Privacy Policy
What data we collect, why, and what we do not do with it.
Last updated August 4, 2026
This policy explains what personal data we collect and how we handle it.
What we collect
When you order: name, email address, phone number, shipping address, organisation, and the contents and value of your order. We record your research-use attestation and the time it was given.
When you create an account: the above, plus a hashed password. We never store passwords in a recoverable form.
When you contact us or subscribe: name, email address and the content of your message.
Automatically: IP address, browser type and pages visited, for security and to understand which content is useful.
Payment data
We do not store payment card details. Payments are handled through bank transfer, cryptocurrency or third-party processors, and card data never reaches our servers.
Why we hold it
- To process, ship and support your orders
- To maintain the compliance records this product category requires, including research-use attestations and batch traceability
- To send order and shipping notifications
- To send marketing email, only where you have opted in
- To meet legal and tax obligations
Order notifications
Order and cart activity generates an internal operational notification to our fulfilment team, delivered over WhatsApp to a private staff group. These notifications contain order details necessary for fulfilment. They go to our own staff only and are never shared with third parties or used for marketing.
Who we share it with
- Couriers, to deliver your order
- Payment providers, to process payment
- Our email provider, to send transactional messages
- Authorities, where legally required
We do not sell personal data. We do not share it with advertisers or data brokers.
Retention
Order records and compliance attestations are kept for seven years to meet tax and regulatory record-keeping requirements. Account data is kept while your account is active. Marketing subscriptions are kept until you unsubscribe.
Your rights
Depending on your jurisdiction you may have the right to access, correct, delete or export your data, to object to processing, and to withdraw consent for marketing at any time. Contact us to exercise any of these; we respond within 30 days.
Note that compliance records attached to a completed order may need to be retained even after an account deletion request, for the retention period above.
Security
Data is transmitted over TLS and stored on access-controlled infrastructure. Passwords are hashed. Access to customer data is limited to staff who need it.
Cookies
We use cookies necessary for the site to function — session management and your shopping cart. Your cart is stored in your browser's local storage so it survives between visits.
Contact
Questions about this policy, or about data we hold on you, go to our contact page.