Privacy Notice

Information we collect

Registration details you give us (name, email, phone, province, organization and website, research interest and whether you buy at wholesale volumes), order details including the shipping address you enter at checkout, and anonymous first-party analytics about how the site is used. We do not collect payment card data: payments are handled entirely by our payment provider.

How we protect it

• Phone numbers, IP addresses, street address lines, ZIP codes and creator payout details are encrypted before they are stored, using a key held only in our server environment.
• Staff views show these fields masked by default; a full value has to be revealed one record at a time.
• Access to the catalog uses a single-use sign-in link and an encrypted, http-only session cookie that expires after 30 days. No password and no access code is ever stored.
• Third-party credentials (email delivery, payments, advertising) exist only in our server environment and are never sent to your browser.

How we use information

To review research-access registrations, fulfil and ship orders, provide order status and support, prevent fraud and abuse, and measure which campaigns bring researchers to us.

Sharing

We share the minimum necessary with the providers that operate the business: email delivery, payment processing, and shipping. Where we measure advertising performance, only irreversibly hashed identifiers are sent, never a readable email or phone number. We do not sell personal information.

How long we keep it

• Registrations that never became orders: deleted after 24 months.
• Anonymous analytics events: deleted after 14 months.
• Raw payment provider notifications: deleted after 90 days.
• Sign-in links: single use, and deleted within 7 days.
• Order records: retained as long as required for tax and accounting purposes.