Privacy Policy

Information we collect

We collect information you provide (name, email, phone number, institution, and inquiry details), your marketing text-message preference if you sign in by phone, limited technical data (IP address and timestamps recorded for compliance attestations), and cart data stored locally in your browser.

The store requires an account. You can create one with your email address and a password (we email a link to confirm the address, and a link to reset a forgotten password), or by signing in with Google. Your password is stored only as a one-way hash. If you sign in with Google, we receive your name and email address from Google under your Google account settings; we do not receive your Google password. Your age and research-use attestation, with the time, IP address and browser it was recorded from, is kept with your account.

If you submit a damage or return claim, we also collect the photographs you upload and the description you write, together with the order number and the IP address the claim was sent from. Photographs of a parcel commonly show the shipping label, so they may contain your name and address; please redact anything you would rather not send. Claim photographs are stored privately, are accessible only to signed-in NytroGene staff reviewing the claim, and are deleted 90 days after upload. See the Refund & Return Policy for how claims are handled.

How we use it

Information is used to review and fulfill research-eligibility requests, communicate about orders, maintain compliance records, and operate the site. If you choose Accept in the cookie notice, it is also used to measure and improve our advertising, including showing our ads to people who have visited the site (see Analytics and Sharing). We do not sell your personal information for money.

Cookies

We use a minimal set of cookies required for the site to function, including a research-use acknowledgement cookie and, for administrators, a session cookie. At checkout, the secure card form provided by our payment platform, TagadaPay, and its card-security provider may use device and browser information to protect the payment and to complete card verification (3-D Secure) with your bank; it is not used for advertising or tracking.

Analytics

We collect first-party, pseudonymous usage analytics — pages and products viewed, time on page, cart activity, the steps of signing in and checking out (for example, that a sign-in was started or a payment did not go through, the sign-in method used, whether the account is new, and whether the visit is on a phone or a computer; never your password, your email address or payment details), and how the visit reached the site (the name of the referring website, or the campaign tags such as utm_source in the link you followed) — to understand and improve the site and our marketing. Events are keyed to a random session identifier stored in your browser; they are not linked to your IP address and are not shared with third-party advertising networks.

When you create an account or place an order, we also keep with it how you first found us and the latest link or website that brought you back — the same referring-site name, campaign tags and the first page you landed on, never the full web address or anything you typed — so we can see which marketing brings customers. If you decline analytics in the cookie notice, none of this is recorded.

Our site is hosted by Vercel, which also provides cookieless, aggregate page-view analytics. To serve the site and compute those aggregates, Vercel receives your IP address and browser information. If you decline analytics in the cookie notice, neither the first-party analytics nor the Vercel page-view script records your visit.

If you choose Accept in the cookie notice, we also use Google Analytics and Google Ads conversion measurement, provided by Google LLC, to measure how the site is used and whether our advertising leads to orders. These Google tags set cookies in your browser and receive your IP address, browser and device information, the pages you view (with sign-in links, order codes and any other query details removed from the address, except campaign tags such as utm_source or an ad-click identifier), the products you view and add to your cart, and, for a completed order, its order number, the products and their prices, and the order total. They do not receive your name, email address, phone number, shipping address or payment details. We have turned off Google signals, advertising personalization and remarketing for this data. None of these Google tags load unless you choose Accept.

If you choose Accept, we also use Google Tag Manager, operated by our advertising agency through a server provided by Stape at bhs.nytrogene.com, to send events from this site to Meta Platforms (Facebook and Instagram advertising). These tags set cookies and receive your IP address, browser and device information, the pages you view, the products you view, add to or remove from your cart, and your checkout steps. For a completed order they also receive the order number, the products and their prices, the order total and shipping, and your contact details: name, email address, phone number, city, state, ZIP code and country. They never receive your payment details. Our agency and Meta use this information to measure our advertising, to find people likely to be interested in our products, and to show our ads to people who have visited the site. None of these tags load unless you choose Accept, and you can change your choice at any time with “Cookie choices” at the bottom of every page.

Sharing

We share data with service providers necessary to operate — order fulfillment, email delivery, text-message delivery, file storage, website hosting and analytics, and payment processing — with the advertising partners described under Analytics, only if you choose Accept, and as required by law. We do not sell personal information for money. Under some state privacy laws, the information our advertising partners receive may count as “sharing” or a “sale” for advertising purposes; you can opt out at any time by choosing Decline under “Cookie choices” at the bottom of every page.

Checkout and payment: orders are placed on this site. Card payments are processed through our payment platform, TagadaPay, and our card processor, Kashu. When you pay, your card details are entered into a secure form and encrypted by TagadaPay's card-security provider before they leave your browser; NytroGene never receives or stores your full card number or security code. To authorise the payment and protect against fraud, TagadaPay and Kashu receive your name, email address, shipping address, the order amount, the IP address and browser your order was placed from, and the card details you enter; your card issuer may also receive information needed to verify the payment (3-D Secure). NytroGene keeps the payment reference, the order amount and the payment status. Your research-use attestation is recorded by NytroGene and is not shared with the payment providers.

Order fulfillment: to pick, pack, and ship your order, we share the minimum information needed to do so with our third-party fulfillment provider, Rapid Fulfillment: your name, shipping address (address lines, city, state, postal code, and country), the email address on your order, and your order's contents (product SKU, name, quantity, price) and order total. We do not share your phone number, date of birth, research-use attestation, consent records, account credentials, or payment details with Rapid Fulfillment.

SMS / text messaging

If you provide your mobile number, we may send text messages you have requested — one-time passcodes for signing in and verifying your identity, order and shipping updates, and, if you separately opt in, restock and new-batch alerts. Consent to receive marketing texts is not a condition of any purchase.

Message frequency varies based on your account activity and the alerts you request. Message and data rates may apply.

You can opt out of marketing texts at any time by replying STOP; reply HELP for help. Opting out of texts does not remove account-security messages required to use your account.

Mobile opt-in information and phone numbers collected for text messaging are shared only with our text-message delivery provider, solely to send the messages you request, and are never sold. They are not shared with third parties or affiliates for their marketing purposes. No mobile information is shared with third parties for their own marketing.

Retention

Order and compliance records (including attestation timestamps and IP) are retained as required for tax and regulatory purposes.

Categories of recipients (CCPA disclosure)

In the preceding 12 months, we disclosed the following categories of personal information to the following categories of service providers, solely for the purpose stated: identifiers (name, email, shipping address) and commercial information (order line items and order totals) to our order-fulfillment provider, Rapid Fulfillment, for the business purpose of picking, packing, and shipping orders; identifiers (name, email) and, for damage claims, the claim description and photographs, to our email-delivery provider for the business purpose of sending order and claim correspondence; identifiers (name, email) and claim details to our text-message provider for the business purpose of alerting our staff to a claim; and uploaded claim photographs to our file-storage provider for the business purpose of storing them for review; and internet activity information (IP address, browser information, pages viewed, referring page, and approximate location derived from IP address) to our hosting and analytics provider, Vercel, for the business purpose of serving the site and computing aggregate page-view statistics; internet activity information (IP address, browser and device information, pages viewed, ad-click identifiers, and approximate location derived from IP address) and commercial information (products viewed and added to cart, and the sign-in method used; for completed orders, the order number, products, prices and order total) to our analytics and advertising-measurement provider, Google (Google Analytics and Google Ads conversion measurement), only for visitors who accept analytics cookies, for the business purposes of measuring site usage and the effectiveness of our advertising; and identifiers (name, email, shipping address), commercial information (order amount), payment information (card details, encrypted before they reach us) and internet activity information (IP address and browser information) to our payment platform, TagadaPay, and our card processor, Kashu, for the business purpose of processing payment and preventing fraud; and, only for visitors who accept cookies, internet activity information (IP address, browser and device information, pages viewed, products viewed and added to or removed from the cart, and checkout steps), commercial information (for completed orders, the order number, products, prices, order total and shipping) and identifiers (name, email address, phone number, city, state, ZIP code and country, for completed orders) to our advertising agency, its server-side tagging provider Stape, and Meta Platforms, for the purposes of measuring and improving our advertising, including targeted advertising to people who have visited the site. We do not sell personal information for money. The disclosure to our advertising partners may be “sharing” for cross-context behavioral advertising under California law; it happens only after you choose Accept, and you can opt out at any time through “Cookie choices” at the bottom of every page.

Your rights (CCPA/GDPR)

You may request access to, export of, or deletion of your personal data, subject to records we are required to retain. To exercise these rights, or to opt out of any sale of personal information, contact NytroGene.