FEMSTATE is operated by Femstate LLC (Miami, Florida, USA). This policy explains what we collect, why, who we share it with, and the choices you have. We have written it to describe what our software actually does — not what is convenient to say.
1. Data we collect
We only collect what we need to deliver phase-aligned recommendations, fulfil orders and improve the product.
- Account data: your email, name and authentication details when you create an account. Authentication is handled by Supabase Auth. We never see or store your password.
- Quiz and cycle data: your answers — age range, life stage, the date your last period started, symptoms, goals and preferences — and the cycle phase and formula we derive from them.
- Daily check-ins: the mood, energy, symptoms and free-text notes you choose to log in your account. These are optional.
- Order data: what you bought and your subscription status. Payments are processed by Stripe; card numbers never reach our servers.
- Messages you send us: anything you write in the contact form, which we store as a support ticket linked to your record so we can answer you.
- Approximate location: a country and region estimate derived from your connection headers. We do not collect or store your IP address or precise GPS location.
- Usage data: pages visited and time on page, and — only if you accept analytics cookies — product analytics events.
2. Health data — how we treat it
Your cycle dates, symptoms, life stage and daily check-ins are consumer health data. We treat them as the most sensitive information we hold, and we apply specific rules to them:
- We never share them with advertising networks, data brokers or social media platforms, and we run no advertising pixels anywhere on this site. The only health information that leaves our database goes to the providers that deliver what you asked for — the formula name to our payment processor, and your result to our email provider so it can send you your guide. Section 6 says exactly what each one receives.
- Session recording is disabled on the quiz and on your account pages, so no third-party tool records how you describe your symptoms. Everywhere else on the site, form inputs are masked in any recording.
- They are stored in our database with row-level security and are readable only by our own server, never by a browser.
- We do not use them to make automated decisions with legal effects. The recommendation you receive is guidance, not a decision about you.
If you are a resident of Washington State or Nevada, you have additional rights over this data. See our Consumer Health Data Privacy Notice.
4. How we use your data
- To work out your current cycle phase and give you personalized guidance.
- To process your orders, manage your subscription and provide customer support.
- To send your personalized guide and, if you opt in, cycle education and product updates.
- To understand demand in aggregate and improve our formulas and content.
- To keep the service secure and prevent abuse.
Where the law requires a legal basis, we rely on: performing our contract with you (orders and account), your consent (analytics cookies, marketing email and health data), and our legitimate interest in keeping the service secure and improving it.
5. Email
Transactional email — your guide, order confirmations, subscription notices — is sent because you asked for it or because we owe it to you as part of your purchase. Marketing email only goes to addresses that opted in, and every campaign carries an unsubscribe link. Unsubscribing removes you from all marketing lists, not just the one you clicked from.
Our email is delivered by Resend (USA). We record whether a message was delivered and opened so we can tell whether our email is working and stop sending to addresses that bounce.
7. We do not sell your data
We do not sell your personal information, and we do not share it for cross-context behavioural advertising — the two things those terms mean under California and other state privacy laws. We do not operate advertising pixels on this site. We will never sell or share health data under any circumstances.
8. How long we keep it
- Account, cycle and check-in data: while your account is open, and for up to 90 days after you close it, so a deletion can be undone if it was a mistake. Deletion today is handled by our team when you ask for it, not by an automatic job — ask us and we do it within 45 days.
- Order and payment records: seven years, because tax and accounting law requires it.
- Quiz answers without an account: we aim to keep them no longer than 24 months from your last interaction. There is no automatic purge job today, so in practice they are removed when you ask us — see the deletion note above.
- Marketing contacts: until you unsubscribe, plus a permanent record of the unsubscribe itself — that record exists precisely so we never email you again.
- Analytics events: up to 24 months, in aggregate.
9. Your rights
Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or send you a copy in a portable format. You can also withdraw a consent you previously gave. To exercise any of these, write to us from the contact page or email privacy@femstate.me. We answer within 45 days.
We will never charge you, deny you service, or give you a worse price because you exercised a privacy right.
Residents of Washington State and Nevada have additional health-data rights, including the right to have health data deleted and to withdraw consent to its collection. See the Consumer Health Data Privacy Notice.
10. Age
FEMSTATE is intended for people aged 18 and over, and only an adult may buy from us or open an account. We do not knowingly collect personal information from children under 13. If you believe a child has given us their information, write to privacy@femstate.me and we will delete it.
Our educational content can be read by anyone. If you are under 18 and thinking about supplements, talk to a parent, guardian or healthcare professional first.
11. Where your data is processed
Femstate LLC is based in the United States and our service providers process data there. If you are writing to us from outside the United States, your data will be transferred to and processed in the US, where privacy law differs from your own country's.
12. Security
We protect your data with encryption in transit, row-level access control in the database, role-based access for our own staff, and rate limiting against abuse. Our platform tables are readable only by our server — never directly by a browser. No system is perfect, and we will not pretend otherwise: if a breach ever affects your data, we will notify you as the law requires.
13. Not medical advice
FEMSTATE provides wellness and educational information. It is not medical advice and does not diagnose, treat, cure or prevent any disease. These statements have not been evaluated by the Food and Drug Administration. Always consult a qualified healthcare professional about your health.
14. Changes to this policy
If we change this policy in a way that materially affects your rights, we will tell you by email or with a notice on the site before the change takes effect. The date at the top always shows the current version.
15. Contact
Femstate LLC, Miami, Florida, USA. Questions about your privacy: privacy@femstate.me, or through the contact page.