Last updated: September 18, 2026
The short version: Herval.co is a small, independent gardening blog. We collect only what we need to answer your messages, send the newsletter you ask for, and arrange any service you book. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use analytics only if you say yes. You can ask to see, correct, or delete your data at any time by writing to [email protected].
This Privacy Policy explains how Herval.co ("Herval," "we," "us," or "our") collects, uses, stores, shares, and protects personal information when you visit our website, read our gardening guides, subscribe to our newsletter, contact us, or book one of our services. It also explains the choices you have and the rights you may hold under laws such as the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, "CCPA/CPRA"), other US state privacy laws, and the Children's Online Privacy Protection Act (COPPA).
Please read this policy together with our Terms of Use, our Cookie Policy, and our Disclaimer. If you do not agree with this policy, please do not use the website or submit personal information to us.
1. Who we are
Herval.co is a gardening tools and resources blog owned, written, and operated by Henry Rootwell, based in the State of Oregon, United States. We publish gardening guides, tool reviews, and practical how-to content, and we offer a small number of consultation and workshop services to readers.
For the purposes of the GDPR and UK GDPR, Henry Rootwell, trading as Herval.co, is the "controller" of the personal data described in this policy. That means we decide why and how your personal data is processed and we are responsible for handling it lawfully. For the purposes of US state privacy laws, we are the "business" or "controller" that determines the purposes and means of processing.
You can reach us about anything in this policy at [email protected]. General questions can go to [email protected], or you may use our contact page.
2. Scope of this policy
This policy applies to personal information we process through the Herval.co website, our newsletter, our contact form, email correspondence, and the booking and delivery of our services. It does not apply to third-party websites, retailers, or platforms that we link to, including Amazon and other affiliate partners. When you click a link and leave our site, the privacy practices of that third party apply, and we encourage you to read their policies.
"Personal information" or "personal data" means any information that identifies, relates to, describes, or could reasonably be linked to you as an individual, such as your name, email address, or IP address. It does not include information that has been truly de-identified or aggregated so that it can no longer be associated with you.
3. Information we collect
We try to follow the principle of data minimization: we collect only what we need for a specific, stated purpose. We collect information in three ways: information you give us, information collected automatically, and information from cookies and similar technologies.
3.1 Information you provide to us
- Newsletter signup: your name and email address when you subscribe to our gardening newsletter.
- Contact form and email: your name, email address, the subject of your message, and anything you choose to write in the message body, such as questions about your garden, photographs you send, or details about your growing conditions.
- Service bookings: when you request one of our services through the contact form, we collect your name, email address, the service you are interested in, your preferred dates and times, and the practical details needed to deliver the service. Depending on the service, this may include your general location or growing zone, the size and layout of your garden, the tools you own, pest or plant problems you are experiencing, and your irrigation setup. If a service is delivered in person, we may also need a service address and a phone number.
- Payment-related information: if you pay for a service, we record what you paid, when, and for which service. Card or bank details are handled by the payment provider you use; we do not store full card numbers.
- Feedback, press, and advertising inquiries: if you write to [email protected], [email protected], [email protected], or [email protected], we receive your email address, name, organization (if given), and the content of your message.
Please do not send us sensitive personal information, such as health information, government identification numbers, financial account details, or information about your racial or ethnic origin, religious beliefs, or sexual orientation. Our services do not require this kind of information.
3.2 Information collected automatically
Like almost every website, our hosting infrastructure automatically receives certain technical information when your browser requests a page. This typically includes:
- your IP address;
- the date and time of the request;
- the page or file requested;
- the referring page (the page you came from), if your browser sends it;
- your browser type, version, and operating system (the "user agent"); and
- the HTTP status code and amount of data transferred.
These server logs are used to deliver the website, keep it secure, diagnose errors, and defend against abuse such as automated attacks. Herval.co is a static website, which means we do not run user accounts, logins, comment databases, or server-side tracking profiles.
3.3 Cookies, local storage, and analytics
We use a very small number of essential browser storage items, such as a localStorage entry that remembers your cookie-consent choice. If, and only if, you give consent, we may use privacy-friendly analytics to understand which guides are read most and how the site performs. We do not use advertising cookies, cross-site tracking pixels, or third-party behavioral advertising. Full details are in our Cookie Policy.
3.4 Information from third parties
We do not buy personal information. Affiliate programs such as the Amazon Associates Program give us aggregated, non-identifying reports (for example, the number of clicks and the number and value of qualifying purchases). These reports do not tell us who you are or what you personally purchased. If you pay for a service through a payment provider, that provider may send us a confirmation that includes your name, email address, and the amount paid.
4. How we use your information and our legal bases
Under the GDPR and UK GDPR, we must have a lawful basis for each use of personal data. The table below explains what we do with your information and why we are allowed to do it. US readers can treat the "purpose" column as our notice of the business purposes for which we collect and use personal information.
| Purpose | Categories of data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Sending the newsletter you requested | Name, email address, subscription date, consent record | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Responding to messages sent through the contact form or by email | Name, email address, message content | Legitimate interests (Art. 6(1)(f)) in answering reader questions; or steps taken at your request before entering into a contract (Art. 6(1)(b)) |
| Arranging, scheduling, and delivering booked services | Name, email, phone, service address, garden details, booking dates | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, payments, refunds, and bookkeeping | Name, email, service booked, amounts and dates of payment | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax and accounting records |
| Operating, securing, and troubleshooting the website | IP address, server logs, device and browser data | Legitimate interests (Art. 6(1)(f)) in keeping the site available and secure |
| Remembering your cookie-consent choice | Consent value and timestamp stored in your browser | Legal obligation (to record consent) and legitimate interests; this storage is strictly necessary |
| Understanding site usage through privacy-friendly analytics | Pseudonymous or aggregated usage data (pages viewed, referrer, device type, approximate country) | Consent (Art. 6(1)(a)); analytics runs only after you opt in |
| Earning affiliate commissions through links to retailers | No personal data held by us; the retailer processes click data under its own policy | Legitimate interests (Art. 6(1)(f)) in funding the website |
| Handling press, advertising, and editorial inquiries | Name, email, organization, message content | Legitimate interests (Art. 6(1)(f)) in running the business |
| Complying with law, enforcing our terms, and defending legal claims | Any relevant data we hold | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms, and we have concluded that they are not, because the processing is limited, expected, and low-risk. You have the right to object to processing based on legitimate interests, as explained below.
We do not use your personal information for automated decision-making, including profiling, that produces legal or similarly significant effects on you.
5. Our newsletter
If you sign up for the Herval.co newsletter, we use your name and email address to send you gardening tips, seasonal reminders, new guides, and occasional notices about our services. Some newsletters may contain affiliate links; these are always disclosed.
We send the newsletter only to people who have asked to receive it. We may use a confirmation ("double opt-in") email to verify your address. Every newsletter includes a working unsubscribe link, and we honor unsubscribe requests promptly, and in any event within ten business days as required by the US CAN-SPAM Act. Our emails identify Herval.co as the sender, use truthful subject lines, and include a valid way to contact us. You can also unsubscribe by writing to [email protected].
We may use a reputable email service provider to store the subscriber list and deliver emails. That provider acts as our processor and may record basic delivery information, such as whether a message was delivered or bounced. Where the provider offers open or click tracking, we either disable it or use it only in aggregate to improve the newsletter; you can block such tracking by disabling images in your email client. After you unsubscribe, we may keep your email address on a suppression list solely to make sure we do not email you again.
6. The contact form
When you submit our contact form, the information you enter is transmitted securely to us so that we can read and reply to your message. Because the site is static, the form is processed by a form-handling or email delivery service acting on our behalf, which forwards your submission to our inbox. We use your message only to respond to you and, where relevant, to arrange a service. We do not add contact-form senders to the newsletter unless they separately and expressly subscribe.
We may use basic spam-prevention measures, such as a hidden "honeypot" field or rate limiting, to protect the form from automated abuse.
7. Service bookings
We offer five services: Garden Tool Consultation, Garden Design & Planning, Tool Sharpening & Maintenance Workshops, Organic Pest Control Consultation, and Irrigation & Sprinkler Planning. All are requested through the contact form. When you book a service, we use your information to:
- confirm availability, fees, and scheduling;
- prepare for the session, for example by reviewing photographs or descriptions of your garden, tools, or irrigation system;
- deliver the service in person, by video call, or by email;
- send follow-up notes, plans, or recommendations you have paid for;
- process payments, cancellations, rescheduling, and refunds; and
- keep business and tax records.
If you share photographs of your property, please avoid including people, vehicle license plates, or house numbers that are not needed. We will not publish your photographs, garden plans, or story on the website without your separate, express permission. If a service is delivered by video call, the video platform processes your data under its own privacy policy; we do not record sessions without your prior agreement.
8. Affiliate links and third-party services
Herval.co participates in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn fees by linking to Amazon.com and affiliated sites. As an Amazon Associate we earn from qualifying purchases. We may also participate in other affiliate programs operated by retailers or affiliate networks.
When you click an affiliate link, you leave Herval.co and go to the retailer's website. The retailer or affiliate network may place cookies or use similar technologies on its own site to record that you arrived from our link, so that we can be credited for a qualifying purchase. This happens on the retailer's website, not ours, and is governed by the retailer's privacy and cookie policies. We do not receive your name, address, payment details, or order history. We only see aggregated reports.
We may also rely on the following categories of third-party service providers:
- website hosting and content delivery (for serving the static site and its server logs);
- form handling and email delivery (for the contact form);
- email marketing (for the newsletter);
- privacy-friendly analytics (only with your consent);
- payment processing (for paid services);
- video conferencing (for remote consultations); and
- professional advisers such as accountants and lawyers.
9. How we share information
We do not sell personal information, and we do not rent or trade our mailing list. We share personal information only in these limited circumstances:
- Service providers (processors): with the vendors listed above, who process data on our instructions, under contracts that require them to keep it confidential and secure and to use it only to provide services to us.
- Legal requirements: when we believe in good faith that disclosure is required by law, regulation, subpoena, court order, or other legal process, or is necessary to protect the rights, property, or safety of Herval.co, our readers, or others.
- Business transfers: if Herval.co is sold, merged, or transferred, personal information may be transferred to the new owner, who will be bound by this policy or will notify you of any changes.
- With your consent: in any other case where you have asked us to, or agreed that we may, share your information.
10. International data transfers
Herval.co is operated from the United States, and our service providers may store and process data in the United States or other countries. If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal data will be transferred to a country that may not provide the same level of data protection as your home country.
Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), or a provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions, where available. Some transfers, such as replying to a message you send us, may also be necessary to take steps at your request. You may ask for more information about these safeguards by writing to [email protected].
11. How long we keep your information
We keep personal information only for as long as it is needed for the purposes described in this policy, unless a longer period is required or permitted by law. When the retention period ends, we delete the data or anonymize it.
| Type of data | Retention period |
|---|---|
| Newsletter subscriber name and email | Until you unsubscribe; then moved to a suppression list (email only) to honor your opt-out |
| Contact-form messages and general email correspondence | Up to 24 months after our last exchange, then deleted |
| Service booking records, notes, and plans | Up to 3 years after the service is completed, so we can answer follow-up questions and handle any claims |
| Invoices, payment, and tax records | Up to 7 years, as required for US tax and accounting purposes |
| Server logs | Generally no longer than 30 days, unless needed to investigate a security incident |
| Cookie-consent choice (in your browser) | 12 months, after which we ask again |
| Consent-based analytics data | Aggregated reports kept indefinitely; any pseudonymous raw data no longer than 24 months |
| Records of privacy requests | 24 months, as required by certain US state laws |
12. How we protect your information
We use reasonable administrative, technical, and physical safeguards appropriate to a small publication. These include serving the site exclusively over HTTPS, keeping the site static to reduce the attack surface, using strong, unique passwords and multi-factor authentication on the accounts we use to run Herval.co, limiting access to personal information to people who need it, and choosing service providers with good security practices.
No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. If we learn of a data breach that affects your personal information, we will notify you and the relevant authorities where the law requires us to do so.
13. Your privacy rights
Your rights depend on where you live. We extend the core rights below to all readers where reasonably practicable, regardless of location.
13.1 Rights under the GDPR and UK GDPR
If you are in the EEA, the UK, or Switzerland, you have the right to:
- Access the personal data we hold about you and receive a copy of it;
- Rectification of inaccurate or incomplete data;
- Erasure ("the right to be forgotten") in certain circumstances;
- Restriction of processing in certain circumstances;
- Data portability, meaning to receive data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller;
- Object to processing based on our legitimate interests, and to object at any time to direct marketing;
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and
- Lodge a complaint with a supervisory authority, such as the data protection authority in your EU member state or the UK Information Commissioner's Office (ICO). We would appreciate the chance to address your concerns first.
13.2 Rights under the CCPA/CPRA (California)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose, including the categories of personal information, the categories of sources, the business purposes, and the categories of third parties to whom we disclose it;
- Access the specific pieces of personal information we have collected about you;
- Delete personal information we collected from you, subject to certain exceptions;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of your personal information;
- Limit the use and disclosure of sensitive personal information (we do not collect sensitive personal information for purposes that trigger this right); and
- Non-discrimination: we will not deny you services, charge different prices, or provide a different quality of service because you exercised your rights.
Do Not Sell or Share My Personal Information. We do not sell personal information and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. Affiliate links send you to a retailer's site, where the retailer sets its own tracking under its own policy; we do not pass any personal information about you to the retailer. If you would still like to record an opt-out preference with us, email [email protected] with the subject line "Do Not Sell or Share," and we will honor it.
Categories collected in the last 12 months: identifiers (name, email address, IP address, phone number if provided); customer records (service address, payment records); internet or network activity (server logs and, with consent, analytics); geolocation at a general level (approximate country or region derived from IP, or growing zone you tell us); and audio, electronic, or visual information (photographs you choose to send). These are collected from you directly and from your device, and used for the business purposes listed in section 4. They are disclosed for business purposes only to the service provider categories listed in section 8.
13.3 Rights under other US state laws
Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, may have rights to confirm whether we process their personal data, to access, correct, delete, and obtain a portable copy of it, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of significant decisions. Oregon residents may also request a list of the specific third parties to which we have disclosed personal data. Although some of these laws may not apply to a publication of our size, we will honor such requests. If we decline a request, you may appeal by replying to our decision with the subject line "Appeal"; we will respond within the period required by your state's law, and if you are dissatisfied with the outcome you may contact your state Attorney General.
14. How to exercise your rights
- Email [email protected] with a description of your request (for example, "access," "delete," or "correct"), or use our contact page.
- Tell us the email address you used with Herval.co so that we can locate your data.
- We will verify your identity, usually by confirming that you control that email address. We will not ask for more information than we need to verify you.
- We will acknowledge your request within 10 business days and respond within one month (GDPR/UK GDPR) or 45 days (US state laws). Where the law allows, we may extend this period if a request is complex, and we will tell you if we do.
You may use an authorized agent to submit a request on your behalf. We may ask the agent to provide proof of your written permission, and we may ask you to verify your identity directly. Requests are free of charge unless they are manifestly unfounded or excessive.
15. Children's privacy
Herval.co is a general-audience website intended for adults. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13, consistent with COPPA. Our newsletter and services are intended for people aged 18 or older (or the age of majority where they live). In the EEA and UK, we do not knowingly process the personal data of children under 16 based on consent.
If you are a parent or guardian and believe that your child has given us personal information, please contact [email protected]. We will delete the information promptly. Young gardeners are welcome to enjoy our guides with a parent or guardian, who should handle any correspondence with us.
16. Do Not Track and Global Privacy Control
Some browsers send a "Do Not Track" (DNT) signal. Because there is no common industry standard for how to respond to DNT, we do not respond to it in a specific way. However, we do not track you across other websites, and optional analytics run only with your consent.
We recognize the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising, as applicable, and we will not load optional analytics for that browser even if a consent banner is shown. Because GPC is browser-based, it applies only to the browser that sends it.
17. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or the law. When we do, we will change the "Last updated" date at the top of this page. If the changes are material, we will provide a more prominent notice, such as a note on the website or an email to newsletter subscribers, before the changes take effect. Where the law requires your consent to a change, we will ask for it.
18. Contact us
If you have any questions, concerns, or requests about this Privacy Policy or how we handle your personal information, please contact:
- Privacy requests: [email protected]
- General questions: [email protected]
- Contact form: herval.co contact page
Herval.co is owned and operated by Henry Rootwell, Oregon, United States. We aim to answer every privacy message personally and promptly.
Related policies: Terms of Use · Cookie Policy · Disclaimer