe a child has given us personal information, contact us and we'll remove it.

Changes

If we change how we handle your information, we'll update this page and the date at the top.