Privacy Policy

Data Controller

We are the data controller.

• Contact: [email protected]

If you have any questions about this Privacy Policy, please contact us at the email above.

1. What Personal Data Do We Collect?

We collect only the data necessary to provide our services:

• Identification and contact information: Name, email address, phone number (optional), billing and shipping address.
• Account and verification data: Username, password (hashed), date of birth / age (required for 18+ verification upon account creation and purchase).
• Order and payment data: Order details, products purchased and the amount paid. We accept cryptocurrency only, and we never see or store card numbers — payment is handled entirely by our payment provider.
• Technical data: IP address, browser type, device information, cookies (for site functionality and analytics).
• Affiliate data: Referral codes/links (if you join the affiliate program).
• Communication data: Messages sent via contact form or support.

We do not collect sensitive data (health information, race, etc.), and our products are sold exclusively for research use — we do not collect any health-related or personal usage data.

2. How Do We Collect Your Information?

• Directly from you: When you create an account, complete checkout, verify age, join the affiliate program, or submit a contact form.
• Automatically: Through cookies, server logs (IP address, browsing behavior).
• Indirectly: From third parties such as payment processors (limited to transaction confirmation) or shipping partners (address for delivery).

3. Why Do We Use Your Information?

We process data only on the following lawful bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)): To process and fulfil orders, handle shipping, payments, and order updates.
• Legitimate interests (Art. 6(1)(f)): Fraud prevention, website security, improving the site via non-identifiable analytics, and managing the affiliate program.
• Legal obligation (Art. 6(1)(c)): Retaining minimal records as required by applicable laws.
• Consent (Art. 6(1)(a)): Newsletter or marketing emails (only if you explicitly opt in – you can withdraw consent at any time with the same ease).

4. Who Do We Share Your Data With?

We share data only with necessary third-party processors (with GDPR-compliant data processing agreements):

• Payment processing: NOWPayments (cryptocurrency payments; receives order amount and reference, not your address).
• Fulfilment: Our third-party logistics partner in Poland (name and delivery address only, in order to pack and ship your order).
• Email: Resend (order confirmations, shipping notifications and account emails).
• Hosting: FlokiNET (EU-based servers) and Cloudflare (traffic security and delivery).
• Analytics: PostHog (EU-hosted) and Google Analytics, only after you consent to analytics cookies.
• Others: Auditors (for accounting), legal advisors (in case of disputes).

No sharing for marketing purposes without consent. For any transfers outside the EU/EEA (e.g., to US-based processors), we use Standard Contractual Clauses (SCCs) or equivalent safeguards.

5. How Long Do We Keep Your Data?

• Order-related data: Up to 7 years (bookkeeping/legal requirements) or longer if required by law.
• Account data: Until you delete your account or after 2 years of inactivity (automatic deletion of non-order-related data).
• Affiliate data: Until participation in the program ends.
• Technical logs: Up to 12 months.

We delete or anonymize data when it is no longer needed.

6. Your Rights Under GDPR

You have the right to:

• Access your data (free copy).
• Rectification of inaccurate data.
• Erasure ("right to be forgotten") – subject to certain conditions.
• Restriction of processing.
• Object to processing (e.g., legitimate interests).
• Data portability (receive data in a machine-readable format).
• Withdraw consent (where consent is the legal basis).
• Lodge a complaint with your local supervisory authority.

To exercise your rights, contact us at [email protected]. We will respond within one month (extendable in complex cases).

7. Security

We implement appropriate technical and organizational measures: Encryption (HTTPS, data at rest), access controls, regular backups, pseudonymization where possible.

In case of a personal data breach, we will notify you and the relevant supervisory authority within 72 hours if there is a high risk to your rights and freedoms.

8. Cookies and Tracking

We use necessary cookies (for functionality) and analytics cookies (only with your consent via a cookie banner – in line with the ePrivacy Directive). See our separate Cookie Policy for details.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted here with the new date. Continued use of the website constitutes acceptance.

10. Contact

• Email: [email protected]