What we collect, why we hold it, and how to get it back. We take what an order or a support request needs, and not much else.
This policy covers chemlabs.shop and the data we handle when you browse it, contact support, or place an order. ChemLabs is the controller of that data.
We keep this short deliberately. We collect what an order or a support request actually needs, and not much else.
When you contact support. Your email address, the topic, any order reference you give, and the message itself.
When you create an account. Your email address and a display name derived from it.
When you order. The shipping address you enter, the products ordered, and the order reference. Card details are handled by our payment processor and never reach our servers.
Automatically. Standard server logs: IP address, user agent, and the pages requested. We use the IP address to rate-limit the support form so it cannot be flooded.
We do not collect health information, we do not ask why you want a compound, and we have no interest in building a profile of you.
Where the GDPR applies, our lawful bases are performance of a contract, our legitimate interest in running and securing the service, and compliance with legal obligations.
Essential. We store your access confirmation and, if you sign in, your session, in your browser’s local storage. These cannot be switched off without breaking the site, and they are the only things set if you decline.
Analytics. If you accept, we record aggregate page views so we can tell which pages are worth keeping. No cross-site tracking, no advertising networks, no selling anything to anyone.
You can change your mind by clearing site data in your browser, which resets the banner.
We do not sell personal data and we do not share it for anyone else’s marketing. A small number of processors handle data on our behalf:
We may disclose data where the law requires it, or where we need to establish or defend a legal claim.
Support correspondence is kept for two years. Order and batch records are retained for six years to maintain product and shipment traceability and to meet applicable recordkeeping requirements. Server logs roll off within 30 days.
When a retention period ends the data is deleted or irreversibly anonymised.
Depending on where you live you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, or complain to your data protection authority.
Email support@chemlabs.shop and we will respond within 30 days. We will ask you to verify the request came from you, and we may need to keep order records that we are legally required to retain.
The site is served over HTTPS with HSTS. Support submissions are validated and rate-limited server-side, and account passwords are stored only as salted hashes — never in a readable form. API credentials are held in encrypted environment storage and never reach the browser.
No system is perfect. If you find a vulnerability, email support@chemlabs.shop and we will confirm receipt within one business day.
Our infrastructure and processors are primarily in the United States. If you contact us from outside the US, your data is transferred there and handled under the safeguards our processors provide, including standard contractual clauses where they apply.
This site and everything we sell are intended for adults aged 21 and over. We do not knowingly collect personal information from anyone under 21, and we do not sell to them.
If you believe someone under 21 has given us personal information, contact us at support@chemlabs.shop and we will delete it.
We update this policy when what we do changes. The date at the top of the page reflects the last revision. Material changes will be announced on the site.
Privacy questions and data requests go to support@chemlabs.shop.
