01Who we are and what this covers
This Privacy Policy explains how [Company Legal Entity, LLC], doing business as Darkside Labs (“we,” “us,” or “our”), collects, uses, shares, and protects personal information when you visit our website, create an account, place an order, use our Research Finder tool, subscribe to emails, or contact us. We are the business responsible for (the “controller” of) that information.
This policy does not cover third-party websites or services we link to, such as our payment processor’s hosted checkout page or carrier tracking pages, which are governed by their own privacy policies.
02Information we collect
Information you give us
- Account information: your name, email address, and password (stored only in hashed form by our authentication provider).
- Order and shipping information: name, shipping address, phone number (if provided), email address, items ordered, amounts paid, coupon codes used, order notes, and order history.
- Research-use attestation: when you check out, we record that you confirmed you are 21 or older and purchasing for lawful laboratory research, together with the date, time, and IP address of that confirmation.
- Communications: the content of messages you send through our contact form or by email, and our replies.
- Research Finder answers: the research areas and questionnaire answers you submit, the catalog items suggested to you, and your email address if you choose to provide it.
- Email subscriptions: your email address and the date and source of your sign-up.
Payment information
Payments are handled by Stripe on its secure hosted checkout page. We never receive or store your full card number or security code. Stripe shares with us limited information such as payment status, a payment reference, and in some cases the card brand and last four digits, so that we can confirm and manage your order.
Information collected automatically
- Technical data: IP address, browser type, device information, and pages requested, collected in server logs and used for security, fraud prevention, and rate limiting.
- Cookies and local storage: a strictly necessary sign-in session cookie, and browser local storage that keeps your cart contents and your research-use acknowledgment. We do not currently use third-party advertising or cross-site tracking cookies. See our Cookie & Local Storage Policy.
Information from others
We may receive information from our payment processor (such as fraud-screening results) and from shipping carriers (such as delivery status).
03How we use information
We use personal information to:
- process, fulfil, ship, and support your orders, including sending order confirmations and tracking emails;
- create and maintain your account and let you view your order history;
- verify eligibility, enforce our Research Use Only Policy, and keep records of research-use attestations;
- respond to your messages and provide customer service;
- send marketing emails where you have subscribed or where otherwise permitted by law (you can opt out at any time);
- detect, prevent, and investigate fraud, abuse, security incidents, and unlawful activity;
- maintain, secure, and improve the website and our catalog; and
- comply with legal, tax, accounting, and regulatory obligations, and establish or defend legal claims.
We do not use your information to make decisions that produce legal or similarly significant effects about you based solely on automated processing.
05How long we keep information
We keep personal information only as long as necessary for the purposes described above:
- Order records and research-use attestations: generally up to seven years, to meet tax, accounting, and compliance obligations and to resolve disputes.
- Account information: until you ask us to delete your account, subject to the order-record period above.
- Contact messages and Research Finder submissions: up to 24 months, unless needed longer for an open matter.
- Marketing subscriptions: until you unsubscribe; we then keep a minimal record of your email address so we can honor your opt-out.
- Server logs: for a limited period for security and troubleshooting.
06Security
We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit (HTTPS), database access controls that limit each user to their own records, restricted staff access based on role, signed and verified payment notifications, and rate limiting on sensitive forms. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Please use a strong, unique password and contact us immediately if you believe your account has been compromised.
07Your rights and choices
Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, and to receive a copy of it in a portable format. You can update much of your account information yourself from your account page, or email hello@darksidelabs.org to make a request. We will not discriminate against you for exercising your rights.
California residents (CCPA / CPRA)
If you are a California resident, you have the right to:
- know the categories and specific pieces of personal information we collect, use, and disclose, and the purposes for doing so;
- request deletion of personal information we collected from you, subject to legal exceptions;
- request correction of inaccurate personal information;
- opt out of the “sale” or “sharing” of personal information (we do not sell or share personal information as those terms are defined);
- limit the use of sensitive personal information (we use account login credentials only to provide the Services, and do not use sensitive personal information to infer characteristics about you); and
- not receive discriminatory treatment for exercising these rights.
In the past 12 months we have collected the categories of information described in Information we collect (identifiers, commercial information, internet or network activity, and account credentials) and disclosed them for business purposes only to the categories of recipients listed in How we share information. You may make a request yourself or through an authorized agent. We will verify your identity by matching information you provide against our records before fulfilling a request.
EEA, UK and Switzerland
Our products are currently offered only in the countries listed in our Shipping Policy. If we offer shipping to, or otherwise process information of individuals in, the European Economic Area, the United Kingdom, or Switzerland, the following also applies:
- Legal bases. We process personal information to perform our contract with you (orders and accounts), to comply with legal obligations (tax and compliance records), for our legitimate interests (security, fraud prevention, enforcing our policies, and improving our services), and with your consent (marketing emails, where required).
- Your rights. You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests or for direct marketing. Where processing is based on consent, you may withdraw consent at any time.
- International transfers. We are based in the United States and our service providers may process information in the U.S. and other countries. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
- Complaints. You have the right to lodge a complaint with your local data protection authority, although we would appreciate the chance to address your concern first.
We aim to respond to verified requests within 30 days (or 45 days where permitted by applicable law).
08Marketing emails
If you subscribe to our emails, we may send you news about products, restocks, COA updates, and promotions. Every marketing email includes an unsubscribe link, and you can also opt out by emailing hello@darksidelabs.org. Opting out of marketing does not stop transactional messages about your orders or account, such as confirmations and tracking updates.
09Age requirement
The Services are intended only for adults aged 21 or older who are qualified researchers or acting for a research organization. We do not knowingly collect personal information from anyone under 21, and the Services are not directed to children. If you believe someone under 21 has provided us with personal information, please contact us at hello@darksidelabs.org and we will delete it.
10Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where the changes are material, we will provide additional notice (for example by email or a notice on the website).
11Contact us
To exercise your rights or ask a question about this policy, contact:
[Company Legal Entity, LLC]
d/b/a Darkside Labs, Attn: Privacy
[Business Address]
Email: hello@darksidelabs.org