Privacy policy

This policy explains what information Vitro Sciences collects when you use this site, who else sees it, why, and for how long. We name the processors that actually handle your data rather than describing them in general terms, and we do not sell your personal information.

Information we collect

• Account details. If you create an account: your name, email, and an optional organization. When you place an order, we also save its shipping address and phone number to your account so checkout can fill them in next time. Ask us and we'll delete them.
• Order details. At checkout: your shipping and billing address, contact information, and the items you order, used to process and fulfill the order.
• Sales representative. If you follow a representative’s link, your browser remembers which representative it was and when, for 30 days. If you place your first order in that time, or with a representative’s discount code, we record that representative against your account, and your orders over the next 12 months are credited to them, even when you follow another representative’s link or use their code. If that first order is canceled or fully refunded, or the representative stops representing us, that representative is no longer credited, and we keep a record of when and why that ended. If no representative is credited for your account, or the 12 months have passed, an order with a representative’s code is credited to that representative, for that order alone, unless it is your first order, or your first since a representative still credited for your account stopped representing us, which records them against your account as above. We record the credited representative on each order. Your representative sees the order number, date and amounts, and never your name, email or address.
• Representatives’ details. If you are one of our sales representatives, we collect at setup your name, email, phone number and mailing address, whether you work as an individual or a company, your business name if you have one, and where you plan to promote us, if you tell us. We also record which version of the representative agreement you accepted, when, and your confirmation that you are 18 or older. We use these to run the program, pay you, meet our tax reporting duties and contact you. Your name is shown to people who follow your link, and in the cart and at checkout when your code is applied. A W-9 and payout details are handled with you directly. We keep the last four digits of the account each payout is sent to, and whether we have your W-9, but not your taxpayer ID or full account numbers.
• Marketing. Your email and opt-in status, only if you choose to receive catalog and restock updates.
• Usage analytics. When analytics is enabled, we record pages viewed, device and browser type, and on-site actions such as adding to cart. If you are signed in, we link this to your account’s ID — never your email address or name — and also record changes to your account’s status, such as its approval. We do not use advertising identifiers.
• Verification signals. When bot protection is enabled, a bot-protection service assesses whether a request comes from a bot before we send a verification code.
• Diagnostics and monitoring. To keep the store working we record technical detail about requests: the page or endpoint reached, timing and status, server log lines, and errors your browser reports. These carry a cart or order reference and a request identifier so a single order can be traced through the system, and are stripped of personal detail before they leave our servers. This is operational rather than optional, so it is not covered by the analytics choice above.

Cookies and local storage

A cookie is sent to our server on every request; local storage stays on your device and is read only by the site’s own scripts. We use local storage for the cart and your signed-in session precisely so that they are not sent to our server as a cookie on every page load. Session storage is local storage that lasts only until you close the tab.

Who processes your data

We run our own payment server. Crypto and stablecoin payments settle through a payment system we operate ourselves — not a third-party payment processor — so an invoice, its status, and the wallet address it settles to are on infrastructure we control. Venmo payments are a link we generate to Venmo’s own site, not a server-to-server API integration. Opening that link sends the payment amount and an order reference to Venmo, and reconciling the payment against our account is done by hand afterward, from the note the link carries.

The other services below process data on our behalf, each for a stated reason.

• Cloud hosting providers. One hosts this storefront and keeps request logs for every page you load, which typically include your IP address. Another hosts our commerce backend and its database — your account, order, and product data, and representatives’ details.
• An analytics provider. Receives the page and event data listed above, and your account’s ID if you are signed in, only when analytics is configured and you have consented.
• A monitoring provider. Receives technical records about requests to this site and to our backend — timings, status codes, error messages and server log lines — so we can tell when something is broken and work out what happened. It also receives your cart and order reference numbers, so a fault can be traced back to the order it affected. Email addresses, postal addresses and payment details are removed from the fields that carry them, and addresses, credentials and card numbers are stripped from message text wherever we can recognize them. We cannot promise to catch a postal address written into the middle of an error message. Records are kept for 14 days. With monitoring switched off, nothing is sent at all.
• An email delivery provider. Sends transactional email (order confirmations, shipping notices, verification codes, and representatives’ setup links and statements) and, if you opt in, marketing email. Receives your email address and the content of the message.
• A shipping provider. Receives your shipping address to quote a shipping rate and, once your order ships, to generate the carrier label.
• A bot-protection service. Assesses bot risk on the verification flow before we send a code. It processes signals about your browser and device to do this.

Why we process it

• To perform our contract with you — account creation, taking and fulfilling an order, shipping, and customer service; for representatives, running the representative agreement.
• With your consent — marketing email, and analytics cookies where consent is required.
• Our legitimate interests — keeping the site secure and working (the access gate, bot verification), and understanding how it is used so we can improve it.
• Legal obligation — keeping order and tax records for the period the law requires.

Your rights

If you are in the EU or UK, GDPR gives you the right to access, correct, delete, or export your data, to object to or restrict some processing, and to withdraw consent at any time without affecting processing that already happened. If you are a California resident, the CCPA gives you the right to know what we collect, to delete it, to correct it, and to opt out of any sale or sharing — which is moot here, since we do not sell or share your personal information for cross-context advertising.

To exercise any of these rights, email privacy@vitrosciences.com. Tell us what you are asking for and the email address on your account or order, so we can find the right records. We may ask you to confirm that address, or another detail tied to the account or order, before we act on the request — that check protects you as much as it protects us, since acting on the wrong person’s say-so would be a disclosure in itself. We respond within 30 days.

How long we keep it

Order and tax records are kept for at least seven years because that is the longer end of state tax record-keeping requirements; we would rather over-retain a record we are legally required to produce than delete it early. Deleting account data on request does not reach into records we are separately required to keep for the periods above. A sales representative’s commission, statement and payout records are tax records and are kept for at least seven years. The agreement version a representative accepted, when they accepted it, and their confirmation that they are 18 or older are kept with those records, not deleted with the profile, because they are the proof of the agreement for as long as a claim under it can be brought. Their phone number, mailing address, business name and promotion channels are kept for three years after a representative leaves, in case of a dispute under the agreement, and then deleted. Their name, which is printed on statements, and their email address stay with those records.

Where your data is held

Our cloud hosting providers host this site and its backend in the United States, and that is where your data is processed and stored by default. Where a processor above accesses data from outside the United States — for example, a member of a processor’s support team working from another country — that access happens under that processor’s own data transfer safeguards, such as standard contractual clauses, not under a transfer mechanism we operate ourselves.

Security incidents

The site runs over HTTPS and we limit who can access personal information to what their role requires. No method of storage or transmission is completely secure. If a breach of your personal information occurs, we will notify affected individuals and, where the law requires it, the relevant regulator, without undue delay after we become aware of it.

Children

This site is not directed at anyone under 18, matching the age requirement in our terms of sale. We do not knowingly collect personal information from anyone under 18, and we do not sell the personal information of anyone we know to be under 18. If you believe a minor has given us information, email privacy@vitrosciences.com and we will delete it.

Contact

Questions about this policy, or a data request under the rights above: privacy@vitrosciences.com. For anything else: hello@vitrosciences.com.