Privacy Policy

1. Who we are and how to reach us

KAIRO is the trading name of Launchi LLC, a limited liability company registered in the State of Delaware, United States. We run the online store at vitalmanafter50.com and we sell one product: the KAIRO Motion Kit, a 12-piece resistance band kit.

For everything that happens on this website, Launchi LLC is the data controller. That is the legal term for the company that decides what personal information is collected, why it is collected, and what happens to it — and that is answerable to you and to regulators for it.

• Company: Launchi LLC, trading as KAIRO
• Postal address: 16162 Coastal Hwy, Lewes, DE 19958, United States
• Email: support@vitalmanafter50.com
• Website: vitalmanafter50.com

Email is the fastest way to reach us. A person reads every message and usually replies the same working day. There is no phone menu and no chatbot in the middle.

This policy covers the website, the checkout, the emails we send about your order, and our support inbox. It sits alongside our Terms & Conditions and our Refund Policy, which explain the commercial side of buying from us.

2. Summary — the short version

This is a fair summary of the whole policy. The sections below are the detail, and they are what actually govern.

• We collect what we need to get a kit to your door: your name, email, delivery and billing address, your phone number if you give one, and what you ordered.
• Card details go directly to our payment processor. KAIRO never sees or stores full card numbers. We only see the card brand, the last four digits and whether the payment went through.
• The Motion Kit is a one-time purchase. There is no subscription, no trial that turns into a charge, and no stored recurring billing profile.
• We do not sell your personal information for money. We share it with the suppliers who make the shop work — payment, shipping, email, analytics, hosting — under contract, and only for what we ask them to do.
• We only send marketing email if you asked for it. One click unsubscribes, and it never affects your order, your returns or your warranty.
• Cookies: the ones that make checkout work are always on. Analytics and advertising cookies are optional and you can control them.
• You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email support and we reply within 30 days.
• We keep order records for roughly seven years because tax and accounting law requires it, then delete them.
• We are based in the United States. If you are in the EU or UK, your information crosses the Atlantic, and section 9 explains the safeguards for that.

3. Information we collect

We collect personal information in three ways: you give it to us, we record it automatically as you use the site, and a small number of partners tell us things about your order.

(a) Information you give us

• Order details: your full name, email address, delivery address, billing address, and your phone number if you provide one. The phone number is passed to the carrier so they can reach you about the delivery.
• Order contents: which bundle you chose (1 kit at $49.95, 2 kits at $89.95 or 3 kits at $119.95), the shipping method, the order total in USD, the order number, and the date and time.
• Support messages: anything you write to support@vitalmanafter50.com, including photos or attachments you send — for example a picture of a damaged band for a warranty claim.
• Reviews and feedback: the rating, the text, and the display name you choose to publish it under. Please assume a review is public and do not put anything in it you would not want a stranger to read.
• Email sign-up: your email address, and where you signed up, if you opt in to our list.
• Anything else you volunteer: some customers mention a latex allergy, because the kit contains natural latex. If you tell us something like that, we use it only to answer you properly and we do not build a health profile from it.

We do not ask for your date of birth, government ID, social security number or any medical record, and you should not send them. The Motion Kit is general fitness equipment, not medical equipment, and we have no reason to hold health data.

(b) Information collected automatically

• IP address and the approximate location it suggests — usually the city or region, never precise GPS. We do not ask for or collect device location.
• Device and browser information: device type, operating system, browser name and version, screen size, and language settings.
• Usage information: which pages you viewed, in what order, how long you stayed, what you clicked, and whether you reached the checkout.
• Referrer: the website, link or ad that sent you to us.
• Timestamps for each request, plus basic server and error logs that tell us when something broke.

Most of this is collected through cookies and similar technologies, which section 7 explains and which you can control.

(c) Information we receive from others

• Payment processors confirm whether a payment succeeded or was declined, and pass back the card brand, the last four digits, the name on the card and whether the billing address matched. They never pass us the full card number.
• Shipping carriers send us tracking scans, delivery confirmations, delivery exceptions, and occasionally a corrected address when the one supplied could not be delivered to.
• Fraud-prevention services return a risk score for an order, calculated from order and device signals such as address mismatches or unusual ordering patterns.
• Our email provider tells us whether an email was delivered, bounced, opened or unsubscribed, so we can tell the difference between "not interested" and "never arrived".
• Advertising and analytics platforms may report that a visit or a purchase followed one of our ads. What we get back is normally aggregated and does not identify you by name.

4. Payment information

This is the part people worry about most, so we will be exact about it.

When you pay, your card number, expiry date and security code are typed into a payment field that is served and controlled by our payment processor, and they travel directly to that processor over an encrypted connection. They do not pass through our website's own storage, and there is no database at KAIRO in which a card number could sit.

What comes back to us, and all we can ever see against your order, is: whether the payment was approved, the card brand, the last four digits, the name on the card, the billing address used for verification, and a payment token. The token is a meaningless reference number that lets us issue a refund back to the original payment method without anybody at KAIRO ever handling the card details again.

Our payment processor is certified against the PCI DSS standard, which is the card industry's security standard for handling card data. Card networks and your own bank also process the transaction and apply their own privacy terms.

Your bank or card statement will show KAIRO as the merchant. Because the Motion Kit is a one-time purchase with no subscription, there is no stored billing arrangement to charge you again later and nothing for you to cancel.

If your chosen payment method involves a digital wallet or a third-party pay button, that provider's own privacy policy also applies to the information they collect from you.

5. How we use your information

• To fulfil your order. We take payment, generate a shipping label, dispatch from our facility in Columbus, Ohio within 24 hours (same working day if you ordered before 2pm ET), and hand your name, address and phone number to the carrier. For international orders we also pass the customs information needed so that duties are settled at checkout rather than charged to you on the doorstep.
• To keep you informed about that order. Order confirmation, dispatch notice with tracking, delivery confirmation and refund confirmation are service emails. They are part of the purchase, so you cannot unsubscribe from them while an order is live.
• To provide support, returns and warranty cover. We look up your order to answer questions, to check a return is inside the 30-day window, to send a prepaid return label for US orders or return instructions for international orders, and to honour the 2-year warranty on components. See the Refund Policy for how that works.
• To prevent fraud and abuse. We screen orders for signs of stolen cards, respond to chargebacks with evidence of dispatch and delivery, and block attempts to abuse the returns policy.
• To meet our legal obligations. Tax and accounting records, consumer-protection requirements, export and customs rules, and responding to lawful requests from authorities.
• To send marketing, only if you agreed to it. See section 13.
• To improve the site and the product. We look at aggregated analytics to see which pages are confusing, where people abandon checkout, and which errors are being thrown, and we read support themes to improve the routine guide and the kit itself.

We do not make decisions about you purely by automated means that produce legal effects. The one thing close to it is fraud screening, which can cause an order to be declined. If that happens to you, email us and a human will look at it.

6. Legal bases for using your information

If you are in the EU or UK, the law requires us to have a specific legal basis for each use of your information. Here they are, purpose by purpose. "Legitimate interests" means we have weighed our business need against your privacy and concluded the use is one you would reasonably expect — and you can object to any of them (section 12).

7. Cookies and similar technologies

Cookies are small files a website asks your browser to store. "Similar technologies" means the same idea by other means — pixels (a tiny invisible image that reports back when a page loads), local storage, and software development kits. We group them into four categories.

• Strictly necessary. These remember what is in your basket, carry your session through the checkout, apply security protections and keep the site load balanced. Without them the shop simply does not work, so they are always on and are exempt from consent requirements.
• Preferences. These remember choices such as your country, currency display or whether you have already dismissed a notice, so you are not asked again on every page.
• Analytics. These tell us how many people visited, which pages they read, how far down they scrolled and where they abandoned the checkout. We use this in aggregate to fix what is broken and rewrite what is unclear. We do not use analytics to make decisions about individual people.
• Marketing and advertising pixels. The site may load pixels from advertising platforms so that we can measure whether an ad led to a purchase, avoid showing ads to people who have already bought, and reach similar audiences. These set identifiers that the advertising platform can recognise, and for that activity the platform acts as its own controller under its own privacy policy.

Where the law requires consent before non-essential cookies are set, we ask for it first, and a refusal leaves the site fully usable — you can still browse, order and check out.

How to control cookies yourself

Every major browser lets you block or delete cookies without asking us. The setting is usually under Settings → Privacy and security (Chrome, Edge, Brave), Settings → Privacy & Security (Firefox) or Settings → Privacy (Safari, on both Mac and iPhone). From there you can block third-party cookies, block all cookies, delete what is already stored, or open a private window that discards everything when you close it.

Two honest warnings. Blocking all cookies, including the strictly necessary ones, will break the basket and the checkout — you will not be able to place an order. And because opt-out choices are themselves usually stored in a cookie, clearing your cookies can reset an opt-out you previously made, on that browser and device.

Advertising platforms also offer their own ad settings and opt-out pages, and industry tools such as the Digital Advertising Alliance and the European Interactive Digital Advertising Alliance opt-out pages cover many networks at once. Section 15 explains how we treat Global Privacy Control signals.

8. When we share your information

We share personal information in three situations: with the service providers who run parts of the shop for us, where the law requires it, and if the business itself changes hands.

Service providers (processors)

Each of these is bound by a written contract that limits them to doing what we ask, requires them to keep the data secure, and forbids them from using it for their own purposes.

• Payment processing and fraud prevention — receives your name, email, billing address, order amount and device signals in order to take payment and score risk.
• Fulfilment and shipping carriers — receive your name, delivery address, phone number and email so the parcel can be delivered and tracked, plus a customs description for international orders.
• Email delivery — receives your email address, first name and the order details needed to send confirmations, tracking and, if you opted in, marketing.
• Analytics, hosting and content delivery — receive your IP address and technical request logs so the site loads quickly and we can see how it is used.
• Advertising platforms — where pixels are active, receive online identifiers and events such as "viewed product" or "completed purchase".
• Professional advisers — our accountants and, if we ever need them, lawyers, under a duty of confidentiality.

Legal disclosures

We will disclose information if we are required to by law — a subpoena, court order, tax authority request or customs requirement — or where disclosure is necessary to investigate suspected fraud, to enforce our Terms & Conditions, or to protect the rights, property or safety of our customers or of Launchi LLC. Where we are legally allowed to, we push back on requests that look overbroad, and we tell the affected customer.

Business transfer

If Launchi LLC is sold, merged, or transfers the KAIRO brand and its assets, customer information would pass to the buyer as part of that transaction. The buyer would be required to honour this policy for information collected before the transfer, and if they intended a materially different use we would tell you by email or by a notice on the site before it took effect.

9. International data transfers

Launchi LLC is based in the United States. Our website hosting, our order records and most of our service providers are in the United States, and our warehouse is in Columbus, Ohio. If you order from us, or simply browse the site, from outside the US, your information is transferred to and processed in the United States.

Privacy law in the United States is not identical to the law in the EEA, the UK or Switzerland. Where we transfer personal information out of those regions, we rely on recognised safeguards, which in practice means one or more of the following:

• the Standard Contractual Clauses approved by the European Commission, with the UK Addendum or the UK International Data Transfer Agreement for UK data;
• a provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions, where that provider holds one;
• the derogation for transfers that are necessary to perform the contract you asked us to perform — sending you the parcel you ordered, which cannot be done without giving your address to a carrier.

Alongside those legal safeguards we apply practical ones: we send providers the minimum they need, everything travels over encrypted connections, and we do not transfer support-inbox contents to anyone who does not need to see them. If you want to know which safeguard applies to a specific transfer, email us and we will tell you.

10. How long we keep your information

We keep personal information only as long as we have a reason to. When the reason ends, we delete it or strip it of anything that identifies you.

• Order and transaction records — about seven years from the date of the order. This is not our preference, it is what US federal and state tax and accounting rules expect us to be able to produce.
• Warranty-related records — for the 2-year warranty period plus a further 12 months, so that a late claim can still be checked against the original order.
• Support tickets and email threads — 24 months after the conversation is closed. Threads attached to a return, refund or warranty claim are kept with the order record instead.
• Marketing contacts — until you unsubscribe. After you unsubscribe we keep a minimal suppression record of your email address indefinitely, for the sole purpose of making sure you are never added back and emailed again.
• Website and server logs — up to 12 months in raw form, after which they are aggregated into statistics that no longer identify anyone.
• Fraud and chargeback evidence — up to six years, because card scheme disputes and related legal claims can surface long after the sale.
• Published reviews — until you ask us to take yours down.

If a legal claim, dispute or regulatory request is live, we keep the relevant records until it is resolved even if one of the periods above has expired.

11. How we protect your information

• Encryption in transit. Every page on vitalmanafter50.com, including the checkout, is served over HTTPS, so what you type is encrypted between your device and the server.
• Card data never reaches us. The single most effective security measure we have is not holding the data at all — see section 4.
• Restricted access. Order and support data is visible only to the small number of people who need it to dispatch orders and answer messages. Accounts are individual rather than shared, administrative tools require multi-factor authentication, and access is removed when someone stops working with us.
• Vetted providers. We choose established providers for payment, hosting and email, and hold them to written data protection terms.
• Data minimisation. We do not collect ID documents, dates of birth or health records, so there is nothing of that kind to lose.

Being honest about the limits: no method of transmitting or storing data is 100% secure, and anyone who tells you otherwise is selling something. We cannot promise that our systems, or those of our providers, will never be compromised. What we can promise is that if a breach affects your personal information we will investigate it, fix it, and notify you and the relevant regulator where the law requires — within 72 hours of becoming aware, in the case of the GDPR.

You can help: use a strong, unique password on the email account tied to your order, and treat any message asking for card details or passwords as fraudulent, because we will never send one.

12. Your privacy rights

Depending on where you live, some or all of these rights apply to you by law. We choose to offer the core ones — access, correction and deletion — to every customer, wherever you are.

• Access. Ask what personal information we hold about you and get a copy of it.
• Correction. Have inaccurate or incomplete information fixed. If the address on a pending order is wrong, email us fast — once a parcel has left Columbus we can no longer change the label.
• Deletion. Ask us to erase your information where we have no overriding reason to keep it.
• Portability. Receive the information you gave us in a structured, machine-readable format, or ask us to send it to another company where that is technically feasible.
• Objection. Object to processing based on our legitimate interests. Objection to direct marketing is absolute — we stop, no questions asked.
• Restriction. Ask us to pause processing while an accuracy or objection question is being resolved.
• Withdraw consent. Where we rely on consent, such as marketing or optional cookies, you can withdraw it at any time. This does not undo processing that was lawful before you withdrew.
• Complain to a regulator. You can complain to your data protection or consumer authority. We would rather you gave us a chance first, but it is your right and you do not need our permission.

How to exercise your rights

1. Email support@vitalmanafter50.com with "Privacy request" in the subject line.
2. Tell us what you want — a copy, a correction, deletion, an opt-out — and roughly which orders or time period it concerns, if you know.
3. We verify that the request really comes from you. Normally it is enough to email from the address on the order, or to give us the order number plus the delivery ZIP or postcode. For higher-risk requests, such as bulk deletion, we may ask one further question. We do not ask for a photo of your ID unless there is no other safe way to be sure, and we never ask for card details.
4. We reply within 30 days. If a request is genuinely complex we may need longer — up to a further 60 days under the GDPR, or a further 45 days under California law — and we will tell you why before the first 30 days are up.

Requests are free. If a request is manifestly unfounded or repetitive we may charge a reasonable fee or decline it, and if we do we will explain the reason and how to challenge it.

One practical point on deletion: we cannot delete records that tax or accounting law requires us to retain, and if you ask us to erase everything while a return is still in progress, we may lose the ability to identify your parcel and issue your refund. If you have an open return, see the Refund Policy and let it complete first.

If you are in California (CCPA/CPRA)

• Right to know the categories and specific pieces of personal information we have collected, where it came from, why we collected it, and who we disclosed it to.
• Right to delete personal information we hold, subject to the legal exceptions above.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information for money. Because California defines "sharing" to include cross-context behavioural advertising, our advertising pixels can fall within it. To opt out, email us with "Do Not Sell or Share My Personal Information" in the subject, or send a Global Privacy Control signal from your browser (section 15).
• Right to limit the use of sensitive personal information. We do not collect sensitive personal information as California defines it, and we do not use or disclose any for purposes that would trigger this right.
• Right to non-discrimination. Exercising any of these rights changes nothing about how we treat you. The price is the same ($49.95, $89.95 or $119.95), shipping is still free, the 30-day return window and the 2-year warranty are unaffected, and support answers you just as quickly. We run no financial incentive programmes in exchange for your data.

You may use an authorised agent to make a request; we will ask for written proof that you gave them permission, and we may still contact you directly to confirm. We have not sold or shared the personal information of anyone we know to be under 16.

If you are in the EU, UK or Switzerland (GDPR)

All of the rights listed at the top of this section apply to you, and the legal basis for each use is set out in section 6. Launchi LLC is the controller and you can contact us directly at support@vitalmanafter50.com — your request goes to the people who actually hold the data, not to an outsourced desk.

If you are not satisfied with our answer, you can complain to the supervisory authority in the country where you live or work. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EEA it is your national data protection authority; the European Data Protection Board publishes the list. In Switzerland it is the Federal Data Protection and Information Commissioner.

13. Marketing emails and how to stop them

We only send marketing email to people who asked for it, by ticking the sign-up box at checkout or entering their address in a sign-up form on the site. Buying a kit does not sign you up by itself.

If you are on the list, expect occasional emails about new products, ways to use the bands, and the odd offer. We keep the volume low because we sell one product and there is only so much to say about it.

To stop them: click the unsubscribe link at the bottom of any marketing email. It works immediately, and at the very latest within 72 hours if an email was already queued. If the link fails, email support@vitalmanafter50.com and we will remove you by hand and confirm when it is done. Unsubscribing never affects your order, your right to return within 30 days, or your 2-year warranty.

You will still receive service emails while an order is live — confirmation, dispatch and tracking, delivery, and refund confirmation. These are not marketing and there is no unsubscribe link on them, because they carry information you need. Once your order is complete and any return is resolved, they stop by themselves. There is no subscription and no recurring billing, so there are no billing reminders to receive either.

We use your phone number for delivery only. We do not send marketing text messages. Carriers may text or call you about the delivery itself.

14. Children's privacy

This website and the KAIRO Motion Kit are intended for adults. The site is not directed at children, we do not market to children, and you must be at least 18 to place an order under our Terms & Conditions.

We do not knowingly collect personal information from anyone under 18, and in the EEA and UK we do not knowingly collect it from anyone under 16 (or the lower age of digital consent set by their country, which can be as low as 13). We do not ask visitors for their age, so we rely on being told.

If we discover that we hold personal information from a child, we delete it promptly and cancel any associated order. If you are a parent or guardian and believe your child has given us information, email support@vitalmanafter50.com and we will remove it and confirm to you that it is gone. Please also note the kit contains natural latex and small parts, and is not a toy.

15. Do Not Track and Global Privacy Control

Do Not Track (DNT) is a header some browsers can send. No common standard was ever agreed for what a website must do when it receives one, and no regulator enforces a particular response. Like most websites, we therefore do not change our behaviour in response to a DNT header. We would rather say so plainly than imply a protection that is not there.

Global Privacy Control (GPC) is different: it is a machine-readable signal that some browsers and extensions send, and California law treats it as a valid opt-out request. Where we receive a GPC signal, we treat it as a request to opt out of the sale or sharing of personal information for that browser on that device, and we apply it to the advertising pixels described in section 7.

Two limits worth knowing. GPC is tied to the browser and device that sends it, so you need it enabled on each one you use. And because the resulting opt-out is stored locally, clearing your cookies or site data can wipe it. If you want an opt-out that we apply to your customer record permanently, rather than to one browser, email us and ask for it — that one sticks regardless of what your browser does.

16. Third-party links

Our site and our emails contain links to places we do not control: carrier tracking pages, our payment provider's pages, and occasionally an article or a social media profile. Once you follow one of those links you are on someone else's website, governed by their privacy policy and their cookies, not ours. We are not responsible for their content or their data practices, and we have no ability to delete data you give them. It is worth a glance at their policy before you hand over anything.

For your safety: genuine links in emails from KAIRO go to vitalmanafter50.com or to the tracking page of the carrier handling your parcel. We will never link you to a page asking for your full card number or a password. If something looks off, forward it to support@vitalmanafter50.com and we will tell you whether it came from us.

17. Changes to this policy

We update this policy when our practices change, when we take on a new service provider, or when the law changes. The "Last updated" date at the top of this page always shows when the current version took effect, and it is the quickest way to check whether anything has moved since you last read it.

For minor changes — clearer wording, a corrected typo, a new example — we simply publish the updated page. For material changes, meaning changes that meaningfully affect how we use or share your information, we will post a notice on the site and, if you are on our email list, tell you by email before the change takes effect.

We will not apply a new policy retroactively to reduce your rights over information we already hold in a way that requires your consent, without asking for that consent. If you want a copy of an earlier version of this policy — for example the one in force on the date you ordered — email us and we will send it. Continuing to use the site after an update takes effect means you accept the updated policy; if you do not, stop using the site and ask us to delete your information.

18. How to contact us

Any question about this policy, your information, or a privacy request goes to the same place, and a person answers it.

To help us answer in one reply rather than three, include your order number if you have one, the email address you used to order, and what you would like us to do.

If you are unhappy with how we handled a privacy matter, tell us first — most problems are a misunderstanding we can fix the same day. If that does not resolve it, you can complain to your data protection authority (the ICO in the UK, your national authority in the EEA) or, in California, to the California Privacy Protection Agency or the California Attorney General.

For questions that are not about privacy, our Terms & Conditions cover ordering, shipping and governing law, and our Refund Policy covers the 30-day return window, prepaid US return labels and the 2-year warranty.