Summary
We collect the minimum data needed to accept your order, ship your research standards, prevent fraud, and comply with law. We never receive full card numbers. We rely on a small set of third-party service providers, described by category below. We serve U.S. researchers primarily and honor data-subject requests from anywhere we do business.
1. Who we are
elev8 Labs is the data controller for personal information collected through this website. Contact us at support@elev8labsrx.com with any privacy question.
2. What we collect
Account and order data
- Name and email address
- Shipping address (street, city, state, postal code, country)
- Billing address as separate from shipping, when provided
- Order history, including SKUs, quantities, and prices paid
- Payment tokens, last-four digits of your card, expiration month and year — never the full card number or CVV
Partner-application data
- Business name, institution type, and EIN or equivalent tax identifier where required
- Point-of-contact name, role, and business email
- Supporting documentation you upload in your application
Technical data
- IP address, user-agent string, referrer, and timestamps for security and fraud prevention. Where we log these for fraud prevention, they are hashed for privacy rather than stored in raw form.
- Cookie identifiers and consent state
- Chatbot conversation transcripts associated with your session (retained for a limited period for authenticated users; session-only for guests)
What we do not collect
- Full card numbers (PAN), CVVs, or card track data. Card data is tokenized by our payment processor and never stored in full on our systems.
- Social Security numbers or government-issued identifiers, unless required for partner-account verification.
- Biometric data.
3. Sources
- Forms you submit on this site (account creation, checkout, partner application, contact form).
- Cookies and browser storage when you consent to analytics or marketing categories.
- Third-party service providers (such as our payment processor and email-delivery provider) that return order status, delivery confirmations, or bounce codes.
4. Purposes
We use your information to:
- Fulfill your order, including shipping, tax, and customer support.
- Prevent fraud, account takeover, and chargeback abuse.
- Comply with tax, anti-money-laundering, and card-network obligations.
- Send transactional email (order confirmations, shipping notifications, password resets).
- Send marketing email, only if you have opted in. You can unsubscribe at any time from any marketing email.
- Improve the website and our product catalog through consented, aggregated analytics.
We do not sell your personal information. We do not share your personal information with advertisers beyond the privacy-safe analytics described below.
5. Service providers
We rely on the following categories of service providers. Each is bound by a data processing agreement and processes data only on documented instructions.
| Provider category | Purpose | Data categories |
|---|---|---|
| Cloud database / hosting providers | Database hosting (U.S. region) | Account and order data |
| Application hosting / CDN providers | Application hosting and edge delivery | Request logs, IP address, user-agent |
| Content-delivery, storage, and bot-protection providers | Asset storage and bot-protection challenge | Uploaded assets, challenge-event metadata |
| Email delivery provider | Transactional and marketing email delivery | Email address, email body, delivery status |
| Error-monitoring provider | Server-side error monitoring (PII scrubbed) | Stack traces, request metadata, scrubbed user ID |
| Analytics providers | Product and audience analytics (consent-gated) | Page views, referrer, device category, anonymous identifiers |
| Payment processor | Card-tokenization and authorization | Payment token, last-four, expiry, billing address |
Our service providers may change as our stack evolves. Material changes will be reflected here.
6. Cookies
We use the minimum cookies required to operate the site and, with your consent, a small set of analytics and marketing cookies.
| Category | Purpose | Consent required |
|---|---|---|
| Essential | Session management, CSRF tokens, age-gate acknowledgment, consent state | No |
| Analytics | Traffic and product-usage analysis | Yes |
| Marketing | Attribution for marketing campaigns; not currently active at launch | Yes |
You can update your consent preferences at any time via the cookie banner or by clearing your browser cookies for this site.
7. Data retention
We keep personal information only as long as we need it for the purposes described in this policy, and as required by law. In general:
| Data category | Retention window |
|---|---|
| Account and order records | Retained as long as your account is active and as required by law. |
| Payment tokens | Until the token expires or you remove the card on file. |
| Chatbot transcripts | Retained for a limited period for authenticated users; session-only for guests. |
| Analytics data | Retained for a limited period. |
| Security and fraud logs | Retained for a limited period for security purposes. |
| Marketing email suppressions | Retained as needed to honor your unsubscribe choices. |
| Tax-related records | Retained as required by law. |
8. Your rights
We honor the rights granted by the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to:
- Know what personal information we collect, disclose, and share.
- Request access to and a copy of your personal information.
- Request correction of inaccurate personal information.
- Request deletion of your personal information, subject to legal retention obligations.
- Opt out of any sale or sharing of personal information (we do not sell).
- Limit the use and disclosure of sensitive personal information.
If you reside in a jurisdiction covered by the EU General Data Protection Regulation (GDPR) or the UK GDPR, you have additional rights including data portability and the right to object to processing based on legitimate interest.
To exercise any right, email support@elev8labsrx.com from the address associated with your account. We may require additional verification for sensitive requests. We will respond within 45 days, or sooner where required by law.
9. Children's privacy
This website is not directed at children and is restricted to users 21 and older. We do not knowingly collect personal information from anyone under 21. If you believe an underage individual has submitted information to us, contact support@elev8labsrx.com and we will delete it.
10. Security
We protect your data with:
- Industry-standard security headers and encryption in transit.
- Tokenized card data; no full card numbers or CVVs on our servers.
- Role-based access controls on the admin dashboard.
- Rate limiting on authentication and mutation endpoints.
- Scrubbed error tracking with personally identifiable information removed from breadcrumbs.
- Regular dependency audits.
No system is perfectly secure. If you suspect a security issue with your account, email support@elev8labsrx.com immediately.
11. International transfers
Our infrastructure is U.S.-based. If you access the site from outside the United States, your information will be transferred to and processed in the United States. By using this site, you consent to that transfer.
12. Updates to this policy
We may update this policy to reflect changes in our processing, stack, or legal obligations. The "last updated" date at the top of this page reflects the most recent revision. Material changes to processing will be communicated by email where we have a lawful basis and current contact details.
Questions
Reach us at support@elev8labsrx.com.
elev8 Labs products are reference standards for laboratory research only. Not for human consumption.