Privacy Policy.

1. Information We Collect

• Account & contact information: name, email address, phone number, and institution or laboratory name.
• Order & shipping information: billing and shipping address, order contents, and order history.
• Checkout acknowledgment records: the timestamped research-use and eligibility acknowledgments you submit, together with the IP address, device/browser user-agent, and time of submission, retained as evidentiary proof of consent.
• Support correspondence: the content of emails or messages you send us and our responses.
• Limited analytics & cookies: aggregate, non-precise usage data (such as pages viewed) collected through essential and analytics cookies described in Section 10.

We never receive or store payment card numbers. Cryptocurrency payments are processed by a third-party payment processor under its own privacy policy; PayPal, Zelle and Venmo transfers are handled by those services directly.

2. Sources of Information

We collect information you provide directly (account creation, checkout, support requests), information generated automatically by our systems (acknowledgment timestamps, IP address, device data), and limited information from our service providers (such as payment or delivery confirmation from our payment processor or shipping carriers).

3. How We Use Information & Legal Bases

• Performance of contract: to process, fulfill, and support your order and account.
• Consent: to record your checkout acknowledgments and to send opt-in notifications.
• Legitimate interests: to maintain an audit trail of research-use acknowledgments, prevent fraud, secure the site, and improve our services.
• Legal obligation: to comply with tax, accounting, export-control, and other regulatory requirements, and to respond to lawful requests from public authorities.

4. Disclosure to Processors & Other Recipients

We disclose limited categories of information to service providers acting as processors or subprocessors on our behalf, each bound by contract to use information only to provide services to us:

• Payment processing: our cryptocurrency payment processor, and PayPal, Zelle or Venmo (order amount and payment reference only).
• Hosting & database services: our infrastructure and database providers, to store account, order, and acknowledgment records.
• Email delivery: transactional email providers, for order confirmations and support correspondence.
• Messaging & notifications: providers used to deliver shipping and order-status notifications you opt into.
• Shipping carriers: name and shipping address, to deliver your order.

We may also disclose information (a) to comply with a subpoena, court order, or other valid legal process, (b) to investigate or prevent fraud, security incidents, or violations of our Terms, and (c) in connection with a merger, acquisition, financing, or sale of assets, subject to this notice or an equivalent successor policy.

5. No Sale or Sharing for Cross-Context Behavioral Advertising

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") or analogous state law.

6. Retention

• Checkout acknowledgment records: retained for the longer of seven (7) years or the period required by applicable law, given their evidentiary role in our Terms.
• Order & account records: retained for the duration of your account plus the period required for tax, accounting, and warranty purposes.
• Support correspondence: retained for up to twenty-four (24) months unless deletion is requested sooner.
• Analytics data: retained in aggregate or de-identified form beyond these periods where it no longer identifies you.

7. Security & Breach Notification

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls, and reliance on PCI-compliant processors for payment data. No system is completely secure. In the event of a breach affecting your personal information, we will notify affected individuals and any applicable regulator as required by law.

8. Children's Privacy

This site is not directed to, and is not intended for use by, anyone under eighteen (18) years of age. We do not knowingly collect personal information from anyone under 18. If we learn we have done so, we will delete the information promptly.

9. International Users & U.S. Data Transfer

Our systems and service providers are located in the United States. If you access the site from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, which may not offer the same level of data protection as your home jurisdiction.

10. Cookies, Do Not Track & Global Privacy Control

This site uses only essential cookies required for navigation, checkout, and security, together with limited first-party analytics cookies. We do not deploy third-party advertising or cross-site tracking cookies. Because we do not track users across third-party sites for advertising purposes, our systems currently do not respond differently to browser "Do Not Track" signals; where required by law, we will honor a validly transmitted Global Privacy Control ("GPC") or similar opt-out preference signal as a request to opt out of sale/sharing.

11. Automated Decision-Making

We do not use your personal information to make decisions that produce legal or similarly significant effects through solely automated means, and we do not perform automated profiling for advertising purposes.

12. State Privacy Rights (California, Virginia, Colorado, Connecticut, Utah, Texas)

Depending on your state of residence, you may have the right to: (a) know and access the categories and specific pieces of personal information we hold about you; (b) request deletion of your personal information; (c) request correction of inaccurate personal information; (d) opt out of the sale or sharing of personal information or of profiling in furtherance of decisions producing legal effects (though we do not engage in either); and (e) not receive discriminatory treatment for exercising these rights.

To exercise any of these rights, contact us through the channels described in Section 15. We will verify your identity before acting on a request. If we deny a request, you may appeal the denial using the same contact channel; we will respond to your appeal within the time required by applicable law and, if the appeal is denied, will explain how to submit a complaint to your state attorney general or other applicable regulator.

13. GDPR / UK Data Protection Rights

If the EU General Data Protection Regulation or the UK GDPR applies to our processing of your personal data, you have the right to access, rectify, erase, restrict, or port your data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Our lawful bases for processing are set out in Section 3. You also have the right to lodge a complaint with your local supervisory authority.

14. Third-Party Links

The site may link to third-party websites, including payment provider and shipping-carrier pages. We are not responsible for the privacy practices of third-party sites, and we encourage you to review their privacy notices.

15. Contact & Deletion Requests

To request access, correction, deletion, or an appeal of a denied request, or for any other privacy question, contact us via the Contact page. We will respond within the time required by applicable law.

16. Changes to This Notice

We may update this notice from time to time. The effective date at the top of this page reflects the most recent revision. Material changes will be reflected by a new effective date, and, where required by law, we will provide additional notice.