Privacy policy

What we collect

We collect what we need in order to take, fulfill and support an order or answer an inquiry:

• Account information — the email address you sign in with, and the contact name, organization and telephone number you give us, which we keep on your account so you do not have to re-enter them.
• Order information — shipping address, purchase order reference, the items ordered, any notes you provide, and your confirmation of the research-use certification.
• Payment information — for Cash App, Zelle, ACH and cryptocurrency orders we hold no account details of yours; we keep the reference of the payment we received so that we can match it to the order and issue refunds. Where card payment is offered, card details are entered into a form supplied by the payment processor named at checkout and are sent directly to them; the card number never reaches our servers and we do not store it. We receive and keep the processor's transaction reference and the last four digits of the card.
• Inquiry and support information — whatever you include in a contact form message or an email to us, and the record of what we sent back.
• Technical information — standard server logs including IP address, browser type and pages requested, retained for security and diagnostic purposes. Your IP address is also used to rate-limit the order and contact forms and is used by our payment processor for fraud screening when you pay. Your browser may also report to us, and we log, the address of any resource that our security policy blocked a page from loading; those reports contain the page and resource addresses only.
• Internal notes — our staff may record notes against an order or a customer relating to fulfillment, payment, returns or fraud prevention. These are not shown to you but are covered by your rights below.

How we use it

• To review, accept, charge or invoice, fulfill and ship your order.
• To maintain the lot traceability records that regulation and good practice require.
• To answer your inquiries and support requests.
• To detect and prevent fraud and abuse of the site.
• To meet our own legal, tax and record-keeping obligations.

To help us answer support messages, we use an automated drafting tool provided by Anthropic. The text of your message and the facts of your order may be sent to that service to prepare a draft reply; a member of our staff reads every draft before anything is sent to you. Our agreement with the provider does not permit it to use your information to train its models.

We do not sell, rent or trade your personal information, and we receive no money from anybody for it.

We do share for advertising, and we would rather state it plainly than bury it. This site carries two advertising tags on every page: TikTok's pixel and Google's Google Ads tag. Between them they report the pages you open, the products you view, add to the cart and order, and an identifier in a cookie that each company can read on other sites carrying its own tag. Under California law that is sharing for cross-context behavioral advertising, and you have the right to stop it: Do Not Sell or Share My Personal Information. It takes one click, it works immediately, and nothing else on this site changes.

One more Google script runs in one place only. If you pay by card for delivery inside the United States, the order confirmation screen shows Google's Customer Reviews opt-in, which asks whether Google may email you a short survey about the order. To ask you, it is given your order reference, the email address you placed the order with, the destination country and the estimated delivery date already shown to you — your name, address, payment details and what you bought are not sent. It appears nowhere else on this site, and the same one click at Do Not Sell or Share My Personal Information stops it loading at all.

The pixel is not sent your name, email address, postal address, telephone number, payment details or anything you type into a form. We build no behavioral profiles of our own.

Who we share it with

We share the minimum necessary with the providers that operate parts of this service:

• Card payment processor (named at checkout, where card payment is offered) — card payment processing.
• Shipping carriers (FedEx, USPS) — name, address and telephone number, to deliver your order.
• Resend — delivery of order, sign-in and support emails.
• Google Workspace — our support mailbox, where your emails to us are held.
• Anthropic — drafting of support replies, as described above.
• Neon and Vercel — hosting of our database and website, including server logs.

We also share information with professional advisers where legally required, and we disclose information to law enforcement or regulators only where compelled by valid legal process.

Cookies and local storage

When you confirm the research-use notice that every visitor sees before entering the site, we set a cookie recording the date and time of that confirmation; it lasts fifteen days and is cleared when you sign out, after which the notice is shown again. When you sign in, we set a cookie that keeps you signed in for up to fifteen days; it holds only a random session identifier. Both are strictly necessary for the site, the account and checkout to work. This site uses browser local storage to remember the contents of your cart on your own device, and a cookie holding a random identifier so that we can see how many people are on the site and what is in the carts currently open. That identifier is tied to the pages you open on this site, when you opened them, the contents of your cart, the site that linked you here if any, and the approximate area — town, region and country — that our content delivery network works out from your connection before the request reaches us, and whether you are using an iPhone or iPad, an Android device or a computer. We do not record your IP address against it, we do not record anything finer than a town and no coordinates, we read your browser’s own description of itself only to tell those three apart and do not keep it, we do not record anything you type, your clicks or your mouse, we do not build a profile from it, and it does not follow you anywhere off this site. The record of pages opened is deleted after 90 days. If you sign in or check out, your cart is matched to your account, and we may email you once about a cart you left behind — every such message carries a one-click unsubscribe, and unsubscribing stops them for good without affecting anything about an order you place. None of what this paragraph describes is sold or shared with anybody: it is ours, it stays here, and it is not advertising. The exceptions on this site are the two advertising tags — TikTok's pixel and Google's Google Ads tag — together with Google's Customer Reviews opt-in on the order confirmation screen, which are third-party scripts and are described above and in the Cookie Policy; you can refuse them at Do Not Sell or Share My Personal Information.

Where card payment is offered, the card form on our checkout page is provided by the payment processor named there and is governed by that processor's privacy policy; it may set its own cookies within that form for fraud prevention.

Accounts

Orders are placed through an account. There is no password: we email a link that signs you in once and expires after fifteen minutes. Your account shows your order history and keeps your contact details for the next order. You can ask us to delete your account at any time; order records that we are required to keep will be retained as described below, but no longer linked to a usable account.

Retention

• Order and lot records, including the payment reference and last four card digits, are retained for a minimum of seven years to meet tax and traceability requirements.
• Contact inquiries and support correspondence that do not relate to an order are deleted after two years.
• Server logs are retained for ninety days.
• Sign-in links expire after fifteen minutes; sessions expire after thirty days.

Your rights

Depending on where you live, you may have the right to request a copy of the personal information we hold about you, to have it corrected, to have it deleted where we are not required to keep it, to know which categories of information we hold and share, and to opt out of the sharing described above — use Do Not Sell or Share My Personal Information, which takes effect at once. Write to support@afabiosciences.com and we will respond within thirty days. We will not treat you differently for exercising these rights.

California residents

Under the CCPA/CPRA you have the right to know the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to (all set out above); the right to delete it, subject to the retention obligations above; the right to correct it; and the right not to be discriminated against for exercising these rights. We do not sell personal information. We do share it for cross-context behavioral advertising, through the TikTok pixel and the Google Ads tag described above, and we disclose an order's reference and email address to Google through the Customer Reviews opt-in also described above; you have the right to direct us to stop all of it: Do Not Sell or Share My Personal Information. We honour Global Privacy Control as an opt-out signal on its own, with no request needed. We have no actual knowledge of selling or sharing the personal information of anyone under 16. To exercise a right, email support@afabiosciences.com; we will verify the request against the account or order details we hold and respond within 45 days. An authorized agent may act for you with your written permission.

EU and UK residents

AFA TRADERS LLC is the controller of the personal data described in this policy. We process order and account data because it is necessary to perform the contract you enter when you order (Article 6(1)(b) GDPR); inquiry data, fraud screening, server logs and internal notes on the basis of our legitimate interest in running, securing and improving the service (Article 6(1)(f)); and we retain transaction records because the law requires it (Article 6(1)(c)). You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority. Data is processed in the United States; where it leaves the EU or UK we rely on the standard contractual clauses in our providers' terms. Requests go to support@afabiosciences.com and are answered within one month.

Age

This site and its products are for purchasers who are at least 21 years of age. We do not knowingly collect information from anyone under 21; if we learn that we have, we delete it.

Security

The site is served over TLS, sign-in tokens and support-mailbox credentials are stored only in hashed or encrypted form, and access to order records is restricted to personnel who need it. No system is perfectly secure, and we cannot guarantee absolute security of information transmitted over the internet.

Changes

When this policy changes, the date at the top is updated. Material changes that affect how information already collected is used will be notified to the email address on your account.

Contact

Questions about this policy go to support@afabiosciences.com, or by post to AFA TRADERS LLC, trading as AFA Biosciences, PO Box 24003, Jersey City, NJ 07304, United States.