1. Information We Collect
We collect information you provide directly when you:
- Place an order, start checkout, or submit an inquiry: Name, email address, phone number, organization name, role, shipping and billing addresses, and order notes. We save the email address or phone number you enter at checkout even if you do not finish your order.
- Create an account: Email address, password (hashed, never stored in plain text), and organization details.
- Sign up for updates, enter a giveaway, or claim an offer: Your email address when you use an email sign-up form; your email address and, if you give it, your first name when you enter a giveaway; your phone number when you use our text sign-up form; and your name, email address, mobile number, lab or company, and any optional research field or department you provide when you claim a printed-card or event offer.
- Use the Peptide Finder quiz: Your research focus, experience level, and compound preferences. This data is processed client-side and is not transmitted to our servers unless you proceed to place an order.
- Enter the site: The 21+ screen asks for your age. We keep only an age range (for example, 25-34), never the exact number. It is linked to your account and orders and used only for aggregate demographic statistics. It is self-reported and is not age verification.
- Contact us: Any information you include in emails, contact forms, or phone conversations.
We also automatically collect:
- Usage data: Pages visited, time spent on site, referring URL, browser type, device type, and operating system.
- Cookies and similar technologies: Session cookies for site functionality, analytics cookies (with your consent), and preference cookies to remember your settings.
- IP address: Used for fraud prevention, geographic analytics, and compliance with export regulations.
2. How We Use Your Information
- Processing and fulfilling your orders, including shipping, invoicing, and payment processing.
- Providing customer support and responding to inquiries.
- Sending order confirmations, shipping notifications, COA documents, and account and security messages (such as account activation and password-reset emails).
- If you agree to receive them, sending marketing emails such as newsletters, product news, offers, and rewards updates.
- Verifying the legitimacy of research-use purchases for regulatory compliance.
- Improving our products, services, and website functionality based on aggregate usage patterns.
- Detecting and preventing fraud, unauthorized access, and other illegal activities.
- Complying with legal obligations, including export control regulations and law enforcement requests.
Marketing messages are optional. Placing an order, creating an account, agreeing to this policy, or submitting a sign-up form does not, by itself, sign you up for them. Our marketing emails include links to unsubscribe and to manage your email preferences, where you can turn off topics or pause marketing emails for a while. To stop marketing emails, use the unsubscribe link in any marketing email; if a link can only update part of your preferences, the page will say so, and you can contact us for help. To stop text messages from us, reply STOP to any of our texts; this also stops order updates by text. Unsubscribing from marketing emails does not stop order, account, or security emails.
We will never sell, rent, or trade your personal information to third parties for their marketing purposes.
3. Information Sharing
We share your information only with:
- Payment processor: To process credit and debit card payments, card details are entered directly with our third-party payment processor - we do not store full card numbers on our servers. Bank wire transfers, where offered, are arranged directly between financial institutions.
- Shipping partner (EasyPost): Name and address necessary for delivery, via EasyPost and the carrier it routes your shipment to (for example, USPS or UPS).
- Email delivery provider: The information needed to send our emails to you, including your name, email address, and the content of each message.
- Analytics providers: Aggregated, anonymized usage data to improve the Site.
- Legal authorities: When required by law, subpoena, court order, or to protect our rights, safety, or property.
- Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
Your mobile information will not be sold or shared with third parties for promotional or marketing purposes.
4. Data Security
We implement industry-standard security measures to protect your personal information, including TLS/SSL encryption for all data in transit, encrypted storage for sensitive data at rest, access controls limiting employee access to customer data on a need-to-know basis, and regular security audits of our systems and procedures.
No method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
5. Cookies
We use the following types of cookies:
- Essential cookies: Required for site functionality (session management, cart state, authentication). These cannot be disabled.
- Age-verification cookie: An essential, functional cookie set when you confirm you are 21 or older, so you are not asked to confirm again on every visit. It stores no personal data and persists for up to 90 days; clearing your browser cookies removes it, and you will be asked to confirm again on your next visit.
- Analytics cookies: Help us understand how visitors interact with the Site. Data is aggregated and anonymized. You may opt out via your browser settings.
- Preference cookies: Remember your settings (e.g., filter preferences). Optional.
We do not use advertising cookies or retargeting pixels. We do not participate in third-party ad networks.
6. Data Retention
We retain your personal information for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations (including tax and accounting requirements), and resolve disputes. Order records are retained for a minimum of 7 years for tax compliance. You may request deletion of your account and associated data at any time (see Section 7).
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access: Request a copy of the personal information we hold about you.
- Correction: Request that we correct inaccurate or incomplete information.
- Deletion: Request that we delete your personal information, subject to legal retention requirements.
- Portability: Request your data in a structured, machine-readable format.
- Opt-out: Opt out of non-essential cookies and marketing communications at any time.
- Restrict processing: Request that we limit how we use your data in certain circumstances.
To exercise any of these rights, contact us at support@nulumin.org. We will respond within 30 days.
8. California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To submit a CCPA request, email support@nulumin.org.
9. International Users
If you access the Site from outside the United States, your information will be transferred to and processed in the United States. By using the Site, you consent to this transfer. We comply with applicable international data protection laws, including the EU General Data Protection Regulation (GDPR) for European users.
10. Children's Privacy
The Site is not intended for individuals under the age of 21. We do not knowingly collect personal information from anyone under 21. If we become aware that someone under 21 has provided us with personal information, we will take steps to delete it.
11. Changes to This Policy
We may update this Privacy Policy periodically. Changes will be posted on this page with a revised “Last updated” date. Significant changes will be communicated via email to registered account holders.
12. Contact
For privacy-related inquiries, contact our Data Protection team at support@nulumin.org.
