Privacy policy

Who is responsible

Elute Research is responsible for the personal information described here. Questions and requests go to support@eluteresearch.com.

What we collect

We collect only what we need to run the store:

• Order details: name, email, phone (optional), shipping and billing address, items, lot numbers shipped, and payment status. Card data is handled by our payment processor [PROCESSOR NAME]; we do not store card numbers.
• Account details, if you create an account: email, name and a password hash.
• The age and research-use confirmation you give when entering the site: the text version you confirmed, the date and time, your IP address, your browser's user agent, and whether your browser sent a Global Privacy Control signal.
• Technical logs: IP address, user agent and request details, kept for security and to investigate errors.
• First-party analytics, described below.

Cookies

We use first-party cookies only. None is set for analytics before you confirm the entry statement, and none is renewed after that confirmation expires until you confirm it again.

If your browser sends a Global Privacy Control or Do Not Track signal, we set no visitor identifier (an existing one is removed), we set no referral cookie (an existing one is removed), and the campaign cookie lasts only until you close the browser.

• gate: records that you confirmed the entry statement (30 days).
• vid: a random visitor identifier for our own analytics (13 months).
• vsid: a random identifier for your visit; it ends 30 minutes after your last page view.
• attr: the campaign parameters of the link that brought you here, such as utm_source (30 days).
• rlink: if you arrived through a customer's or partner's referral link, which link it was (30 days); set only after you confirm the entry statement.
• sid: keeps you signed in, only if you sign in (up to 30 days).
• Cart cookie: remembers your cart.
• locale: remembers your English or Spanish language choice for one year.
• mc: your choice about marketing measurement tags, only if we ever offer them (13 months).

Analytics

We record a small set of events in our own database: pages viewed, lot pages viewed, QR code scans, certificates opened, lot lookups, searches on this site, items added to the cart, checkouts started, orders and purchases, sign-up and alert confirmations, problem reports, reorders, feedback answers, visits through a referral link, and which version of a page you saw when we compare two versions. Events carry the random visitor and session identifiers above, the campaign parameters of your visit, and product, lot or order identifiers. They never carry your email address, name, postal address or phone number: a search is kept shortened and left out when it looks like an email address or a phone number, a sign-up records only that it was confirmed, a problem report only its category, and a feedback answer only how many questions were answered. We do not share them with advertising platforms.

Referral links: if you order after arriving through a customer's or partner's referral link, we record that the order came through that link. To find someone referring themselves, we compare the order's email address, shipping address and visitor identifier with those of the link's owner, inside our own database. No reward is paid for a referral.

Third-party advertising or measurement tags are not used. If that changes, they will load only after you allow them, and a Global Privacy Control signal will be treated as a refusal.

Global Privacy Control

We honor the Global Privacy Control (GPC) signal as a request to opt out of the sale or sharing of personal information. We do not sell personal information. [COUNSEL: confirm state-law wording.]

Who we share information with

Service providers that run parts of the store for us, under contract: payment processing [PROCESSOR], shipping carriers and label services [CARRIERS], email delivery [EMAIL PROVIDER] and hosting [HOSTING PROVIDER]. We disclose information when the law requires it.

How long we keep it

[COUNSEL: retention periods.] Proposed: order and tax records for 7 years; entry confirmations for 3 years; analytics events for 25 months; technical logs for 90 days.

Your choices and rights

Depending on your state, you may have the right to access, correct or delete your personal information, and to opt out of certain processing. Email us to make a request; we will verify it before acting. [COUNSEL: state-specific rights and response times.]

Children

The store is for adults 21 and older. We do not knowingly collect information from anyone younger.

Changes

We will post any change to this policy on this page with a new version date.