Who we are
Second Spring is a website operated by Leadspire LLC ("we," "us"), 8 The Green, Ste A, Dover, DE 19901, USA. We're an independent dōTERRA® Wellness Advocate. We don't sell products on this site: The Second Spring Ritual is ordered and billed on doterra.com, which has its own privacy policy. This policy explains what we collect on secondspringritual.com and in our emails, why, and what you can do about it.
The short version
- We don't ask for health information. The quiz asks only about the shape of a day, and its answers never go to Meta.
- We collect your email only if you give it to us, to send the ritual guide and a few short emails. You can unsubscribe in one click.
- We use Meta (Facebook and Instagram) advertising tools, the Meta Pixel and the Conversions API, to understand which ads brought you here and whether they worked. Under California law this may count as "sharing" personal information. You can opt out with the link in our footer, and we honor Global Privacy Control.
- We keep what we collect for 13 months after your last interaction, then an automatic job deletes or anonymizes it.
- We never see your payment details. dōTERRA handles checkout and the monthly billing.
- We don't sell your personal information for money. We don't knowingly collect information from anyone under 16.
Health information
We do not collect health information. No form on this site asks about symptoms, conditions, medication, age, or your body. The quiz asks only about daily routine: when the day starts, when a pause happens, how the evening ends. We don't try to infer health information from what you do on the site, we don't build health profiles, and we don't use location data or geofencing.
Because the products described here are dietary supplements and essential oils, some state laws (for example Washington's My Health My Data Act and similar laws in Nevada and Connecticut) could treat the bare fact of a visit as health-related. So we keep what Meta receives to standard, neutral events (page view, content view, guide request, checkout click, confirmed order) with the product name, never quiz answers or anything you write to us. You can turn that sharing off at any time (see Do Not Sell or Share), and you can ask us to delete everything we hold about you.
Please don't send us health details by email. If you do, we use them only to reply and then delete them; we never add them to our records or share them.
What we collect
Information you give us
- Email address and, optionally, first name, when you ask for the ritual guide before checkout.
- The email you used at checkout and, optionally, your order number, when you confirm an order on our Confirm page.
- Your review, if you choose to write one after ordering (see Reviews).
- Anything you write to us by email.
Information collected automatically when you visit
- Device and browser information: IP address (stored only as a one-way hash), browser type, operating system, language.
- Site activity: pages viewed, buttons clicked, the link you clicked to reach checkout.
- How you got here: referring site, campaign parameters in the URL (utm_source, utm_medium, utm_campaign, utm_content, ad set and ad identifiers), and the Meta click identifier (fbclid).
- Cookies and similar identifiers, listed below.
Information from dōTERRA
dōTERRA may send us, as the referring Wellness Advocate, a notification when an order placed through our link is completed. Where it does, it may include the buyer's name, the email used, the date, and the order type. We use it only to match confirmations and measure our advertising. We don't receive your payment details from dōTERRA, and we don't share dōTERRA's customer lists with anyone.
Cookies and similar technologies
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
ss_sid | us | A random visit identifier, so one visit counts as one visit and an order confirmation can be matched to the ad that led to it | 13 months |
ss_consent | us | Remembers your "Do Not Sell or Share" and "Limit Use" choices on this browser | 13 months |
_fbp | Meta | Meta Pixel browser identifier used to measure and deliver ads | 90 days |
_fbc | us / Meta | Stores the Meta click identifier (fbclid) from the ad you clicked so the order can be attributed to it | 90 days |
We don't use third-party analytics suites, session-replay tools, or advertising networks other than Meta. We don't show a cookie banner because US law doesn't require one for this use; instead, we give you the opt-out link described below and honor Global Privacy Control signals. When you opt out, the Meta cookies are no longer set by the Pixel on this browser.
How we use information
- To send you the ritual guide and the short email series you asked for, and to answer your messages.
- To know whether you completed your order, so we can stop the pre-purchase emails and send the welcome emails instead.
- To measure and improve our advertising: which ad, ad set, and campaign led to a visit, a click to checkout, and a confirmed order.
- To publish reviews you gave us permission to publish.
- To keep the site secure, stop abuse, and fix errors.
- To comply with the law and enforce our Terms of Use.
We don't use your information to make automated decisions with legal or similarly significant effects.
The day quiz
If you take the quiz at /quiz, we store your multiple-choice answers about your daily routine and the result, never your name or email, linked only to the random visit identifier described above, so we can improve the page and see whether the quiz helps. The quiz never asks about health, symptoms, age, or your body. Quiz answers are never sent to Meta and are not used for advertising or ad targeting. If you then ask for the ritual guide, that email address is handled like any other guide request.
Meta Pixel and Conversions API
We use the Meta Pixel (in your browser) and the Meta Conversions API (from our server) to send Meta Platforms, Inc. ("Meta") standard events: a page view, a content view, a guide request, a click to checkout, and a confirmed order, with the product name and price. Before your email, first name, or our visit identifier is sent to Meta, we hash it with SHA-256, so Meta receives a scrambled string rather than the plain value. Your IP address and browser user agent are sent as they are, because Meta requires them in that form to match events; we store the IP address only as a hash. Meta uses this data to attribute orders to our ads, to build audiences, and for its own purposes described in Meta's Privacy Policy and Business Tools terms. Meta may combine it with other data it holds about you.
Under the California Consumer Privacy Act as amended by the CPRA, disclosing personal information to Meta for cross-context behavioral advertising is "sharing." You can opt out at any time using the Do Not Sell or Share My Personal Information link in our footer. When you do, or when your browser sends a Global Privacy Control signal, we stop loading the Pixel in your browser and stop sending server-side events about you to Meta (we still count the visit for ourselves), and we set a cookie to remember that choice on this device and browser.
We send email through Lettermint, an email delivery provider that processes your address and message content on our behalf under a contract that limits its use to delivering our mail. We send marketing email only with your consent, given when you check the box in our form. Every email includes a one-click unsubscribe link and our postal address, as required by the CAN-SPAM Act. We may still send a one-time transactional reply if you write to us.
Reviews
About a month after a confirmed order we may email you a private link to review the ritual. If you write one, we store the name you choose (first name and last initial), your state if you give it, your rating, and your text. We publish it only if you tick the box that allows it, and we publish it unedited. We moderate by content (for example, we leave out personal details, health claims, or anything about other people), never by rating.
Service providers
We share information only with companies that process it for us under contract: Lettermint (email delivery), Railway (hosting and the Postgres database, United States), Cloudflare (DNS, security, and content delivery), and Meta (advertising measurement, as described above). We don't sell personal information for money.
How long we keep it
We keep personal information for 13 months from your last interaction with us (a visit, a form you send us, or an order confirmation). After that, an automatic job that runs several times a day:
- deletes visit records, checkout clicks, advertising events and dōTERRA order notifications older than 13 months;
- deletes your email address and name from our list, with any scheduled emails;
- anonymizes order confirmations: email, name and order number are removed, and only the date and the product remain, so we can still count orders;
- removes the link between anonymous quiz answers and the visit they came from.
Two exceptions. If you unsubscribed, we keep only your email address and the fact that you unsubscribed, so we never email you again. Reviews you allowed us to publish stay up until you ask us to remove them; reviews that weren't published are deleted after 13 months. We may also keep records longer where the law requires it or to resolve a dispute.
Your rights under California law (CCPA/CPRA)
If you live in California, you have the right to:
- Know what personal information we collect, use, disclose, and share, and to receive a copy.
- Delete personal information we hold about you, with legal exceptions.
- Correct inaccurate personal information.
- Opt out of sale or sharing of your personal information. Use the Do Not Sell or Share My Personal Information link in our footer, or turn on Global Privacy Control in your browser; we honor a GPC signal as an opt-out request for that browser.
- Limit the use of sensitive personal information. We don't collect sensitive personal information as defined by the CPRA (such as health information, precise location, or account credentials) and we never ask about your health. If you volunteer such information in an email, we use it only to reply. The Limit the Use of My Sensitive Personal Information link in our footer records your request and we honor it.
- Not be discriminated against for exercising any of these rights.
To exercise your rights, email hello@secondspringritual.com with the subject "Privacy request." We'll verify your request by matching the email you write from against our records; we may ask one or two follow-up questions. We respond within 45 days, extendable once by 45 days with notice. You may use an authorized agent; we'll ask for written permission and may still verify your identity directly.
Notice at collection (categories, as defined by the CCPA): identifiers (email, first name, IP address, cookie IDs, Meta click ID); internet or network activity (pages viewed, clicks, referrer, campaign parameters); commercial information (whether you confirmed an order); inferences we draw (whether you're likely to be interested in follow-up emails about the ritual). Sources: you, your browser, Meta, and dōTERRA's referral notifications. Purposes: as listed under "How we use information." Disclosed to the service providers listed above. Shared for cross-context behavioral advertising with Meta (identifiers and internet activity) unless you opt out. Not sold for money. Retained 13 months.
In the past 12 months we have not sold personal information. We have shared identifiers and internet activity with Meta for advertising as described.
Do Not Sell or Share My Personal Information
Use the control below to opt out of the sharing of your personal information with Meta for cross-context behavioral advertising on this device and browser. We also honor Global Privacy Control signals.
Do Not Sell or Share My Personal Information
Limit the Use of My Sensitive Personal Information
We don't collect sensitive personal information and never ask about your health. If you want your request recorded anyway, use the control below; we honor it.
Limit the Use of My Sensitive Personal Information
Other US states
Residents of states with comparable privacy laws (including Colorado, Connecticut, Nevada, Oregon, Texas, Utah, Virginia, and Washington) may have similar rights of access, deletion, correction, and opt-out of targeted advertising, and, under consumer health data laws, the right to ask us not to share any data that could be read as health-related. Use the same contact and footer links; we apply the same process. If we decline a request, you can appeal by replying to our answer with the subject "Appeal"; we respond within 45 days.
Children
This site is for adults. We don't knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we'll delete it.
Security
We use HTTPS everywhere, store secrets outside our code, hash IP addresses before storing them and email addresses before sending them to Meta, restrict database access to the people who run the site, and keep logs for debugging only. No system is perfectly secure; if a breach affects you, we'll notify you as the law requires.
Do Not Track
Browsers can send a "Do Not Track" signal. There's no agreed standard for it, so we don't respond to it specifically; we do honor Global Privacy Control as an opt-out of sharing.
Links to other sites
Our site links to doterra.com and to Meta. Their privacy policies, not ours, govern what they collect.
Changes
If we change this policy in a meaningful way, we'll update the date at the top and, if you're on our email list, tell you by email. Continued use of the site after the date means you accept the updated policy.
Contact
Leadspire LLC · 8 The Green, Ste A, Dover, DE 19901, USA · hello@secondspringritual.com