Privacy policy
Last updated: 18 September 2026 Effective date: 18 September 2026
Summary of key points
This summary highlights the most important points. Please read the full Policy below for the complete picture.
- Who we are. OnyGuard is a brand operated by Prolong Lab, UAB, a company registered in Lithuania. We are the controller of your personal information.
- What we collect. Your name, contact details, delivery and billing addresses, order history, payment details (handled by our payment processors, not stored by us), your communications with our support team, and technical information about your device and how you use our website.
- Health-related information. Because our products are used for foot and nail care, the fact that you purchase, browse or ask questions about them may reveal information about your health. We treat this as sensitive information. See Section 4 and Section 17.3.
- Advertising. We use cookies, pixels and similar technologies from advertising and analytics companies. Under several United States state privacy laws this counts as a "sale" of personal information and as "sharing" for targeted advertising. You can opt out at any time — see Section 8.
- We do not sell your phone number. Mobile phone numbers and text message consent are never shared with third parties or affiliates for their own marketing purposes. See Section 12.
- Your rights. Depending on where you live, you can ask us to give you a copy of your information, correct it, delete it, stop selling or sharing it, or limit how we use sensitive information. See Section 17.
- How to reach us. Email support@onyguard.com, call +1 (888) 530-7470, or write to Prolong Lab, UAB, Dominikonų g. 11, LT-01131 Vilnius, Lithuania.
1. Who we are and how to contact us
OnyGuard is a trading brand of:
Prolong Lab, UAB Dominikonų g. 11 LT-01131 Vilnius Lithuania
Company registration number: 307116099 Value Added Tax identification number: LT100017808315
Privacy and customer support: support@onyguard.com Telephone (toll-free, United States): +1 (888) 530-7470
Prolong Lab, UAB is the "controller" (under European and United Kingdom data protection law), the "business" (under United States state privacy laws), and the "organisation" or "regulated entity" (under Canadian and Australian privacy law) responsible for the personal information described in this Policy.
Our data protection point of contact can be reached at support@onyguard.com.
2. Scope of this Policy
This Policy applies to personal information we process when you:
- visit onyguard.com or any other website, landing page or funnel we operate that links to this Policy;
- place an order with us, including through a checkout hosted by a third-party checkout provider on our behalf;
- subscribe to a recurring or "subscribe and save" plan;
- sign up for our email or text message programmes;
- contact our customer support team by email, chat, telephone or social media; or
- interact with our advertising on third-party platforms.
This Policy does not apply to third-party websites, platforms or services that we do not control, even where we link to them. See Section 20.
Separate notices. Some categories of information and some jurisdictions are covered by additional notices that sit alongside this Policy:
- Consumer Health Data Privacy Notice — https://onyguard.com/pages/consumer-health-data. This applies to residents of Washington State and Nevada and is required to be a standalone notice under Washington's My Health My Data Act.
3. Personal information we collect
3.1 Information you give us directly
| What we collect | When |
|---|---|
| First and last name | Account creation, checkout, newsletter signup, support contact |
| Email address | Checkout, newsletter and popup signup, support contact, reviews |
| Mobile telephone number | Checkout, text message programme signup, support contact |
| Shipping address and billing address | Checkout |
| Payment card details and billing information | Checkout — collected and processed by our payment processors; we receive only the last four digits, card brand and authorisation result |
| Order and transaction history, including subscription plan, renewal dates and cancellation history | Checkout and account management |
| Account username and password (if you create an account) | Account creation |
| The content of your messages to us, including emails, chat transcripts, telephone call recordings where notified, and social media messages | Customer support contact |
| Product reviews, testimonials, survey answers and photographs you submit | Where you choose to submit them |
| Information you give us when you request a refund, return, replacement or warranty claim, which may include a description of your symptoms or how you used the product | Returns and support |
You do not have to give us this information, but if you do not we may be unable to sell to you, deliver your order, or provide support.
3.2 Information we collect automatically
When you visit our website we automatically collect:
- Internet Protocol address and approximate location derived from it (country, region, city — not precise GPS location);
- device type, operating system, browser type and version, screen resolution, language and time zone;
- referring website or advertisement, landing page, search terms, and any campaign, affiliate or click identifiers appended to the address you arrive on;
- pages viewed, products viewed, items added to cart, time spent, scroll depth, clicks, and form interactions;
- purchase and conversion events, including cart abandonment; and
- cookie identifiers, pixel identifiers, advertising identifiers and similar online identifiers.
Session recording. We use a session replay tool that records how you move through our website — mouse movements, scrolling, taps and clicks — so we can see where the website is confusing or broken. The tool is configured to mask the text you type, so it does not capture what you enter into form fields, and it does not capture payment card details or passwords. You can stop session recording by rejecting analytics cookies — see Section 6.
We collect this using cookies, pixels, tags, software development kits, server-side event forwarding and server log files. See Section 6.
3.3 Information we obtain from third parties
We receive personal information about you from:
- our e-commerce and checkout platforms, which process your order on our behalf;
- payment processors and fraud prevention providers, who give us authorisation results, risk scores and chargeback or dispute information;
- shipping carriers and fulfilment partners, who give us delivery status and address validation results;
- advertising and analytics platforms, which give us aggregated and, in some cases, individual-level information about how our advertising performed and matched to you;
- affiliate and performance marketing networks, which tell us which publisher referred your visit or order; and
- social media platforms, where you interact with our pages or advertisements, in accordance with your settings on those platforms.
We do not purchase personal information from data brokers for the purpose of marketing to people who have not interacted with us.
3.4 Sensitive information
We may process the following categories that are treated as sensitive, special category or consumer health data under one or more laws:
- Health-related information. Our products are marketed for foot, nail and skin concerns, including fungal nail and foot conditions. Information showing that you have browsed, purchased, subscribed to, reviewed, or asked our support team about these products may indicate a past, present or future health condition, treatment, or bodily function. Free-text descriptions of symptoms you send to our support team, and photographs you send us in support of a refund or warranty claim, are health information.
- Account credentials. Your account login combined with your password.
- Payment card numbers and financial account information, handled by our payment processors.
- Precise geolocation. We do not intentionally collect precise geolocation. If your browser or device provides it, we do not use it.
We do not knowingly collect information about your racial or ethnic origin, religious beliefs, philosophical beliefs, trade union membership, genetic data, biometric data, sex life, sexual orientation, criminal history, immigration status, or citizenship status. Please do not send us this information.
How we handle health-related information.
We do not sell health-related information, and we do not use the free-text descriptions, photographs or support conversations you send us for advertising of any kind.
However, you should understand how our advertising and analytics tools work. Our product names and web addresses describe what the products are for. When you view a product page, the page address, the page title and the product name are included in the standard measurement events sent to our advertising and analytics providers, so that we can count conversions and attribute orders to campaigns. Because our product names reference a health concern, those events can reveal that you looked at or bought a product for that concern. We do not send symptom descriptions, photographs, support conversations, or any diagnosis to those providers, and we do not ask our advertising providers to build health profiles about you.
Your controls. You can stop this by rejecting advertising cookies — see Section 6, by using our Your Privacy Choices page, by emailing us to limit our use of sensitive personal information, or by browsing with a Global Privacy Control signal enabled. If you are in the European Economic Area, the United Kingdom or Switzerland, these tools are not activated at all unless you consent. See Section 6 and Section 8.
Residents of Washington State and Nevada have additional rights over this information, including the right to withdraw consent and to have it deleted. See Section 17.3 and our Consumer Health Data Privacy Notice.
4. How we use your personal information
| Purpose | Examples |
|---|---|
| Providing our products and services | Processing your order, taking payment, arranging delivery, managing your subscription, handling returns, refunds and warranty claims |
| Managing your account | Creating and authenticating your account, resetting your password |
| Customer support | Answering your questions, investigating complaints, quality-assuring our support team, training our support team and our automated support assistant |
| Marketing | Sending you email and text message offers where you have opted in, showing you advertisements on third-party platforms, sending cart and checkout reminders, measuring which campaigns work |
| Personalisation | Recommending products, tailoring on-site content and offers |
| Analytics and improvement | Understanding how our website is used, testing changes, improving our products and our checkout |
| Fraud prevention and security | Detecting fraudulent orders, chargeback abuse, promotion abuse, account takeover, bot traffic and attacks on our systems |
| Legal and regulatory compliance | Keeping accounting and tax records, responding to regulators and law enforcement, handling adverse event or product safety reports, responding to privacy rights requests |
| Defending our interests | Establishing, exercising or defending legal claims, enforcing our Terms |
| Corporate transactions | Evaluating, negotiating or completing a merger, acquisition, financing or sale of assets |
We do not use your personal information for any purpose that is materially different from those listed without telling you first and, where the law requires it, obtaining your consent.
5. Legal bases for processing (European Economic Area, United Kingdom and Switzerland)
Because Prolong Lab, UAB is established in Lithuania, the General Data Protection Regulation (Regulation (EU) 2016/679) applies to our processing activities. The legal bases we rely on are:
| Legal basis | Where we rely on it |
|---|---|
| Performance of a contract (Article 6(1)(b)) | Processing and delivering your order, managing your subscription, handling returns and refunds, providing support relating to your order |
| Legal obligation (Article 6(1)(c)) | Keeping accounting, tax and customs records; responding to lawful requests from authorities; product safety and adverse event reporting |
| Legitimate interests (Article 6(1)(f)) | Fraud prevention, network and information security, defending legal claims, essential website analytics, direct marketing to existing customers about similar products, improving our products and services |
| Consent (Article 6(1)(a)) | Non-essential cookies and tracking technologies, email and text message marketing where consent is required, any processing of health-related information for marketing, transfers of your information in specific circumstances |
| Vital interests (Article 6(1)(d)) | Rare cases where processing is necessary to protect someone's life or physical safety |
Where we process health-related or other special category information, we rely on your explicit consent under Article 9(2)(a), or on Article 9(2)(f) where the processing is necessary to establish, exercise or defend legal claims.
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. You can ask us for a summary of that assessment at support@onyguard.com.
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
6. Cookies, pixels and similar technologies
6.1 What these technologies are
A cookie is a small text file placed on your device when you visit our website. It lets the site remember things — that you are logged in, what is in your cart, which currency you chose.
We also use related technologies that work the same way and are covered by this section:
- Pixels and tags — tiny invisible images or scripts that report that a page was viewed or an action taken.
- Local storage — a browser store similar to a cookie but able to hold more data.
- Software development kits — code supplied by a third party and embedded in our site.
- Server-side event forwarding — where the record of your visit is sent from our servers to an advertising or analytics provider rather than from your browser. Your cookie choices apply to this too.
Throughout this section, "cookies" means all of the above.
6.2 The categories we use
| Category | What it does | Can you switch it off? |
|---|---|---|
| Strictly necessary | Runs the site, keeps your cart, processes payment, protects against fraud and bot traffic | No — the site will not work without these |
| Functional | Remembers preferences such as your country and currency | Yes |
| Analytics and performance | Tells us how the site is used so we can fix and improve it | Yes |
| Advertising and targeting | Measures our advertising, attributes orders to campaigns and affiliates, and builds audiences | Yes |
6.3 The cookies on our site
Strictly necessary
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
_shopify_y |
Shopify | Identifies a unique visitor so the store functions correctly | 1 year |
_shopify_s |
Shopify | Identifies a single browsing session | 30 minutes |
cart, cart_currency, cart_ts, cart_ver
|
Shopify | Keeps the contents and currency of your shopping cart | 2 weeks |
shopify_client_id |
Shopify | Links your browser to your order during checkout | 1 year |
localization |
Shopify | Remembers the country and currency you selected | 1 year |
secure_customer_sig |
Shopify | Keeps you signed in to your account | 1 year |
_cmp_a, keep_alive
|
Shopify | Manages privacy settings and session continuity | 1 day |
_tracking_consent |
Shopify | Stores your cookie choices, so we can honour them | 1 year |
Functional
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
__kla_id |
Klaviyo | Recognises you so we can send your order and cart emails, and so on-site forms do not repeat | 2 years |
external_id |
Klaviyo | Links your browser to your customer record | 1 year |
Analytics and performance
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
_ga |
Google Analytics | Distinguishes unique visitors | 2 years |
_ga_T4T3NVVMVQ |
Google Analytics | Maintains the analytics session state for our property | 2 years |
FPAU |
First-party analytics and conversion measurement | 90 days | |
_clck |
Microsoft Clarity | Identifies a unique visitor for session replay | 1 year |
_clsk |
Microsoft Clarity | Groups a visitor's page views into one recorded session | 1 day |
Advertising and targeting
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
_fbp |
Meta | Identifies your browser so we can measure Facebook and Instagram advertising and build audiences | 90 days |
_gcl_au |
Google Ads | Attributes an order to the Google advertisement you clicked | 90 days |
_uetsid, _uetvid
|
Microsoft Advertising | Measures Microsoft advertising and attributes conversions | 1 day / 13 months |
| Affiliate click identifier | Everflow | Records which publisher referred your visit so commission can be paid correctly | 30 days |
A note on our product names. Our product names and web addresses describe what the products are for. Advertising and analytics cookies therefore record that you viewed a page relating to a foot or nail concern. If that matters to you, reject advertising and analytics cookies. See Section 3.4 and our Consumer Health Data Privacy Policy.
Third-party cookie notices. Shopify (shopify.com/legal/cookies), Google (policies.google.com/technologies/cookies), Meta (facebook.com/policies/cookies), Microsoft (privacy.microsoft.com), Klaviyo (klaviyo.com/legal/privacy), Yotpo (yotpo.com/privacy-policy).
6.4 Consent and control
Visitors from the European Economic Area, the United Kingdom and Switzerland are shown a consent banner on their first visit, and no cookie other than a strictly necessary one is set until they consent. Visitors from elsewhere may have functional, analytics and advertising cookies set on arrival, and can turn them off at any time.
You can control cookies by:
- using the Cookie Preferences link in our website footer, at any time;
- using our Your Privacy Choices page at https://onyguard.com/pages/data-sharing-opt-out, which stops advertising cookies and the sharing described in Section 8;
- emailing support@onyguard.com with the subject line "Limit sensitive information";
- configuring your browser to block or delete cookies, though blocking strictly necessary cookies will break the cart and checkout; or
- using the advertising industry opt-outs at optout.aboutads.info, optout.networkadvertising.org, youronlinechoices.eu, and tools.google.com/dlpage/gaoptout.
What happens if you reject. Rejecting functional cookies means the site forgets your country, currency and whether you have seen a sign-up form. Rejecting analytics means we lose the data we use to find and fix problems. Rejecting advertising means you still see advertising, but it is less relevant and we cannot measure it. Your choice is stored on the device and browser you made it on, so if you clear cookies or switch browser or device, you will need to choose again.
Do Not Track. There is still no agreed industry standard for browser "Do Not Track" signals, and we do not currently respond to them.
Global Privacy Control. We do recognise and honour the Global Privacy Control signal. If you visit our website using a browser or extension that transmits a Global Privacy Control signal, we will treat it as a valid request to opt out of the sale and sharing of your personal information and of targeted advertising, for the browser and device on which you send it. You can learn more at globalprivacycontrol.org.
7. Who we disclose personal information to
We disclose personal information to the following categories of recipients. A current list of the specific companies in each category is available on request from support@onyguard.com.
| Category | What they do | Who |
|---|---|---|
| E-commerce platform | Hosts our store, processes orders, hosts our checkout | Shopify Inc. |
| Checkout and subscription management | Operates our alternative checkout, manages recurring billing and dunning | Checkout Champ (Konnektive LLC) |
| Payment processors and fraud prevention | Take payment, screen for fraud, handle disputes and chargebacks | Shopify Payments, PayPal, Solidgate, and the acquiring banks and card networks used to process your payment |
| Fulfilment and logistics providers | Pick, pack, ship and return your order; customs clearance | ShipBob, Inc. and the shipping carriers who deliver your order |
| Customer support platform | Hosts our helpdesk, chat and support ticketing | Commslayer |
| Email and text message platform | Sends our marketing and transactional email and text messages | Klaviyo, Inc., together with the text message aggregator and mobile carriers who deliver the message |
| Advertising and analytics platforms | Serve and measure our advertising | Google LLC (Google Analytics, Google Ads), Meta Platforms, Inc. (Facebook and Instagram advertising, including the Conversions Application Programming Interface), Microsoft Advertising, and other advertising networks we run campaigns with |
| Session replay and website analytics | Records how visitors navigate the website so we can fix problems with it | Microsoft Corporation (Microsoft Clarity) |
| Affiliate and performance marketing network | Tracks which publisher referred your visit or order and calculates commission | Everflow, and the publishers and media partners within that network |
| Reviews platform | Collects and displays product reviews | Yotpo Ltd. |
| Professional advisers | Legal, accounting, audit and insurance | Our lawyers, accountants and auditors |
| Corporate affiliates | Shared services across the brands operated by Prolong Lab, UAB and its group | Our group companies |
| Authorities and legal | Where required by law or to protect rights | Courts, regulators, law enforcement, tax and customs authorities |
| Acquirers | In connection with a merger, acquisition, financing or sale of assets | A prospective or actual buyer and its advisers |
We require our service providers to process personal information only on our instructions and to protect it appropriately.
We do not disclose your mobile telephone number or your text message consent to any third party for that third party's own marketing or promotional purposes.
8. Sale of personal information, sharing for targeted advertising, and how to opt out
Some United States state privacy laws define "sale" and "share" very broadly. Because we allow advertising and analytics partners to collect identifiers and browsing information through our website in exchange for advertising services, and because we pass order information to affiliate networks so commission can be paid, we do "sell" and "share" personal information as those terms are defined under those laws. We do not receive money in exchange for lists of customers.
In the preceding twelve months we have sold or shared the following categories:
| Category | Sold or shared? | To whom | For what purpose |
|---|---|---|---|
| Identifiers (online identifiers, cookie identifiers, Internet Protocol address, email address in hashed form, telephone number in hashed form) | Yes | Advertising and analytics platforms; affiliate networks | Targeted advertising, audience matching, measurement, commission attribution |
| Commercial information (products viewed, items added to cart, orders, order value) | Yes | Advertising and analytics platforms; affiliate networks | Conversion measurement, targeted advertising, commission attribution |
| Internet or other electronic network activity (browsing and interaction information) | Yes | Advertising and analytics platforms | Targeted advertising and measurement |
| Coarse geolocation derived from Internet Protocol address | Yes | Advertising and analytics platforms | Geographic targeting and measurement |
| Personal information under the California Customer Records statute (name, postal address, telephone number) | No | — | — |
| Product-level information that may reveal a health concern, because our product names describe what they are for (see Section 3.4) | Yes | Advertising and analytics platforms | Conversion measurement and targeted advertising |
| Other sensitive personal information — symptom descriptions, photographs, support conversations, account credentials, payment card and financial account information | No | — | — |
| Precise geolocation | No | — | — |
| Biometric information | No | — | — |
We do not sell or share the personal information of consumers we know to be under 16 years of age.
How to opt out
You can opt out of the sale and sharing of your personal information and of targeted advertising in any of these ways:
- Use our Your Privacy Choices page at https://onyguard.com/pages/data-sharing-opt-out, or the "Do Not Sell or Share My Personal Information" link in our website footer.
- Email support@onyguard.com with the subject line "Limit sensitive information" to limit our use and disclosure of your sensitive personal information.
- Browse using a browser or extension that transmits a Global Privacy Control signal, which we honour automatically.
- Reject advertising cookies using the Cookie Preferences link in our website footer.
- Email support@onyguard.com with the subject line "Opt out".
Opting out through a link or cookie control applies to the browser and device you are using. If you clear cookies or use a different browser or device, you will need to opt out again. If you are logged in or give us your email address, we will also apply your opt-out to your customer record.
We will act on your opt-out within fifteen business days, and we will notify the advertising partners to whom we sold or shared your information in the preceding period.
9. Categories of personal information collected — United States state law disclosure
The table below lists the categories of personal information defined in the California Consumer Privacy Act, which we use as a common reference for all United States state privacy laws.
| Category | Collected | Source | Disclosed for a business purpose | Retention |
|---|---|---|---|---|
| A. Identifiers | Yes | You; automatically; third parties | Yes | See Section 10 |
| B. Personal information under the California Customer Records statute | Yes | You | Yes | See Section 10 |
| C. Protected classification characteristics | No | — | — | — |
| D. Commercial information | Yes | You; automatically; third parties | Yes | See Section 10 |
| E. Biometric information | No | — | — | — |
| F. Internet or other electronic network activity | Yes | Automatically | Yes | See Section 10 |
| G. Geolocation data (coarse only) | Yes | Automatically | Yes | See Section 10 |
| H. Audio, electronic, visual or similar information | Yes — support call recordings and photographs you send us | You | Yes | See Section 10 |
| I. Professional or employment-related information | Only if you apply for a job with us | You | Yes | See Section 10 |
| J. Education information | No | — | — | — |
| K. Inferences drawn to create a profile | Yes — for example, product interest and likelihood to repurchase | Derived by us | Yes | See Section 10 |
| L. Sensitive personal information | Yes — account credentials, payment card and financial account information, and health-related information as described in Section 3.4 | You; derived by us | Yes, to service providers only | See Section 10 |
We use and disclose sensitive personal information only for the purposes permitted without consent under the California Consumer Privacy Act (performing our services, security and fraud prevention, short-term transient use, and quality assurance), or with your consent. We do not use sensitive personal information to infer characteristics about you.
10. How long we keep your information
| Information | Retention period |
|---|---|
| Order, invoice and payment records | Ten years from the end of the financial year in which the transaction occurred, as required by Lithuanian accounting and tax legislation, and by tax rules in the countries we sell into |
| Customer account information | For as long as your account is open, then twenty-four months |
| Subscription records after cancellation | Twenty-four months after cancellation, to handle final billing, refunds, warranty claims, disputes and chargebacks |
| Marketing profiles and campaign engagement | Until you opt out or withdraw consent, and in any event no more than twenty-four months after your last interaction with us |
| Email and text message consent records | Six years after consent is withdrawn, so we can evidence that consent existed |
| Customer support tickets, chat transcripts and call recordings | Thirty-six months |
| Photographs submitted with a refund or warranty claim | Twelve months after the claim is closed |
| Fraud, chargeback and dispute records | Seven years |
| Website analytics and advertising identifiers | As stated for each cookie in Section 6; generally no more than twenty-four months |
| Privacy rights request records | Two years, as required to demonstrate compliance |
When a retention period ends we delete the information or irreversibly anonymise it. Where deletion is not immediately possible because information sits in secure backups, we isolate it from further processing until the backup is overwritten.
11. Email marketing
We send marketing emails only where you have opted in, or where you have bought from us and we are permitted to market similar products to you under the law of your country. Every marketing email contains a working unsubscribe link and our postal address.
You can unsubscribe at any time using the link in any marketing email, or by emailing support@onyguard.com. We will action your request within ten business days.
You will continue to receive transactional messages that are necessary to your order or subscription, such as order confirmations, shipping notifications, renewal reminders and receipts. These are not marketing messages and cannot be unsubscribed from while you have an active order or subscription.
Canadian recipients. Under Canada's Anti-Spam Legislation we send commercial electronic messages only with your express or implied consent, and every message identifies us, gives our contact information, and contains an unsubscribe mechanism that stays valid for at least sixty days.
Australian recipients. Under the Spam Act 2003 (Cth) we send commercial electronic messages only with your consent, identify ourselves in every message, and include a functional unsubscribe facility.
12. Text message (SMS and MMS) programme
Your privacy is extremely important to us. We will only use the information you provide through our text message programme (the "Programme") to transmit your mobile messages and to respond to you where necessary. This includes, but is not limited to, sharing information with platform providers, telephone companies (carriers), and other vendors who assist us in the delivery of mobile messages.
WE DO NOT SELL, RENT, LOAN, TRADE, LEASE, OR OTHERWISE TRANSFER FOR PROFIT ANY PHONE NUMBERS OR CUSTOMER INFORMATION COLLECTED THROUGH THE PROGRAMME TO ANY THIRD PARTY. NO MOBILE INFORMATION AND NO OPT-IN CONSENT WILL BE SHARED WITH THIRD PARTIES OR AFFILIATES FOR MARKETING OR PROMOTIONAL PURPOSES.
All other categories of disclosure described in this Policy exclude text message originator opt-in data and consent. The service providers who do receive your mobile telephone number — our text message platform, our message aggregator and the mobile carriers — are contractually prohibited from using it for their own purposes.
Programme terms
| Programme name | OnyGuard |
| What you get | Order updates, shipping notifications, subscription reminders, offers and promotions |
| Message frequency | Up to 15 messages per month. Frequency varies |
| Cost | Free from us. Message and data rates may apply from your carrier |
| To stop | Reply STOP |
| For help | Reply HELP, email support@onyguard.com, or call +1 (888) 530-7470 |
| Who can join | Residents of the United States and Canada, aged 18 or over |
- Consent. By giving us your mobile telephone number and opting in — at checkout, through a sign-up form, by texting a keyword, or by any other enrolment method we offer — you give your prior express written consent to receive recurring automated marketing text messages from OnyGuard at that number, including messages sent using an automatic telephone dialing system. Consent is not a condition of any purchase.
- Your confirmations. You confirm that you are at least 18 years old, that you own the mobile number you provided or are authorised to use it, and that the information you gave us is accurate. You agree to tell us if you stop using that number.
- What we send. Transactional messages (order confirmations, dispatch and delivery updates, subscription renewal reminders, payment problems, replies to your questions) and marketing messages (offers, promotions, new products, cart reminders). Transactional messages about an active order or subscription continue even if you opt out of marketing, unless you reply STOP, which stops everything.
- Message frequency. Up to 15 messages per month. The actual number varies depending on your orders, your subscription and what you interact with.
- Costs. Message and data rates may apply. We do not charge for the messages; your mobile carrier may. Check with your carrier if you are unsure.
- Opting out. Reply STOP to any message. You will receive one final message confirming you have been unsubscribed, then nothing further. You may also opt out by emailing support@onyguard.com, by calling +1 (888) 530-7470, or by telling our support team in any reasonable way. We honour opt-outs promptly, and in any event within ten business days. You do not have to use a particular word or channel — if you tell us to stop, we stop. To rejoin later, opt in again the same way you did the first time.
- Help. Reply HELP for our contact details, email support@onyguard.com, or call +1 (888) 530-7470. Support hours are on our Contact Information page.
- Carriers and delivery. Mobile carriers are not liable for delayed or undelivered messages. Delivery depends on your carrier's network and on transmission from our message provider, and we cannot guarantee that every message arrives. The Programme is supported by most major United States and Canadian carriers, but not necessarily all, and carrier participation can change without notice. Tell us if you change your number or carrier.
- Supported devices. You need a mobile device capable of two-way messaging, on a plan with a participating carrier, that can receive the type of message being sent.
- Changes and removal. We may change or end the Programme, or these terms, at any time, and will tell you by text message or email before a material change takes effect. We may remove you from the Programme without notice, including where your number appears to have been reassigned, where messages repeatedly fail, or where you breach these terms.
- Disputes. If you are resident in the United States, disputes relating to the Programme are resolved by binding individual arbitration under Section 28 of our Terms of Service, which includes a class action waiver and a 30-day right to opt out of arbitration. Please contact support@onyguard.com first — we resolve almost everything that way.
Accuracy and our rights
We reserve the right at all times to disclose any information as necessary to satisfy any law, regulation or governmental request, to avoid liability, or to protect our rights or property.
When you complete forms online or otherwise provide us with information in connection with the Programme, you agree to provide accurate, complete and true information. You agree not to use a false or misleading name, or a name that you are not authorised to use. If, in our sole discretion, we believe that any such information is untrue, inaccurate or incomplete, or that you have opted into the Programme for an ulterior purpose, we may refuse you access to the Programme and pursue any appropriate legal remedies.
Requests about direct marketing disclosures
California Civil Code Section 1798.83 and the General Data Protection Regulation 2016/679 allow users of the Programme who are California or European Union residents to request certain information regarding our disclosure of the information you provide through the Programme to third parties for their direct marketing purposes.
Contact us at the following address to make a request:
Prolong Lab, UAB Dominikonų g. 11, LT-01131 Vilnius, Lithuania support@onyguard.com
13. Subscriptions and recurring orders
If you buy a subscription or "subscribe and save" plan, we additionally process your plan details, renewal schedule, payment method token, billing attempt history, dunning and retry history, pause and skip history, and cancellation reason.
We use this to bill you, to remind you before renewals where the law or the platform requires it, to retry failed payments, to offer you alternatives before cancellation, and to comply with automatic renewal laws.
You can manage or cancel your subscription at any time through the link in your order confirmation email, through your account, or by contacting support@onyguard.com. Our Cancellation Policy explains the process: https://onyguard.com/policies/subscription-policy
After cancellation we keep your subscription records for twenty-four months as set out in Section 10.
14. International transfers of personal information
Please note that we may transfer, store and process your personal information outside the country you live in. Your personal information is also processed by staff and by third-party service providers and partners in those countries.
We are established in Lithuania. Your personal information may be transferred to, stored in and accessed from countries other than the one you live in, including:
- the European Economic Area, where our company and some of our service providers are located;
- the United States, where many of our e-commerce, checkout, payment, marketing, analytics, advertising and support providers are located;
- Canada and Australia, in connection with delivery to customers in those countries.
Our customer support team is based in Lithuania. Our fulfilment partner operates warehouses in the United States. Our e-commerce, checkout, payment, marketing, analytics, advertising and support platforms are based in the United States and the European Economic Area.
Some of these countries do not provide the same level of legal protection for personal information as your home country.
For transfers from the European Economic Area or the United Kingdom, we will rely on recognised transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the United Kingdom, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection. These are supported by a transfer impact assessment and additional technical and organisational safeguards. You can request a copy of the relevant safeguards at support@onyguard.com. The same approach applies to transfers from Switzerland.
For transfers from Australia, we take reasonable steps under Australian Privacy Principle 8 to ensure overseas recipients handle your personal information in accordance with the Australian Privacy Principles, including through contractual commitments.
For transfers from Canada, we use contractual and other means to provide a comparable level of protection while your information is being processed by a service provider outside Canada. Your information may be accessible to the courts, law enforcement and national security authorities of those countries.
15. How we protect your information
We use technical and organisational measures appropriate to the risk, including encryption of data in transit using Transport Layer Security, encryption at rest with our platform providers, access controls limited to staff who need the information, multi-factor authentication on administrative accounts, logging, vendor due diligence and contractual data protection terms, and staff training.
We do not store full payment card numbers. Card data is captured and held by our payment processors, which maintain Payment Card Industry Data Security Standard compliance.
No method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security. Please do not send us sensitive information, such as full card numbers or health details, through unsecured channels such as social media messages.
If a personal data breach occurs, we will notify the relevant supervisory authorities and affected individuals where the law requires it and within the timescales the law sets, including within seventy-two hours of becoming aware where the General Data Protection Regulation applies.
16. Children
Our website and products are intended for adults. We do not knowingly collect personal information from, sell or share the personal information of, or direct marketing to, anyone under eighteen years of age. By using our website you confirm that you are at least eighteen.
We do not process the personal information of consumers we know to be under eighteen for the purpose of targeted advertising, and we do not sell or share the personal information of consumers we know to be under sixteen.
If you believe a child has given us personal information, contact support@onyguard.com and we will delete it.
17. Your privacy rights
17.1 Rights available to everyone
Wherever you live, you can:
- ask us what personal information we hold about you and get a copy of it;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete information we no longer need;
- unsubscribe from marketing email and text messages;
- opt out of advertising cookies; and
- complain to us about how we have handled your information.
17.2 United States state residents
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have the following rights. Which rights you have, and their limits, depend on your state.
- Right to know and to access — to confirm whether we process your personal information and to obtain a copy of it, along with the categories we collect, the sources, the purposes, and the categories of recipients.
- Right to correct inaccuracies in your personal information.
- Right to delete your personal information, subject to legal exceptions such as our obligation to keep transaction records.
- Right to data portability — to obtain a copy in a portable and readily usable format.
- Right to opt out of the sale of personal information, of sharing or processing for targeted advertising, and of profiling that produces legal or similarly significant effects. See Section 8.
- Right to limit the use and disclosure of sensitive personal information (California), and to opt out of the processing of sensitive data (Colorado, Connecticut, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Virginia — in most of these states we must obtain your opt-in consent before processing sensitive data at all).
- Right to non-discrimination — we will not deny you goods or services, charge you a different price, or provide you a different level of quality because you exercised a privacy right.
- Right to withdraw consent where we relied on it.
- Right to a list of the categories of third parties to which we have disclosed personal data (available to residents of California, Delaware and Maryland).
- Right to a list of the specific third parties to which we have disclosed personal data (available to residents of Minnesota and Oregon).
- Right to a list of third parties to which we have sold personal data (available to residents of Connecticut).
- Right to question and correct profiling (available to residents of Connecticut and Minnesota).
- Right to opt out of the collection of sensitive data and personal data collected through a voice or facial recognition feature (available to residents of Florida). We do not operate such features.
Maryland residents. We do not sell sensitive data, and we do not process personal data for targeted advertising or sell the personal data of any consumer we know to be under eighteen.
California "Shine the Light". California Civil Code section 1798.83 lets California residents ask us once a year, free of charge, for information about the categories of personal information we disclosed to third parties for those third parties' direct marketing purposes in the previous calendar year, and the names and addresses of those third parties. Send requests to support@onyguard.com.
Authorised agents. You may use an authorised agent to submit a request on your behalf. We will ask the agent for proof of authorisation signed by you, and we may ask you to verify your own identity directly.
Verification. We will verify your identity before acting on a request to know, access, correct, delete or port. We normally do this by asking you to confirm information we already hold, such as the email address on your order and details of a recent order. We use information you give us for verification only for that purpose. We do not require verification for an opt-out of sale or sharing.
Timing. We will acknowledge your request promptly and respond within forty-five days. Where permitted, we may extend once by a further forty-five days and will tell you if we do.
Appeals. If we decline to act on your request, you may appeal by emailing support@onyguard.com with the subject line "Privacy appeal". We will respond in writing within sixty days, explaining our reasons. If we deny your appeal, you may complain to your state Attorney General.
17.3 Washington State and Nevada residents — consumer health data
Washington State's My Health My Data Act and Nevada Senate Bill 370 give residents of those states specific rights over consumer health data, which is defined broadly and, in our case, includes information that reveals that you have sought out or purchased products for a foot, nail or skin condition.
Residents of those states have the right to:
- confirm whether we collect, share or sell their consumer health data, and access it, including a list of all third parties and affiliates with whom we have shared or sold it and contact information for each;
- withdraw consent to our collection and sharing of their consumer health data; and
- have their consumer health data deleted, including from our backups and archives, and to have us notify our service providers, affiliates and processors of the deletion request.
We do not sell consumer health data. We will not sell it without first obtaining your separate, written and signed authorisation that meets the requirements of the My Health My Data Act.
Our standalone Consumer Health Data Privacy Notice contains the full detail required by these laws and is linked separately from our homepage: https://onyguard.com/pages/consumer-health-data
To exercise these rights, email support@onyguard.com with the subject line "Consumer health data request". We will respond within forty-five days.
17.4 European Economic Area, United Kingdom and Switzerland
Under the General Data Protection Regulation and the United Kingdom General Data Protection Regulation you have the right to:
- access your personal data and receive a copy;
- have inaccurate data rectified;
- have data erased in the circumstances set out in Article 17;
- restrict processing in the circumstances set out in Article 18;
- data portability for data you provided to us that we process by automated means on the basis of consent or contract;
- object to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation;
- object at any time, absolutely, to processing for direct marketing purposes, including profiling for direct marketing;
- withdraw consent at any time where we rely on it; and
- not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.
We will respond within one month. We may extend by two further months for complex requests and will tell you if we do. There is no charge unless your request is manifestly unfounded or excessive.
Complaints. You may lodge a complaint with your local supervisory authority. Our lead supervisory authority is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania — ada@ada.lt. A list of all European supervisory authorities is published by the European Data Protection Board. In the United Kingdom, the Information Commissioner's Office at ico.org.uk. In Switzerland, the Federal Data Protection and Information Commissioner.
17.5 Canada
We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act and, where applicable, provincial privacy legislation including Quebec's Act respecting the protection of personal information in the private sector.
We collect, use and disclose your personal information with your express consent, or with your implied consent where the purpose is obvious and you voluntarily provide the information. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice; we will tell you what the consequences of withdrawal would be.
In limited circumstances the law allows us to process personal information without consent, including for fraud detection and prevention, in connection with a business transaction, for investigating a breach of an agreement, or where disclosure is required by a subpoena, warrant or court order.
You have the right to access the personal information we hold about you and to challenge its accuracy. Quebec residents additionally have the right to data portability, to request that we cease disseminating information, and to be informed where a decision about them is based exclusively on automated processing.
Our Privacy Officer can be reached at support@onyguard.com or at our postal address. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Commission d'accès à l'information du Québec if you live in Quebec.
17.6 Australia
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This Policy is our Australian Privacy Principle 1 privacy policy. It tells you what personal information we collect, how we collect it, why we collect it, who we disclose it to, that we disclose it overseas and to which countries (Section 14), and how you can access it, correct it and complain.
Australian residents have the right to request access to the personal information we hold about them and to request correction of it. We will respond within thirty days. We may refuse access in the limited circumstances set out in Australian Privacy Principle 12 and will give you written reasons if we do.
If you do not give us the personal information we ask for, we may be unable to sell to you, deliver your order, manage your account, verify your identity, or respond to your enquiry.
Complaints. Contact us first at support@onyguard.com. We will acknowledge within seven days and respond within thirty days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au, by telephone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.
18. Automated decision-making and profiling
We use automated processes to:
- score orders for fraud risk, which may result in an order being held for manual review or declined;
- segment customers for marketing based on their purchase and engagement history; and
- route and draft responses to customer support enquiries using an automated support assistant, with human review available.
We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing without human involvement. If a decision that significantly affects you is ever made solely by automated means, we will tell you, explain the main factors involved, and give you a straightforward way to request human review, to express your point of view and to contest the decision. Contact support@onyguard.com.
19. How to exercise your rights
| Method | Details |
|---|---|
| support@onyguard.com | |
| Telephone | +1 (888) 530-7470 (toll-free, United States) |
| Post | Prolong Lab, UAB, Dominikonų g. 11, LT-01131 Vilnius, Lithuania |
| Opt out of sale or sharing | Our Your Privacy Choices page at https://onyguard.com/pages/data-sharing-opt-out, or a Global Privacy Control signal |
| Limit sensitive information | Email support@onyguard.com, subject line "Limit sensitive information" |
| Unsubscribe from email | Link at the foot of any marketing email |
| Stop text messages | Reply STOP |
Please tell us which right you wish to exercise and which state or country you live in, so we can apply the correct rules.
20. Third-party websites and platforms
Our website and our advertising link to third-party websites and platforms that we do not control, including social media, review platforms, payment providers and affiliate publishers. This Policy does not apply to them. We are not responsible for their privacy practices and we encourage you to read their privacy notices. Anything you post publicly on a third-party platform may be visible to others and may be used by that platform.
21. Complaints
If you are unhappy with how we have handled your personal information, contact support@onyguard.com. We will acknowledge your complaint within seven days and aim to resolve it within thirty days.
You may also complain to a regulator: your state Attorney General (United States), the State Data Protection Inspectorate of the Republic of Lithuania or your local supervisory authority (European Economic Area), the Information Commissioner's Office (United Kingdom), the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec (Canada), or the Office of the Australian Information Commissioner (Australia).
22. Changes to this Policy
We may update this Policy. The "Last updated" date at the top tells you when we last did. If we make material changes we will post a prominent notice on our website and, where the law requires it, notify you directly and obtain your consent before applying the change to information we already hold.
23. Contact us
Prolong Lab, UAB (trading as OnyGuard) Dominikonų g. 11, LT-01131 Vilnius, Lithuania
Privacy: support@onyguard.com Support: support@onyguard.com Telephone: +1 (888) 530-7470
These statements have not been evaluated by the Food and Drug Administration. Our products are not intended to diagnose, treat, cure or prevent any disease.