Privacy

When you place an order we collect the email address, organisation, and any notes you provide, the recipient name and U.S. delivery address, a phone number, the shipping quote, and the contents of your order. When you pay, our payment processor tells us the status of the payment and the amounts involved, and we keep its notification in full as the record of that payment; it carries the processor's own transaction identifiers, not your wallet address or your bank account number.

We store your researcher confirmation in a cookie on your own device, and your order in your browser's local storage so it survives a page reload. Neither is used for advertising and neither is shared. Our cookie policy lists every one of them by name.

Our hosting provider records the IP address and user agent of requests to this site in its own server logs. That happens for every site it serves and is not something we switch off. We do not join those logs to an order or to an account.

If you open an account we collect your email address, your organisation if you give us one, the two researcher affirmations you make — at registration, or at your first sign-in for an account created through a provider — and the timestamps our database records for them, and the dates your account was created, last updated, and last signed in to, together with whether your email address has been confirmed. We never receive or store your password — see the security policy for how it is handled.

If you sign in through Google, that provider tells us your email address, an account identifier, and the basic profile details attached to your provider account — typically your name and a profile picture link — which our authentication provider stores with your account. We do not use or display them, and we do not receive your contacts, files, or activity from the provider account. The sign-in is a redirect to the provider's own site and back; no provider code runs on any page of this site.

Our authentication provider records the IP address and user agent of every sign-in attempt in its authentication log, and sets session cookies on your device. Both are how a sign-in is kept secure and neither is optional.

Where you place an order while signed in, we keep the reference, your email address, your organisation, your notes, the delivery address, the items in the order, the totals, and the payment status, so you can see your past orders.

Anything you affirm at registration is recorded as your affirmation at a point in time. It is your statement, timestamped by our database; it is not a verification we carried out.

To process and fulfil your order, to take and reconcile payment, to respond to you, and to keep the records we are required to keep as a supplier of research materials. Orders placed without an account are kept for as long as those record-keeping obligations require.

An account exists so that your researcher affirmation and your past orders are durable rather than living in a cookie on one device. You do not need one to browse the catalog, build an order, or check out.

Order details are shared with the third-party fulfillment partner that dispatches your order — the recipient name and shipping address the order is sent to, the email address and any phone number needed to deliver and track it, and the items ordered — and with our payment processor when payment is taken. Both receive only what they need for that job and nothing else. Our cryptocurrency processor, NOWPayments, receives the order reference, the amount, and the address of the page to return you to. It does not receive your name, delivery address, email, or the items ordered. Our bank-payment processor, eDebit Direct, receives more, because a bank debit is authorised against the payer: your name, email address, phone number, and delivery address, together with the order reference and the amount. It does not receive the items ordered.

This site is hosted by Vercel, and accounts and their data are held by Supabase, which provides our authentication and our database. Both process data on our behalf under their own terms.

We disclose data to a public authority only where we are legally required to.

We keep account data for as long as the account exists. When an account is closed we delete it, except for anything we are required to keep as a record of a sale, which we keep for the period that obligation runs and no longer.

Cookies and local storage sit on your own device and are yours to clear at any time. Clearing them removes them immediately.

You may request a copy of the data we hold about you, ask us to correct it, or ask us to delete it, by writing to help@atlanticlongevity.net. We will respond within the period required by applicable law.

We do not sell or share personal information as those terms are defined under U.S. state privacy laws. We do not use it for targeted advertising, and we run no advertising or analytics trackers.

We honour access, correction, and deletion requests from any resident of any state, whether or not the statute in that state applies to a business of our size.

If a security incident results in unauthorised access to personal information we hold, we will notify the people affected and the authorities, as applicable law requires.

This site sells laboratory research materials to qualified researchers aged 21 or over, and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.