Privacy Policy
We collect the minimum needed to fulfil an order and to keep the compliance records required of us — and we say plainly what those are.
Effective August 1, 2026
1. What we collect
- Order information — email address, recipient name, optional organization, shipping address, and the contents and value of your order.
- Age verification records — whether the 21+ check passed or failed, the time, your IP address, and your browser user agent. We do not store your date of birth. It is used to compute the result and then discarded.
- Researcher attestation records — your email address, the exact wording you agreed to and its version, the time, your IP address, and your browser user agent.
- Account information — if you create an account, your email address and any name you supply.
- Technical data — server logs and the strictly necessary cookies described in our Cookie Notice.
We do not collect or store card numbers. Payment details are entered on our payment provider’s hosted page and never reach our systems.
2. Why we collect it, and our legal bases
- To fulfil your order — performance of a contract.
- To verify age and record your attestation — compliance with our legal obligations and our legitimate interest in operating a compliant business. These records are also evidence for our payment providers and regulators.
- To detect fraud and protect the site — legitimate interests.
- To send transactional email about your order — performance of a contract.
3. Who we share it with
We share personal information only with service providers acting on our behalf: our hosting and database providers, our payment provider, our shipping carriers and label provider, and our transactional email provider. We do not sell personal information, and we do not share it for cross-context behavioural advertising.
We may disclose information where required by law, or to protect our rights, safety, or property.
4. How long we keep it
- Age-verification and attestation records: retained for the life of the business and for as long as required for regulatory, audit and payment-underwriting purposes. These records are append-only and cannot be edited or deleted once written — that is the point of them.
- Order records: retained as required for tax, accounting and dispute purposes.
- Account information: retained until you ask us to close your account.
5. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising these rights. If you are in the EEA or UK you may also object to or restrict certain processing and lodge a complaint with your supervisory authority.
An important limit: we cannot delete compliance records. Age-verification and attestation records are retained to meet legal and audit obligations, and are technically append-only. Where we cannot honour a deletion request for that reason, we will tell you and explain the basis.
To make a request, contact privacy@discreetbiolabs.com. We will verify your identity before acting, and respond within the time the applicable law allows.
6. Security
Data is encrypted in transit. Database access is governed by row-level security so that one customer cannot read another’s orders or compliance records. Administrative credentials are held server-side only and are never exposed to your browser.
7. International transfers
Our infrastructure is operated in the United States. If you access the site from outside the United States, your information will be processed there.
8. Children
This site is not intended for anyone under 21 and we do not knowingly collect information from anyone under that age. See our Age Verification Policy.
9. Changes
We will post any changes on this page and update the effective date above.