Free UK delivery
First pouch £19 when you subscribe
Third-Pary tested
Vegan Friendly
No artificial colours
Updated On:
9 September 2026
Privacy Policy
This policy explains what personal information we collect when you use levulo.co.uk or buy from us, what we do with it, who else sees it, and what rights you have over it.
We've written it plainly and specifically. Where a section says we use a particular company, we name them. Where we don't collect something, we say so.
If anything here isn't clear, email hello@levulo.co.uk and ask.
1. What information Do We Collect
Levulo Labs Ltd is the data controller for the information described in this policy. That means we decide what's collected and what happens to it, and we're responsible for it.
Company number: 16999409
Registered office and trading address: Elmwood House, York Road, Kirk Hammerton, York, YO26 8DH, United Kingdom
Email: hello@levulo.co.uk
We're a small company and we don't have a Data Protection Officer — we're not required to appoint one. Data protection questions go to hello@levulo.co.uk and reach one of the founders directly.
2. What this policy covers
This policy covers levulo.co.uk, our online shop at shop.levulo.co.uk, and the emails and messages we send you.
It doesn't cover other companies' websites. Our site links to places we don't run — our social media profiles, Royal Mail's tracking pages, payment providers — and once you're there, their privacy policies apply, not ours.
3. What we collect
Things you give us:
Your name and contact details — name, email address, delivery and billing address, and your mobile number if you give us one.
Your order — what you bought, when, how much you paid, your subscription status and renewal dates, and your order history.
Your account — your login details, if you create an account. Passwords are stored encrypted by Shopify. We can't see them.
What you tell us — the content of emails, contact form messages and texts you send us.
Your marketing preferences — whether you've opted in, and when.
Things we collect automatically when you use the site:
Technical information — your IP address, browser and device type, and rough location based on your IP (city level, not your street).
How you use the site — pages you looked at, how you got here, what you clicked, and whether you opened or clicked an email we sent.
About payment. We never see or store your full card details. When you pay, your card information goes straight to Shopify Payments or PayPal. What comes back to us is the last four digits, the card type, and the billing address. That's all we hold.
About health information. We don't ask for it and we don't want it in our systems. If you mention something about your health when you email us — for example asking whether Foundation is suitable alongside a medication — we'll use what you've told us only to answer your question. It doesn't go into any marketing profile, and we don't build health records on customers.
We don't collect biometric data, and we don't collect information about your race, religion, sexuality, politics or any other special category of data.
4. Where we get it from
Almost everything comes directly from you — when you order, create an account, join a waitlist, sign up to emails, or get in touch.
The rest comes from:
Cookies and similar technologies on our site, when you've agreed to them (see clause 7).
Our payment providers, who confirm whether a payment succeeded and pass back the limited card information described above.
Royal Mail, which tells us the delivery status of your parcel.
We don't buy contact lists, and we don't add anyone to our marketing without them asking to be there.
5. Why we use it, and our legal basis
UK data protection law says we need a valid reason — a "lawful basis" — for everything we do with your information. Here's ours.
To take and fulfil your order — including processing payment, sending your parcel, managing your subscription, and dealing with returns and refunds. Our basis: performing our contract with you.
To manage your account and answer your questions — replying to emails, sorting out problems, handling complaints. Our basis: performing our contract with you, or our legitimate interest in running the business properly where you're not yet a customer.
To keep the required financial records — invoices, transaction records, VAT and tax records. Our basis: complying with our legal obligations.
To send you marketing — emails and, if you've opted in, texts. Our basis: your consent, or the "soft opt-in" where you've bought from us before and we're telling you about similar products. You can stop it at any time (see clause 6).
To understand how the site is used and to advertise — analytics, and advertising on Google, Meta and TikTok. Our basis: your consent, given through the cookie banner.
To keep the site and our orders secure — spotting fraudulent orders, preventing abuse of discount codes, protecting against attacks. Our basis: our legitimate interest in protecting the business and our customers, and complying with our legal obligations.
To improve what we sell and how we sell it — looking at what's working, in aggregate. Our basis: our legitimate interest in improving our products and service.
Where we rely on legitimate interests, we've considered whether it's fair to you and whether you'd reasonably expect it. If you want to know how we weighed that up for a particular use, ask us and we'll explain.
6. Marketing
Emails. We send marketing emails if you've asked us to, or if you've bought from us and we're telling you about similar products. Every email has an unsubscribe link. It works immediately and there's no "are you sure" — one click and you're off.
Texts. We only send marketing texts if you've specifically opted in to them. Reply STOP to any message and we'll stop. Full detail is in clause 20 of our Terms & Conditions.
These are separate. Unsubscribing from emails doesn't stop texts, and opting out of texts doesn't stop emails. Do both if you want both stopped, or email us and we'll do it.
Order messages aren't marketing. If you've placed an order, we'll still send you order confirmations, dispatch notices, renewal reminders and account notices, because we need to. Opting out of marketing doesn't switch those off — and you wouldn't want it to.
Advertising. You may see our ads on Google, Facebook, Instagram or TikTok. If you've accepted marketing cookies, those platforms may show our ads to you based on your having visited our site, and may show them to people with similar interests. You can turn this off through our Cookie Settings, and through your ad settings on each platform.
7. Cookies
Cookies are small files stored on your device. We use them in three ways.
Essential cookies keep the site working — remembering what's in your basket, keeping you logged in, getting you securely through checkout, and remembering your cookie choices. These can't be switched off, because without them the site doesn't function. We don't need your consent for these.
Analytics cookies tell us how the site is used — which pages people read, where they arrive from, where they give up. We use Google Analytics for this. It helps us fix what's not working.
Marketing cookies let us advertise on Google, Meta and TikTok, and let us see whether an ad led to a purchase.
Analytics and marketing cookies only load if you agree to them. You choose when the banner appears, and you can change your mind at any time using Cookie Settings in the footer of any page.
You can also block or delete cookies in your browser settings. If you block essential cookies, checkout won't work.
8. Who we share it with
We don't sell your information. We never have and we won't.
We do share it with the companies that make the business run. Each one is contractually required to protect it, to use it only for what we've asked them to do, and not for their own purposes:
Shopify — runs our shop, checkout and customer accounts, and holds our order records.
Shopify Payments and PayPal — take payment and screen transactions for fraud.
Seal Subscriptions — manages subscriptions, renewal dates and your ability to skip, pause and cancel.
Frameship — connects our website to our shop so the basket works across both.
Framer — hosts the website itself.
Klaviyo — sends our marketing emails and texts, and records whether you opened them.
Google — our work email and files (Workspace), plus Analytics, Ads and Search Console.
Meta and TikTok — advertising, where you've accepted marketing cookies.
Royal Mail — delivers your parcel. They get your name, address and a contact detail for delivery notifications.
Our accountant — sees transaction records, not marketing data.
We'll also share information where the law requires it — for example a court order, a tax investigation, or a request from a regulator we're obliged to answer. And if the business is ever sold or merged, customer information would transfer as part of it; we'd tell you before that happened.
9. Where your information goes
Some of the companies above are based outside the UK, mainly in the US and the EU. That means your information sometimes leaves the UK.
UK law allows this as long as the information stays protected to UK standards. Where a transfer goes somewhere the UK hasn't judged to have equivalent protection, we rely on one of two safeguards:
the UK Extension to the EU–US Data Privacy Framework, where the company has certified under it; or
the UK's International Data Transfer Agreement, or the UK Addendum to the EU's standard contractual clauses.
If you'd like to know which safeguard applies to a particular company on the list, email hello@levulo.co.uk and we'll tell you.
10. How long we keep it
We keep things only as long as we need them.
Order and payment records — six years after the end of the financial year they relate to. We don't have a choice about this one; tax law requires it.
Your account — for as long as you use it. If you haven't ordered or logged in for three years, we delete it.
Marketing list — until you unsubscribe.
After you unsubscribe — we keep a minimal record of your email address or mobile number on a suppression list, indefinitely. This exists so that we don't accidentally email you again. It isn't used for anything else, and it's the only way to reliably honour an opt-out.
Emails and messages you send us — two years, unless they relate to a complaint or a legal matter, in which case longer.
Analytics data — 14 months.
Your cookie choices — 12 months, then we'll ask again.
When a retention period ends we delete the information or anonymise it so it can no longer identify you.
11. How we keep it safe
Our site and checkout run over encrypted connections. Payment details go directly to our payment providers and never sit on our systems. Access to customer information is limited to the people who need it, and the accounts holding it are protected with two-factor authentication.
The companies we use are established platforms with their own security programmes, and they're contractually obliged to protect what we send them.
No system is perfectly secure, and we're not going to pretend otherwise. If a breach ever happened that put your rights or freedoms at risk, we'd tell the Information Commissioner's Office within 72 hours and tell you without undue delay.
12. Your rights
You have the following rights over your information. They're free to use.
Access — ask for a copy of what we hold about you.
Correction — have anything inaccurate fixed.
Erasure — ask us to delete it. We can't delete records we're legally required to keep, like order and tax records, but we can remove everything else.
Restriction — ask us to pause using it while something's being sorted out.
Portability — get the information you gave us in a machine-readable format, or have it sent to another company.
Objection — object to us using your information on the basis of legitimate interests. If you object to direct marketing, we'll stop, full stop.
Withdraw consent — where we rely on your consent, you can take it back at any time. That doesn't affect anything we did before you withdrew it.
How to use any of them: email hello@levulo.co.uk. We'll respond within one month. If your request is complicated we can extend that by two months, but we'll tell you if we need to and why.
We may ask you to confirm your identity first — not to be obstructive, but because handing your information to someone pretending to be you would be worse.
13. Automated decisions
Our checkout automatically screens orders for signs of fraud, and flags anything unusual. That's normal for online shops and it protects both of us.
No order is ever cancelled purely by a machine. If an order is flagged, one of us looks at it before anything happens to it.
We don't profile customers in any way that produces legal effects or similarly significant effects for you.
14. Under 18's
Our products aren't for under-18s, and neither is our site. We don't knowingly collect information from anyone under 18.
If you believe a child has given us their information, email hello@levulo.co.uk and we'll delete it.
15. Changes to this policy
We'll update this policy when what we do changes — a new tool, a new kind of processing, a change in the law. The date at the top shows when it was last updated.
If we make a change that materially affects how we use your information, we'll tell you by email rather than quietly editing the page.
16. Contact us, and how to complain
For anything to do with your information — a request, a question, a concern — email hello@levulo.co.uk, or write to us at Levulo Labs Ltd, Elmwood House, York Road, Kirk Hammerton, York, YO26 8DH.
If you're unhappy with how we've handled something, please tell us first and give us a chance to fix it.
You also have the right to complain to the UK's data protection regulator at any point:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 0303 123 1113 ico.org.uk
Updated On:
9 September 2026
Privacy Policy
This policy explains what personal information we collect when you use levulo.co.uk or buy from us, what we do with it, who else sees it, and what rights you have over it.
We've written it plainly and specifically. Where a section says we use a particular company, we name them. Where we don't collect something, we say so.
If anything here isn't clear, email hello@levulo.co.uk and ask.
1. What information Do We Collect
Levulo Labs Ltd is the data controller for the information described in this policy. That means we decide what's collected and what happens to it, and we're responsible for it.
Company number: 16999409
Registered office and trading address: Elmwood House, York Road, Kirk Hammerton, York, YO26 8DH, United Kingdom
Email: hello@levulo.co.uk
We're a small company and we don't have a Data Protection Officer — we're not required to appoint one. Data protection questions go to hello@levulo.co.uk and reach one of the founders directly.
2. What this policy covers
This policy covers levulo.co.uk, our online shop at shop.levulo.co.uk, and the emails and messages we send you.
It doesn't cover other companies' websites. Our site links to places we don't run — our social media profiles, Royal Mail's tracking pages, payment providers — and once you're there, their privacy policies apply, not ours.
3. What we collect
Things you give us:
Your name and contact details — name, email address, delivery and billing address, and your mobile number if you give us one.
Your order — what you bought, when, how much you paid, your subscription status and renewal dates, and your order history.
Your account — your login details, if you create an account. Passwords are stored encrypted by Shopify. We can't see them.
What you tell us — the content of emails, contact form messages and texts you send us.
Your marketing preferences — whether you've opted in, and when.
Things we collect automatically when you use the site:
Technical information — your IP address, browser and device type, and rough location based on your IP (city level, not your street).
How you use the site — pages you looked at, how you got here, what you clicked, and whether you opened or clicked an email we sent.
About payment. We never see or store your full card details. When you pay, your card information goes straight to Shopify Payments or PayPal. What comes back to us is the last four digits, the card type, and the billing address. That's all we hold.
About health information. We don't ask for it and we don't want it in our systems. If you mention something about your health when you email us — for example asking whether Foundation is suitable alongside a medication — we'll use what you've told us only to answer your question. It doesn't go into any marketing profile, and we don't build health records on customers.
We don't collect biometric data, and we don't collect information about your race, religion, sexuality, politics or any other special category of data.
4. Where we get it from
Almost everything comes directly from you — when you order, create an account, join a waitlist, sign up to emails, or get in touch.
The rest comes from:
Cookies and similar technologies on our site, when you've agreed to them (see clause 7).
Our payment providers, who confirm whether a payment succeeded and pass back the limited card information described above.
Royal Mail, which tells us the delivery status of your parcel.
We don't buy contact lists, and we don't add anyone to our marketing without them asking to be there.
5. Why we use it, and our legal basis
UK data protection law says we need a valid reason — a "lawful basis" — for everything we do with your information. Here's ours.
To take and fulfil your order — including processing payment, sending your parcel, managing your subscription, and dealing with returns and refunds. Our basis: performing our contract with you.
To manage your account and answer your questions — replying to emails, sorting out problems, handling complaints. Our basis: performing our contract with you, or our legitimate interest in running the business properly where you're not yet a customer.
To keep the required financial records — invoices, transaction records, VAT and tax records. Our basis: complying with our legal obligations.
To send you marketing — emails and, if you've opted in, texts. Our basis: your consent, or the "soft opt-in" where you've bought from us before and we're telling you about similar products. You can stop it at any time (see clause 6).
To understand how the site is used and to advertise — analytics, and advertising on Google, Meta and TikTok. Our basis: your consent, given through the cookie banner.
To keep the site and our orders secure — spotting fraudulent orders, preventing abuse of discount codes, protecting against attacks. Our basis: our legitimate interest in protecting the business and our customers, and complying with our legal obligations.
To improve what we sell and how we sell it — looking at what's working, in aggregate. Our basis: our legitimate interest in improving our products and service.
Where we rely on legitimate interests, we've considered whether it's fair to you and whether you'd reasonably expect it. If you want to know how we weighed that up for a particular use, ask us and we'll explain.
6. Marketing
Emails. We send marketing emails if you've asked us to, or if you've bought from us and we're telling you about similar products. Every email has an unsubscribe link. It works immediately and there's no "are you sure" — one click and you're off.
Texts. We only send marketing texts if you've specifically opted in to them. Reply STOP to any message and we'll stop. Full detail is in clause 20 of our Terms & Conditions.
These are separate. Unsubscribing from emails doesn't stop texts, and opting out of texts doesn't stop emails. Do both if you want both stopped, or email us and we'll do it.
Order messages aren't marketing. If you've placed an order, we'll still send you order confirmations, dispatch notices, renewal reminders and account notices, because we need to. Opting out of marketing doesn't switch those off — and you wouldn't want it to.
Advertising. You may see our ads on Google, Facebook, Instagram or TikTok. If you've accepted marketing cookies, those platforms may show our ads to you based on your having visited our site, and may show them to people with similar interests. You can turn this off through our Cookie Settings, and through your ad settings on each platform.
7. Cookies
Cookies are small files stored on your device. We use them in three ways.
Essential cookies keep the site working — remembering what's in your basket, keeping you logged in, getting you securely through checkout, and remembering your cookie choices. These can't be switched off, because without them the site doesn't function. We don't need your consent for these.
Analytics cookies tell us how the site is used — which pages people read, where they arrive from, where they give up. We use Google Analytics for this. It helps us fix what's not working.
Marketing cookies let us advertise on Google, Meta and TikTok, and let us see whether an ad led to a purchase.
Analytics and marketing cookies only load if you agree to them. You choose when the banner appears, and you can change your mind at any time using Cookie Settings in the footer of any page.
You can also block or delete cookies in your browser settings. If you block essential cookies, checkout won't work.
8. Who we share it with
We don't sell your information. We never have and we won't.
We do share it with the companies that make the business run. Each one is contractually required to protect it, to use it only for what we've asked them to do, and not for their own purposes:
Shopify — runs our shop, checkout and customer accounts, and holds our order records.
Shopify Payments and PayPal — take payment and screen transactions for fraud.
Seal Subscriptions — manages subscriptions, renewal dates and your ability to skip, pause and cancel.
Frameship — connects our website to our shop so the basket works across both.
Framer — hosts the website itself.
Klaviyo — sends our marketing emails and texts, and records whether you opened them.
Google — our work email and files (Workspace), plus Analytics, Ads and Search Console.
Meta and TikTok — advertising, where you've accepted marketing cookies.
Royal Mail — delivers your parcel. They get your name, address and a contact detail for delivery notifications.
Our accountant — sees transaction records, not marketing data.
We'll also share information where the law requires it — for example a court order, a tax investigation, or a request from a regulator we're obliged to answer. And if the business is ever sold or merged, customer information would transfer as part of it; we'd tell you before that happened.
9. Where your information goes
Some of the companies above are based outside the UK, mainly in the US and the EU. That means your information sometimes leaves the UK.
UK law allows this as long as the information stays protected to UK standards. Where a transfer goes somewhere the UK hasn't judged to have equivalent protection, we rely on one of two safeguards:
the UK Extension to the EU–US Data Privacy Framework, where the company has certified under it; or
the UK's International Data Transfer Agreement, or the UK Addendum to the EU's standard contractual clauses.
If you'd like to know which safeguard applies to a particular company on the list, email hello@levulo.co.uk and we'll tell you.
10. How long we keep it
We keep things only as long as we need them.
Order and payment records — six years after the end of the financial year they relate to. We don't have a choice about this one; tax law requires it.
Your account — for as long as you use it. If you haven't ordered or logged in for three years, we delete it.
Marketing list — until you unsubscribe.
After you unsubscribe — we keep a minimal record of your email address or mobile number on a suppression list, indefinitely. This exists so that we don't accidentally email you again. It isn't used for anything else, and it's the only way to reliably honour an opt-out.
Emails and messages you send us — two years, unless they relate to a complaint or a legal matter, in which case longer.
Analytics data — 14 months.
Your cookie choices — 12 months, then we'll ask again.
When a retention period ends we delete the information or anonymise it so it can no longer identify you.
11. How we keep it safe
Our site and checkout run over encrypted connections. Payment details go directly to our payment providers and never sit on our systems. Access to customer information is limited to the people who need it, and the accounts holding it are protected with two-factor authentication.
The companies we use are established platforms with their own security programmes, and they're contractually obliged to protect what we send them.
No system is perfectly secure, and we're not going to pretend otherwise. If a breach ever happened that put your rights or freedoms at risk, we'd tell the Information Commissioner's Office within 72 hours and tell you without undue delay.
12. Your rights
You have the following rights over your information. They're free to use.
Access — ask for a copy of what we hold about you.
Correction — have anything inaccurate fixed.
Erasure — ask us to delete it. We can't delete records we're legally required to keep, like order and tax records, but we can remove everything else.
Restriction — ask us to pause using it while something's being sorted out.
Portability — get the information you gave us in a machine-readable format, or have it sent to another company.
Objection — object to us using your information on the basis of legitimate interests. If you object to direct marketing, we'll stop, full stop.
Withdraw consent — where we rely on your consent, you can take it back at any time. That doesn't affect anything we did before you withdrew it.
How to use any of them: email hello@levulo.co.uk. We'll respond within one month. If your request is complicated we can extend that by two months, but we'll tell you if we need to and why.
We may ask you to confirm your identity first — not to be obstructive, but because handing your information to someone pretending to be you would be worse.
13. Automated decisions
Our checkout automatically screens orders for signs of fraud, and flags anything unusual. That's normal for online shops and it protects both of us.
No order is ever cancelled purely by a machine. If an order is flagged, one of us looks at it before anything happens to it.
We don't profile customers in any way that produces legal effects or similarly significant effects for you.
14. Under 18's
Our products aren't for under-18s, and neither is our site. We don't knowingly collect information from anyone under 18.
If you believe a child has given us their information, email hello@levulo.co.uk and we'll delete it.
15. Changes to this policy
We'll update this policy when what we do changes — a new tool, a new kind of processing, a change in the law. The date at the top shows when it was last updated.
If we make a change that materially affects how we use your information, we'll tell you by email rather than quietly editing the page.
16. Contact us, and how to complain
For anything to do with your information — a request, a question, a concern — email hello@levulo.co.uk, or write to us at Levulo Labs Ltd, Elmwood House, York Road, Kirk Hammerton, York, YO26 8DH.
If you're unhappy with how we've handled something, please tell us first and give us a chance to fix it.
You also have the right to complain to the UK's data protection regulator at any point:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 0303 123 1113 ico.org.uk