Natural wellness, made simple

Privacy notice

Last updated: 5 November 2026

1. Who we are

Nook & Root sends a free email newsletter about real food and everyday wellness. We are responsible (the "controller") for the personal data described here. Nook & Root is run from Singapore. Contact: david@nookandroot.com.

Data protection officer: david@nookandroot.com. Contact our data protection officer about any data protection question or request.

Which laws we follow. Our main law is Singapore's Personal Data Protection Act 2012 (PDPA), because we run the business from Singapore.

Who our newsletter is for. Our newsletter is for readers in the United States, Canada, Australia and New Zealand. We do not aim it at readers in the UK, Ireland or the rest of the European Union. We have not appointed a representative in the EU or UK. You can contact us directly at david@nookandroot.com about any privacy matter.

2. What we collect

  • Your email address (required) and first name (optional).
  • A consent record: the date and time you signed up, the form (and version) you used, and the consent wording shown to you.
  • Sign-up details captured by our form: the page version you saw, which guide you asked for, and campaign tags in the link you used (UTM parameters).
  • Whether you open our emails and which links you click, recorded by Brevo (see section 5).
  • If you reply to us: your email, which goes to david@nookandroot.com and is stored in our Gmail inbox (see section 5).
  • A reply log, kept with minimal data: initials or an ID, not your full email or any health details.

We do not ask for your country on our sign-up form.

Giving your data is voluntary. Without an email address, we can't send you the newsletter.

3. Why we use it, and our legal basis

We use your data to send you the guide and our newsletter (which may include affiliate links), and to keep a record of your consent. Our legal basis is your consent. You can withdraw it at any time by clicking "unsubscribe" in any email or by emailing us. Withdrawing consent does not affect emails we sent before.

4. Cookies and analytics

There are no analytics or advertising cookies or tracking pixels on this site. Our sign-up form loads Google reCAPTCHA, which may set cookies for security and bot detection (see section 5). We do not install the Brevo tracker, which Brevo says places a visitor_id cookie when installed (Brevo: the Brevo tracker).

5. Who processes your data, and where

Brevo (newsletter). Our subscriber list is stored in Brevo (Sendinblue SAS, France), which processes it on our behalf. Brevo says its databases are hosted in the EU, in France and Germany (OVH) and Belgium (Google Cloud) (Brevo: Data storage location). Some of Brevo's own sub-processors may handle data outside the EU, including the US; Brevo says it protects these transfers with Standard Contractual Clauses and may rely on the EU-US Data Privacy Framework (Brevo privacy policy). Brevo's Data Processing Agreement, Annex 2 (in its Terms of Use, version 1 October 2025), lists its core sub-processors as OVH (hosting, France), Google Cloud (hosting, Belgium), Cloudflare (content delivery, USA/EU), Zendesk (support tickets, EU/USA) and Omni (dashboards, EU), with Standard Contractual Clauses or the EU-US Data Privacy Framework for transfers. Other listed sub-processors (SMS, AI, landing pages) apply only if we use those services, and we don't.

We measure email opens and clicks. Brevo records, for each subscriber, whether you open our emails and which links you click, using a small tracking image and tracked links (Brevo help). We use this only to improve our emails and to remove inactive subscribers. We never use it to profile you, sell data, share with merchants or target ads.

Google reCAPTCHA (sign-up form). Our sign-up form (provided by Brevo) uses Google reCAPTCHA to check that sign-ups come from a person, not a bot. It loads Google scripts and may collect device and browser information and set Google cookies. This is a service provided by Google, and Google handles this data under its own Privacy Policy and Terms of Service. Google may process this data outside your country, including in the US.

Namecheap and Google (replies). If you reply to us, your email goes to our address at david@nookandroot.com. Namecheap forwards it, using its free email forwarding, to a Google (Gmail) mailbox, where it is stored. Namecheap acts as our processor for email forwarding. Our newsletter emails, and our replies to you, are sent from david@nookandroot.com through Brevo (our replies use Brevo's email relay, SMTP), so Brevo also processes our manual replies (see Brevo above). Namecheap says it processes data on US-based servers (Namecheap privacy policy). Google may store and process data in many countries, including the US (Google privacy policy). Our Gmail account is a free personal account, which is covered by Google's Terms of Service and Privacy Policy. Google says it does not offer a data processing agreement for consumer Gmail and does not act as a data processor for it (Google Privacy Help Center).

We may use AI-assisted tools to help draft replies; a person reviews every reply before it is sent.

6. We do not sell your data

We do not sell or share your personal data, and we do not use it for targeted advertising.

7. How long we keep it

  • Your subscriber data is kept until you unsubscribe.
  • If you haven't opened or clicked any of our emails for about 11 months, we send you one plain "Still want these emails?" message. If you don't respond, we remove you at 12 months.
  • After you unsubscribe, we keep your email address only on a suppression list, so we honour your opt-out and don't email you again.
  • We keep your consent record for 3 years after you unsubscribe, as proof that we had your permission.

8. Your rights

Email our data protection officer at david@nookandroot.com to use any right below. It's free. We may ask you to confirm your identity. We reply within the time the law sets, for example:

  • Singapore (PDPA 2012): we give access or make corrections as soon as reasonably possible. If we can't within 30 days, we will tell you in writing within those 30 days when we will respond (Personal Data Protection Regulations 2021, reg. 5).
  • Canada (PIPEDA): within 30 days, extendable by up to 30 more days in limited cases (OPC).
  • Australia (APP 12): within a reasonable period, which the OAIC says should generally not exceed 30 calendar days (OAIC).
  • New Zealand (Privacy Act 2020): we respond to access and correction requests as soon as reasonably practicable and within 20 working days (Privacy Act 2020 ss.44 and 63). If we need more time on the grounds the Act allows, we will tell you within those 20 working days. Sources: Office of the Privacy Commissioner guidance; s.44.
  • UK/EU: within one month, extendable by two months for complex or repeated requests (ICO).

We usually reply much sooner.

  • Singapore (Personal Data Protection Act 2012, PDPA), our main law: we run the business from Singapore, so the PDPA applies. You can ask for access to your data and how it has been used or disclosed in the past year, and ask us to correct it (PDPA ss.21-22). You can withdraw your consent at any time with reasonable notice, for example by unsubscribing (s.16). Singapore's data portability obligation is not yet in force; the PDPC says it will take effect when regulations are issued (PDPC: data protection obligations). Singapore's Do Not Call rules cover calls, texts and faxes to Singapore phone numbers, not email, and we don't send those (PDPC: DNC provisions).
  • Canada (CASL, PIPEDA): we email you only with your express consent; you can unsubscribe at any time. You can ask to access and correct your data.
  • Australia (Privacy Act 1988, Australian Privacy Principles, Spam Act 2003): access and correction, and opting out of direct marketing at any time, free of charge.
  • New Zealand (Privacy Act 2020): you can ask us to confirm whether we hold personal information about you and to access it (information privacy principle 6), and to correct it (principle 7). If we do not make a correction you asked for, you can give us a statement of correction to keep with your information. We respond within 20 working days as set out above. If we disclose your information to a service provider outside New Zealand (for example Brevo in the EU, or Google, which may process reCAPTCHA data in the US), we take steps consistent with principle 12 so that comparable privacy safeguards apply. You can complain to New Zealand's Office of the Privacy Commissioner. Sources: IPP 6; IPP 7; IPP 12.
    New Zealand (Unsolicited Electronic Messages Act 2007): we send commercial emails only with your express consent: you subscribe by ticking or submitting our sign-up form yourself, and we keep a record of when and how you signed up. Every email identifies who authorised it and how to contact us, and includes a free, working unsubscribe link. When you unsubscribe, we stop further marketing emails within five working days. Sources: Unsolicited Electronic Messages Act 2007; DIA Compliant Electronic Marketing guidance.
  • Everyone, wherever you live (including the US): we honour requests to access or delete your data and to opt out of our emails.
  • UK and EU (UK GDPR, EU GDPR, PECR): we don't aim our newsletter at the UK or EU, but if you live there you can still ask for access, correction, deletion, restriction, objection, portability, and to withdraw consent. We email you only with your consent, and every email has an unsubscribe link.

We take steps to keep your data secure. You can complain to a regulator: Singapore's Personal Data Protection Commission (PDPC), the Office of the Privacy Commissioner of Canada (OPC), the Office of the Australian Information Commissioner (OAIC), New Zealand's Office of the Privacy Commissioner, the ICO (UK), or your local EU data protection authority. We'd be grateful if you contacted us first so we can try to help.

9. Affiliate links

Some of our emails and pages contain affiliate links, clearly labelled. If you buy through one, we may earn a commission at no extra cost to you. The merchant's site then has its own privacy notice and may set its own cookies. We do not pass your email address to merchants.

10. Children

Our newsletter is not for anyone under 16, and we do not knowingly collect their data. If you think a child has signed up, email us and we'll delete it.

11. Changes to this notice

If we change this notice, we'll update the date at the top. If it's a significant change, we'll tell subscribers by email.