Privacy policy

1.Information we collect

Account information. When you register we collect your email address, a password, your name, your date of birth, and the business type you declare. The date of birth is collected to confirm the 21-or-older requirement that applies to every order. Your password is stored as a hash and we cannot read it.

Delivery addresses. When you save an address or place an order we collect the recipient name, street address, city, state, postal code and country. A phone number is optional and is used only where a carrier needs it for a delivery.

Order records. We keep what you ordered, what it cost, the shipping method, the delivery address, tracking and carrier details, and your confirmation that the order is for research use. We keep this because it is the record of a sale.

Technical information. When you sign in we record the session, the IP address and the browser user agent it was created from, and when it was last used. This is how a session can be recognised, expired and revoked, and how we notice an account being accessed from somewhere it should not be.

Correspondence. If you contact us, we keep the message and our reply so we can deal with it and refer back to it.

Newsletter subscriptions. If you subscribe, we collect your email address for that purpose. Nothing else is required to subscribe.

2.How we use your information

To take, process and deliver orders, including passing a delivery address to the carrier.

To operate accounts: signing in, verifying an email address, resetting a password, and showing you your own order history.

To confirm eligibility — that a buyer is 21 or older and is purchasing for research use, as the terms of sale require.

To send transactional messages about an order you placed: confirmations, dispatch notifications, and anything specific we need to tell you. These are part of the service, not marketing, and they are not optional while an order is live.

To send the newsletter, but only if you asked for it.

To answer enquiries, investigate problems, prevent fraud and abuse, and enforce the terms of sale.

To meet legal, tax and record-keeping obligations, and to respond to a lawful request from an authority.

We do not use your information to build advertising profiles, and we do not make automated decisions about you that produce legal effects.

3.Marketing communications

The newsletter is opt-in. The field that records it defaults to off, and it stays off unless you turn it on — an opt-in that arrives already ticked is not an opt-in.

It carries catalogue additions, restocks, and certificates of analysis as we publish them. It does not carry claims about what any material does, and it never will: the research-use rules that govern this site govern anything we send.

Every message includes an unsubscribe link. Unsubscribing takes effect on that list alone — it does not close your account, cancel an order, or stop the transactional messages an order needs.

We do not send marketing by text message, and we do not send marketing on behalf of anyone else. We do not sell or rent your address.

4.Cookies, local storage and third-party scripts

We set two cookies. `age_verified` records that the age check has been completed, so it is not shown on every page. `pp_session` keeps you signed in; it cannot be read by scripts, is restricted to this site, is sent over HTTPS in production, and lasts at most thirty days.

Your cart is kept in your browser's local storage, not on our servers. It stays on your device until you check out or clear it.

One third-party script runs on this site: MailerLite's, which powers the newsletter tooling and may set its own cookies for that purpose. It loads on every page.

There is no Google Analytics, no tag manager, no advertising pixel and no cross-site advertising tracking on this site. If that ever changes, this section changes with it.

You can block or delete cookies in your browser. Blocking ours will mean the age check reappears and you will not be able to stay signed in.

5.How we protect your information

The site is served over HTTPS, so traffic between your browser and us is encrypted in transit.

Passwords are stored as hashes. Email verification and password reset tokens are also hashed at rest, because a live reset link is a credential for as long as it is valid.

Our records of transactional email keep metadata — which template went where, and whether it was delivered — and deliberately not the message body or the link it contained, for the same reason.

Card details are entered with the payment provider and are not transmitted to or stored on our systems. We hold a payment reference, not a card number.

No system is perfectly secure and we will not claim otherwise. What we can say is what we do, which is set out above.

6.Sharing your information

We do not sell personal information, and we do not rent or trade it.

We share it with the service providers who make the site work, and only so far as their part of it requires: our hosting and database providers, our transactional email provider, our newsletter provider, our payment provider, and the carrier delivering your parcel.

We may disclose information where a law, a court order or a lawful request from a regulator or law enforcement agency requires it, and where it is necessary to establish or defend a legal claim, or to prevent harm.

If the business is ever sold or reorganised, customer records may transfer as part of it. Any acquirer would be bound by this policy for information collected under it, and we would say so on this page before it took effect.

7.How long we keep it

Order records are kept for as long as tax, accounting and product-compliance obligations require, which outlasts the account itself.

Account information is kept while the account is open. Sessions expire on their own and are revoked when you sign out.

Verification and password reset tokens are short-lived by design and are consumed or expired rather than retained.

Newsletter subscriptions are kept until you unsubscribe, which removes the address from that list.

When information is no longer needed for any of the above, it is deleted or anonymised.

8.Your rights and choices

You can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, ask us to delete what we are not required to keep, and object to or restrict some uses of it.

You can unsubscribe from the newsletter at any time from any message we send, without contacting us.

Which of these rights apply, and how far they go, depends on where you live. Where a right applies to you we will honour it; where a law requires us to keep something — a tax record, for example — we will explain why we cannot delete it rather than quietly not doing it.

To make a request, email us from the address on the account so we can tell it is you. We will answer as quickly as we can, and within whatever period the applicable law requires.

Exercising any of these rights costs nothing and will not affect the service you get.

9.Third-party websites

This site links to other websites — carriers, and documents published by others. Once you follow a link you are on someone else's site, under their privacy policy, and this one no longer applies.

We do not control those sites and are not responsible for how they handle your information. It is worth reading their policy before giving them anything.

10.Age requirement

This site is not intended for anyone under 21, and orders may only be placed by buyers who are 21 or older. That is a stricter limit than a general children's-privacy rule, and it is enforced at the age check and again at registration.

We do not knowingly collect information from anyone under 21. If we learn that we have, we will delete the account and the information associated with it.

11.Changes to this policy

We may update this policy. The version published here is the version in force, and a material change will be noted on this page rather than made quietly.

Continuing to use the site after a change means accepting the updated policy.

12.Governing law and jurisdiction

This policy is governed by the laws of the State of Colorado, United States, without regard to its conflict of laws rules, and matches the governing law clause in our terms of sale.

This site is directed to buyers in the United States, and we deliver only to United States addresses.

13.How to contact us

For any question about this policy, or to make a request about your information, email us. Say what you are asking for and we will tell you what we can do and what we need from you.