Prime Science Supply ("we") respects your privacy and works to protect your personal data. This Policy describes what information we collect, how we use it, who we share it with, and how long we keep it.
1. Who we are
Prime Science Supply supplies research-grade peptides and compounds (Research Use Only — RUO). We operate through the website primesciencesupply.com. Orders are placed on the website and confirmed by email.
2. What data we collect
We collect the following personal data when you place an order:
- Identification: full name
- Contact: email address and phone number
- Delivery: shipping address, city, state, and postal code
- Research affiliation: the type of institution you state you represent at checkout (for example: individual researcher, academic institution, CRO)
- History: orders placed, amounts paid, and coupons used
- Browsing (with your consent): analytics cookies via Google Analytics 4
3. How we use your data
We process your personal data for the following purposes:
- Order fulfillment: processing and delivering your order, issuing the charge, and managing inventory and logistics.
- Legal and tax obligations: keeping tax and accounting records for as long as needed to meet tax obligations and to respond to audits and payment disputes.
- Customer support: answering questions, providing support, and sending updates about your order.
- Email marketing (with your consent): sending promotions, news, launches, and offers — only if you expressly opt in at checkout. You can opt out at any time by clicking "Unsubscribe" in the footer of any email you receive.
- Site analytics and improvement (with your cookie consent): understanding how the site is used and improving the experience.
3.1 Opens and clicks in marketing emails
When we send marketing emails (only to people who consented), they include:
- Open pixel: a 1x1 image that records when the email is opened (date and time).
- Tracked links: links in the email pass through a redirect that records the click before sending you to the destination.
Purpose: measuring engagement and improving content. This data is stored in our own database and is not shared with third parties. If you prefer not to receive marketing emails, simply unsubscribe using the link in the footer of every email.
3.2 Re-engagement of existing customers
If you have purchased from us in the past and have not expressly opted in to marketing emails, we may send you a single re-engagement email, based on our legitimate business interest in maintaining the relationship. That email contains a button to opt in to further messages and a prominent unsubscribe link. If you ignore it, we remove your address from the list after 30 days.
4. Sharing your data
We share your data only when necessary, with the following categories:
- Carriers and logistics providers: name, address, and phone number, so the package can be delivered.
- Payment processor: the data strictly necessary to process the payment (we do not store card data).
- Infrastructure providers: hosting on Supabase and Vercel (under data protection terms).
- Transactional and marketing email provider: Resend (resend.com) — it only sends emails authenticated by our domain. It does not store your data beyond what delivery requires.
- Government authorities: upon a court order or lawful request.
We do not sell or rent your personal data to third parties.
5. Cookies and similar technologies
We use cookies to keep the site working (cart, language) and, with your consent, Google Analytics 4 analytics cookies. You can accept or decline at any time through the cookie banner, choosing between "Necessary only" and "Accept all".
6. How long we keep your data
- Order and financial data: up to 5 years after the last transaction — this is our retention policy for tax, accounting, and payment-dispute purposes.
- Marketing data: until you withdraw your consent.
- Cookie and consent logs: for 5 years, for audit purposes.
7. Your rights
You can request confirmation that we process your data, access, correction, deletion, a copy of your data in a portable format, and withdrawal of consent. Section 8 sets out those rights in CCPA/CPRA terms, along with our response deadlines.
8. California privacy rights (CCPA/CPRA)
This section describes the rights created by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and uses the categories of personal information that law defines. It applies to California residents — but in practice we handle these requests the same way for every customer, without asking which state you live in.
8.1 Categories of personal information we collect
- Identifiers: name, email address, phone number, shipping address, and IP address. Source: you, at checkout or when you create an account. Purpose: processing and delivering your order, providing support, and preventing fraud.
- Commercial information: products ordered, amounts paid, coupons used, and order history. Source: your own transactions. Purpose: fulfilling the order, accounting, and customer support.
- Internet or other electronic network activity: pages visited and browser/device data, via Google Analytics 4 — collected only if you accept analytics cookies. Purpose: measuring and improving the site.
- Customer records: the combination of name, address, and phone number tied to a transaction. Same source and purpose as above.
- Professional or employment-related information: the type of research institution you state you represent at checkout. Source: you. Purpose: recording that the material is supplied for research use, as our terms and our payment partners’ review require.
8.2 What we do not collect
We do not collect any of the categories the CPRA calls "sensitive personal information": Social Security number, driver’s license, passport, or any government ID; bank account or payment card numbers; precise geolocation; biometric or health data; racial or ethnic origin, religion, or union membership; or the contents of your mail, email, or messages. Card data goes straight to the payment processor and never passes through our systems.
Because we do not collect data in those categories, the right to limit the use of sensitive personal information has nothing to apply to.
8.3 Sale and sharing: we do neither
- We do not sell your personal information, and we have not sold it in the preceding 12 months.
- We do not share your personal information for cross-context behavioral advertising, and we have not shared it in the preceding 12 months. The site carries no advertising pixel from any network. Our analytics tag only loads after you accept analytics cookies, and it is configured to keep advertising signals switched off even then.
- We have never sold or shared the personal information of consumers under 16 years of age.
That is why there is no "Do Not Sell or Share My Personal Information" link on this site: there is no sale or sharing to opt out of. If that ever changes, we will update this policy and put the opt-out link in the footer before the change takes effect.
Passing data to a carrier, a payment processor, or an infrastructure provider in order to fulfill your order — as described in section 4 — is neither a "sale" nor a "share" under the CCPA: those providers may only use the data for the service we hired them to perform.
8.4 Your rights under the CCPA/CPRA
- Know and access: which categories of data we collect, where it came from, what we use it for, who we share it with — and a copy of the specific pieces of data we hold about you.
- Delete: ask us to delete the personal information we hold about you, subject to the exceptions the law itself allows — the main one here is order and payment records, which we need to keep for tax and payment-dispute purposes.
- Correct: ask us to correct inaccurate personal information.
- Opt out of sale or sharing: does not apply today — see 8.3.
- Limit the use of sensitive personal information: does not apply today — see 8.2.
- No discrimination: we will not deny you products, charge you a different price, give you a lower-quality product, or provide you a worse level of service because you exercised any of these rights.
8.5 How to submit a request and how long we take
Send an email to [email protected] with the subject line "Privacy request". The timelines below are the ones the CCPA sets — we do not promise a shorter deadline than we can meet:
- We confirm we received your request within 10 business days.
- We respond substantively within 45 calendar days of receiving the request. If we need more time, we may extend by up to another 45 calendar days, telling you and explaining why before the first period runs out.
- Requests are free of charge, up to twice in any 12-month period.
How we verify it is you: we compare what you tell us against what is already on your record — normally the email address or phone number used on the order, plus an order number. We do not ask for a government ID: that would mean collecting data more sensitive than what we are protecting. If we cannot confirm your identity from what we already hold, we explain why and what is missing.
Authorized agent: you may appoint someone to submit the request on your behalf. In that case we may require written permission signed by you, and we may still confirm your identity directly with you.
9. Residents of other U.S. states
Several other U.S. states have comprehensive privacy laws that grant rights similar to those in section 8 — access, correction, deletion, and opting out of sale. We do not run a separate process per state: use the same email address and the same path described in 8.5, and we will handle your request the same way, on the same timelines.
10. Children’s privacy
This site is not directed to anyone under 18, and we do not knowingly collect personal information from children under 13. If we learn that we have received data from a child under 13, we delete the record. If you are a parent or guardian and believe this has happened, write to the address in section 13.
11. Security
We use technical and organizational measures to protect your data: encryption in transit (HTTPS), Row Level Security in the database, role-based access control (admin/operator), automated backups, and access auditing.
12. Changes to this policy
This Policy may be updated from time to time. The current version is always available on this page, with the last-updated date at the top. Material changes will be communicated by email to active customers.
13. Privacy contact
For any question, request, or exercise of rights relating to your personal data: