Effective Date: July 20, 2025
1. Introduction
At ExoLabz, your privacy is extremely important to us. This Privacy Policy outlines how we collect, use, disclose, and protect your personal information in compliance with applicable United States federal and state privacy law, including the California Consumer Privacy Act (as amended by the CPRA) and the Utah Consumer Privacy Act. By using our website, you consent to the practices described below.
2. Who We Are
ExoLabz is a United States-based supplier of high-purity research peptides and related materials. All products are strictly for research purposes only, and all personal information collected is handled with care and transparency.
3. Information We Collect
We may collect the following types of personal information when you interact with our website:
Full name
Email address
Shipping and billing address
Phone number (if voluntarily submitted)
Payment information (processed via secure third-party gateways)
Technical information (IP address, browser type, cookies, analytics data)
Communication records (e.g., emails, support requests)
4. Why We Collect This Information
We collect personal data to:
Process orders and manage account access
Deliver products, updates, and tracking
Offer customer support and resolve issues
Meet legal and tax obligations
Improve website functionality and optimize user experience
Send promotional emails (only with your consent)
5. Consent
By using our website, placing an order, or subscribing to our updates, you consent to the collection and use of your personal data for the purposes described above. You may withdraw your consent at any time by contacting us directly (see Section 10).
6. How We Protect Your Information
We use reasonable and industry-standard security safeguards to protect your data, including:
SSL encryption on all transactions
Firewalled and access-controlled servers
Secure payment processors
Employee training on data handling
Limiting internal access to only necessary personnel
However, no system can guarantee 100% security. You use our services at your own risk.
7. Disclosure of Personal Information
We do not sell, rent, or trade your personal information. We may share it with third-party providers only when necessary to:
Process payments (e.g., Stripe, crypto platforms)
Fulfill shipping and delivery
Maintain and host our website
Provide analytics (Google Analytics, etc.)
All third parties are bound by confidentiality agreements or privacy obligations.
8. Retention of Information
We retain personal data for as long as needed to fulfill the purposes for which it was collected, including legal, tax, and business obligations. When data is no longer needed, we securely delete or anonymize it.
9. Cookies & Tracking Technologies
We use cookies and tracking tools (such as Google Analytics) to:
Track website performance
Understand customer preferences
Improve our marketing
You may disable cookies through your browser, but this may limit website functionality.
10. Your Privacy Rights
Depending on the state in which you reside, you may have the right to:
Access your personal information
Request corrections
Withdraw consent
File complaints about our handling of your data
To exercise these rights or for any privacy-related inquiries, email us at:
support@exolabz.co
We will respond within 30 days.
11. International Data Transfers
Some data may be processed outside the United States (e.g., by third-party payment gateways or hosting providers). We ensure these providers offer privacy safeguards equal to United States standards.
12. Anti-Spam & Marketing (CAN-SPAM Compliance)
We comply fully with the United States CAN-SPAM Act. Marketing emails are sent only with express consent. Every message contains a clear unsubscribe link, and you can opt out at any time.
13. Children’s Privacy
Our services are not intended for individuals under the age of 21. We do not knowingly collect data from minors.
14. Policy Changes
We may update this Privacy Policy as our practices evolve. The “Effective Date” will always reflect the latest version. Continued use of our services implies acceptance of any updated terms.
15. Questions or Concerns
If you have any questions, email us directly at:
support@exolabz.co
We’re here to help and will do our best to address your privacy concerns promptly.
16. State privacy rights
Several United States states give residents specific rights over their personal information. Where one of those laws applies to you — including the California Consumer Privacy Act as amended by the CPRA, the Utah Consumer Privacy Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the comparable statutes now in force in a growing number of other states — you may have the right to know what personal information we hold about you and how it is used, to obtain a copy of it, to correct it, to ask us to delete it, and to receive it in a portable, commonly used format.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. There is accordingly nothing to opt out of on that front, but you may still exercise every other right listed above.
We do not use your personal information to make any decision about you based solely on automated processing, and we do not engage in profiling that produces legal or similarly significant effects. If that changes, we will tell you before the decision is made and give you a way to object.
Exercising a privacy right will never lead to discriminatory treatment: your price, your shipping and the service you receive stay the same.
17. How to exercise a right, and who is accountable
ExoLabz has designated a person responsible for the protection of personal information, accountable for our compliance with this policy and with applicable privacy legislation. Requests for access, correction, deletion, withdrawal of consent or portability, and any privacy complaint, may be sent to support@exolabz.co marked for the attention of the Privacy Officer. We respond within forty-five (45) days, and will tell you if we need the extension that state law allows.
We will take reasonable steps to verify your identity before acting on a request, usually by matching the request to the email address and order details already on file. An authorised agent may submit a request on your behalf with written permission.
If you are not satisfied with our response, you may complain to your state Attorney General. California residents may also contact the California Privacy Protection Agency.
18. Security incidents and breach notification
We maintain a register of security incidents affecting personal information. Where an incident creates a risk of harm, we will notify you and the appropriate regulator within the period required by the applicable state breach notification statute, take reasonable measures to reduce the risk of harm, and take steps to prevent further incidents of the same kind.
19. Purchaser eligibility information
When you place an order we ask for your purchaser category (research institution, licensed researcher, university, or laboratory research and development). We collect this so that we can satisfy ourselves that supply is being made on a research basis, and we retain it with the order record as evidence of the basis on which supply was made. We may disclose it to a regulator or law enforcement agency where we are required by law to do so. It is not used for marketing.
20. How long we keep information
Order records, including the purchaser eligibility information described above, are retained for seven (7) years from the end of the calendar year in which the order was placed, in order to meet tax, accounting and regulatory record-keeping obligations. Marketing contact records are retained until you withdraw consent, and then for the period needed to evidence that withdrawal. Website analytics data is retained for the period configured in the analytics service. When information is no longer required for any of these purposes it is securely deleted or anonymised.
