Legal

Privacy policy

What we collect, why, and what we will never do with it.

Last updated August 10, 2026

What we collect

  • Contact and shipping details you give us at checkout.
  • Order history, so you and our support team can see what you bought.
  • Payment metadata only — card brand, last four digits, issuing country. Never a full card number.
  • Technical data: IP address, browser, and the pages you visited, used for fraud prevention and to understand what is working.

What we do with it

We use it to fulfil orders, provide support, prevent fraud, meet legal obligations, and — only if you opt in — to tell you about restocks and new compounds. Order confirmations and shipping notices are not marketing and are always sent.

What we never do

We do not sell your personal information. We do not share your order history with advertisers. We do not disclose what you bought to anyone outside the parties needed to ship and support it.

Who we share it with

Only the processors needed to run the store: our payment provider, shipping carriers, email delivery, and our hosting and database providers. Each receives the minimum needed to do its job.

Card data

Card details are entered into fields hosted by our payment provider and tokenized in your browser. They never pass through our servers, are never written to our logs, and are never stored by us.

How long we keep it

Order records are retained for seven years to meet tax and accounting obligations. Marketing preferences are kept until you withdraw them. Analytics data is retained in aggregate.

Your rights

You can access, correct, export or request deletion of your personal data by contacting us. Deletion requests are honoured except where we are legally required to retain order records. You can unsubscribe from marketing at any time from your account or any marketing email.

Cookies

We use cookies for essential functions — your bag, your session, and the age confirmation — plus first-party analytics. Referral cookies record which partner sent you, for 30 days.

Questions about any of this? Contact us — a person reads every message.