What we collect, why, who it is shared with, and how to get it removed.

What is collected

Account details, shipping and billing addresses, order history, COA download events and standard web telemetry (page views, referrer, coarse device data). Payment card data is tokenised by the processor - raw card numbers never touch this application.

Why

To fulfil orders, verify researcher eligibility, produce regulatory records, prevent fraud and answer support tickets. Analytics are used at the aggregate level for stock planning.

Sharing

Carriers (label creation), the payment processor, the accredited QC laboratory (batch identifiers only) and, where legally required, law-enforcement or tax authorities with a valid request.

Retention

Order and release documentation is kept for 7 years to satisfy audit requirements. Marketing consent records are kept until withdrawn. Request an export or deletion from the account page or the privacy desk, and we will action it within 30 days.

Cookies

Session cookie (cart and login), age-gate acknowledgement, and an optional analytics cookie. Blocking analytics does not affect the storefront.