This policy is draft text written for the design prototype. Retention periods, the processor list, and the rights sections have not been reviewed by qualified counsel and must not be published in this form.
Who we are
Atlas Labs (PLACEHOLDER — legal entity name and registered address to be inserted) is the controller of the personal information described here. This policy covers this website, orders placed through it, and the account and certificate-lookup features attached to it.
What we collect
You give us
- Account details: name, email address, and the one-time codes used to sign in.
- Order details: billing and shipping address, phone number where you provide one, and the contents of your order.
- Institutional details: institution or laboratory name, role, and anything you send us to support verification or a purchase-order account.
- Correspondence: what you write in the contact form or email us, and our replies.
We collect automatically
- Device and usage data: IP address, browser and device type, pages viewed, referring page, and timestamps.
- Cookie identifiers as described in section 5.
- Certificate lookups: lot numbers and verification codes entered into COA Lookup, which we log to detect abuse and to spot counterfeit codes.
We do not collect
- Full payment card numbers. Those go straight to our payment processor.
- Health information. Do not send it — these products are not for human or veterinary use and we have no reason to hold it.
- Any special-category data. If you send it unprompted we will delete it.
How we use it
- To take, verify, fulfil, and ship your orders, and to handle returns and QC claims.
- To operate your account and sign you in.
- To answer your enquiries and provide support.
- To keep records we are required to keep, including the research-use attestation attached to each order.
- To detect and prevent fraud, abuse, and misuse of the site or of certificate verification.
- To measure how the site is used so we can improve it.
- To send you marketing email, where you have opted in.
Our lawful bases (where that framing applies) are performance of the contract for order handling, legal obligation for record-keeping, legitimate interests for fraud prevention and site improvement, and consent for marketing and non-essential cookies. PLACEHOLDER — to be confirmed by counsel against the final data map.
Attestation and verification records
When you confirm the research-use attestation at checkout, we record that confirmation against the order along with the time it was made. In the production build this is stored as an attribute on the order itself.
Anything you send us for institutional verification — a laboratory address, a purchase order, a letter of affiliation — is kept with the account and used only to decide whether an order can be released. It is not used for marketing.
Payments
Card details are entered directly into our payment processor's environment and are never received or stored by Atlas Labs. We keep the outcome of the transaction, the last four digits, the card brand, and the billing address, so we can match payments to orders and process refunds.
Marketing email
We send marketing email only where you have opted in. Every marketing email carries an unsubscribe link and unsubscribing takes effect immediately. Transactional email — order confirmations, dispatch notices, certificate notifications, and account security messages — is part of the service and is not covered by the marketing opt-out.
How long we keep it
| Record | Retention |
|---|---|
| Order and attestation records | PLACEHOLDER — expected to follow the statutory accounting and product-record period |
| Account details | While the account is open, then PLACEHOLDER after closure |
| Support correspondence | PLACEHOLDER |
| Analytics and access logs | PLACEHOLDER |
Retention periods are placeholders pending counsel. When a period ends we delete the record or irreversibly anonymise it.
Security
The site is served over TLS. Sign-in uses one-time codes rather than stored passwords. Access to order and account data is limited to staff who need it, and our platform and payment providers maintain their own certified controls. No system is perfectly secure, so we cannot guarantee absolute security — but we will notify you and the relevant authority where a breach requires it.
Your rights
Depending on where you live you may have the right to:
- Ask what personal information we hold about you and get a copy of it.
- Have inaccurate information corrected.
- Have information deleted, where we are not required to keep it.
- Object to or restrict certain processing, including profiling.
- Receive your information in a portable format.
- Opt out of the sale or sharing of personal information and of targeted advertising.
- Withdraw consent at any time, without affecting processing already carried out.
To exercise any of these, email research@getatlaspeptides.com or use the contact form. We respond within the period the applicable law requires and we will never treat you differently for exercising a right. We may need to verify your identity first. If you are unhappy with our response you can complain to your data protection authority.
International transfers
We operate from the United States, and our service providers may process information in the United States and elsewhere. Where information is transferred out of a region that restricts transfers, we rely on an appropriate safeguard such as standard contractual clauses. PLACEHOLDER — the transfer mechanism will be confirmed with counsel.
Children
This site is not directed at children and we do not knowingly collect information from anyone under 18. Purchasing requires you to be at least 18 (or the age of majority where you live, if higher). If you believe a child has given us information, tell us and we will delete it.
Changes
We may update this policy. The "last updated" date at the top changes when we do, and material changes will be notified to account holders by email.
Contact
Privacy questions and rights requests: research@getatlaspeptides.com or the contact form. A postal address for privacy correspondence is PLACEHOLDER pending the operating entity's registration.