Privacy policy

What we collect

Information you give us

• At checkout: first and last name, email address, phone number, and shipping address. Card details are entered at checkout and passed directly to our payment processor — we store only the card brand, last four digits, and expiry.
• If you create an account: your email address, and your name if you supply it.
• If you contact us: whatever you put in the message, including any institution or purchase-order details you choose to add to an order.
• If you subscribe to our email: your email address, the wording of the consent you gave, and the page and campaign you subscribed from. You can unsubscribe from any message we send.

Information collected automatically

• Server logs: IP address, browser user-agent, requested URL, and timestamp.
• Research-use acknowledgement: when you confirm on entry that you are a qualified researcher, we record the date and time, your IP address, your browser user-agent, and the version of the wording you were shown. We keep it because the acknowledgement is a condition of sale and we have to be able to show what was confirmed.
• Site activity: pages viewed and actions taken, associated with a randomly generated visitor identifier stored in your browser. This is how we understand which pages work; it is not tied to your identity unless you sign in or place an order.
• Advertising measurement: this site loads the Meta Pixel, which reports page views and purchase events to Meta and can associate them with your Meta account if you have one.

We do not knowingly collect information from anyone under 18, and this site is not directed to children.

Why we use it

• To take payment, fulfil your order, and send order and shipping updates.
• To record the research-use-only acknowledgement made at checkout.
• To provide your account and give you access to your past orders and certificates.
• To answer your enquiries.
• To detect and prevent fraud, and to meet our legal and tax obligations.
• To measure how the site and our advertising perform.

Where the GDPR applies, we rely on performance of a contract (fulfilling your order), legal obligation (tax and accounting records), and legitimate interests (fraud prevention, site analytics, and securing the service). Advertising measurement relies on consent where consent is required.

Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural advertising beyond the pixel disclosed above. We use these processors:

Sticky.io

Payment processing and order management. Shared: name, email, phone, billing and shipping address, and card details.

Supabase

Application database and authentication hosting. Shared: account email, order records, and site activity.

Vercel

Website hosting and delivery. Shared: ip address and request metadata in server logs.

Meta (Facebook)

Advertising measurement via the Meta Pixel. Shared: site activity, and a hashed identifier where you are signed in to meta.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Cookies and similar technologies

We use browser storage for things the site cannot work without — keeping you signed in, remembering your cart, recording that you completed the research-use confirmation (a first-party cookie kept for 30 days), and holding the visitor identifier described above — and the Meta Pixel sets cookies for advertising measurement. You can block or delete cookies in your browser; the essential ones cannot be turned off without breaking sign-in and checkout. Most browsers also send a Global Privacy Control signal on request, which we treat as an opt-out of advertising measurement.

How long we keep it

Order and transaction records are kept for as long as we are required to keep them for tax and accounting purposes. Account information is kept until you ask us to delete the account. Server logs and site activity are kept for a short operational period and then discarded. Research-use acknowledgements and email-consent records are kept for as long as they may be needed as evidence of what was confirmed, which is at least the life of the related order or subscription. Certificates of analysis are archived against their lot numbers indefinitely — they describe material, not people.

Your rights

Depending on where you live you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, object to or restrict certain processing, and withdraw consent you have given. Under the GDPR you may also complain to your national supervisory authority.

If you are a California resident, you may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and opt out of sale or sharing — we do not sell personal information. We will not discriminate against you for exercising any of these rights.

To make a request, email us via the contact page. We may need to verify your identity before acting, and we will respond within the period the applicable law allows.

International transfers

Our processors operate in the United States, so information you provide may be transferred to and stored there. Where information is transferred out of the UK or the EEA, we rely on the transfer mechanisms our processors have in place, including the European Commission’s standard contractual clauses.

Security

The site is served over TLS, access to order data is restricted to authorised staff, and full card numbers never reach our systems. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Changes

If this policy changes materially we will update the date at the top of this page. Continued use of the site after a change means you accept the revised policy.

Contact

Appalachia Labs is the controller of the personal information described here. Reach us at the contact page.