Privacy

Short version: we collect what an order needs, we keep the acknowledgement record because we are required to, we do not sell your details to anyone, and you can have your account deleted by asking.

What we collect

• Account details — name, email, phone, researcher type and optional organization, given at registration.
• The research-use acknowledgement — the fact and timestamp of your confirmation that you are 21+ and are buying for laboratory research. We are obliged to be able to evidence this and it is kept for as long as the account exists.
• Order details — what you bought, the lot numbers shipped, the delivery address and the order value.
• Marketing preferences — whether you opted in to email or SMS, held separately from the lot-notice list.
• Technical data — a session cookie so you stay signed in, and standard server logs including IP address, used to rate-limit sign-in attempts and investigate abuse.

We do not collect card numbers. Payment happens on a processor's own page and card data never reaches our servers.

Why we hold it

To fulfil orders and answer support; to reach every buyer of a lot if it is recalled; to meet our record keeping obligations around research-use acknowledgements; to prevent fraud and abuse; and — only where you opted in — to send you new certificates, restocks and pricing.

Cookies

We set one essential cookie, rn_session, an HttpOnly signed token that keeps you signed in for 30 days. Your cart and your research-use acknowledgement live in your own browser's local storage, not on our servers. We do not run advertising trackers or cross-site pixels on this site.

Who else sees it

Our hosting provider, our email provider (for transactional and, if you opted in, marketing mail), our payment processor (order reference and amount only), and carriers (name and delivery address). Each is contractually limited to processing on our instructions. We do not sell, rent or trade personal data, and we do not share it with data brokers.

How long we keep it

Account and order records are retained for seven years from the last order, which is the period our tax and product-liability obligations require. Marketing preferences are kept until you change them. Server logs are kept for 90 days. On deletion we remove your identity and preferences, keeping only the anonymised commercial record we are required to hold.

Your choices

• Unsubscribe from marketing in one click, in any marketing email.
• Lot notices are separate. Leaving the marketing list never removes you from recall notices, and vice versa — that separation is deliberate.
• Access, correction or deletion — email support@rensaresearch.com and we will act within 30 days.
• SMS — reply STOP to any message. Message and data rates may apply.

If you are a California resident, the CCPA rights to know, delete, correct and opt out of "sale" or "sharing" apply. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of — but the request route above is the same one.

Security

Passwords are stored as salted scrypt hashes and are never recoverable in plaintext, by us or by anyone. Sessions are signed tokens in HttpOnly cookies. Sign-in and registration are rate-limited per address and per account. If a breach ever affects your data we will tell you and the relevant authority within the statutory window.

Children

This site is not directed at anyone under 21 and we do not knowingly hold their data.

Draft for review. Confirm the retention periods against your actual accounting and liability obligations, and add your data-protection contact, before launch.