Privacy Policy

1. Who We Are and What This Policy Covers

VantaBioChem LLC is the business responsible for the personal information described here. We operate the online store at vantabiochem.com from Utah.

Below is what we collect at vantabiochem.com, the reason for each item, the providers that receive it, how long it stays, and the rights you can exercise over it. The policy applies to the store and to the email we send about orders. It does not apply to any site we link to, or to a service you use directly under its own policy. What we collect is what a store needs to take and fill an order, and nothing beyond that.

The other documents this store publishes — the Terms of Sale & Service, the Research Use Only Covenant, the Shipping Policy, and the Returns & Refunds Policy — are separate and are linked from vantabiochem.com.

2. Information We Collect

You can order as a guest. An account is optional, and we never require one in order to buy, to make a privacy request, or to appeal a decision.

Order information. The name, email address, and delivery address you enter at checkout, the items and quantities ordered, the price and any discount applied, and anything you type into an order note. Source: you.
Account information, if you create an account. Your name, your email address, your password stored only as a bcrypt hash, and your order history. We never store a password in plain text and we cannot read yours. Source: you.
Consent record. At checkout you tick three separate confirmations: that you are at least 21, that the materials are for laboratory research use, and that you accept the terms. Each is recorded separately with the order, together with the time it was recorded and a SHA-256 hash of the exact text of each document linked to you at that moment. The server refuses an order unless all three are true. Source: you.
Payment information. No card processor is configured for this store. We never receive a card number, a bank login, or the credentials you use with the peer-to-peer payment services listed at checkout. You pay using peer-to-peer transfer services (as listed at checkout), and what you enter in one of those services goes to that service under its own policy. What we record is that an order is awaiting payment, that payment was later confirmed, and any reference you send us so we can match a payment to an order. Source: you and the payment service.
Shipping and delivery information. The delivery name and postal address, the weight and dimensions of the parcel, the label and tracking number bought through Shippo, and the carrier scan events that come back — the carrier's first physical scan and the delivery scan. Source: you, Shippo, and the carrier.
Messages. Your name, your email address, and whatever you write when you use the contact form or email us, plus our replies. Source: you.
Cart and session data. Cart contents, a session value, and a flag recording that you passed the age gate. These sit in your browser's local storage on your own device. Source: your device.
Server logs. Routine request records: IP address, date and time, the page or endpoint requested, the browser user-agent string, and error diagnostics. Source: generated automatically when your browser requests a page.
Marketing list membership. Your email address and the date you opted in, if you opted in. If you opt out, your address moves to a suppression list with the date of the opt-out.

What we do not collect. Government identifiers, biometric data, precise geolocation, financial account credentials, and health information. We do not buy, license, or scrape personal information, and we do not receive it from advertising networks or data brokers. Everything above comes from you, from your device, or from a provider acting on our instructions.

3. How We Use Your Information

Each category is used for the purposes listed against it and for nothing else.

Order information — to take the order, confirm it, fill it, produce a shipping label, contact you about that order, and handle a return or refund under the Returns & Refunds Policy.
Consent record — to enforce the check at checkout, and to show later what was confirmed, when, and against which version of which document.
Account information — to let you sign in, see your order history, and reset your password.
Email address — to send transactional email about an open order, to answer you, and to send marketing email only if you opted in.
Delivery address and parcel data — to buy a label, get a rate, and let the carrier deliver the parcel.
Messages — to answer you and to keep a record of what was asked and what we replied.
Cart and session data — to keep your cart between pages, keep you signed in during a visit, and remember that the age gate was answered.
Server logs — to keep the site running, diagnose errors, and detect abuse of the site.
Order and tax records — to meet tax, accounting, and recordkeeping obligations, and to defend a dispute or chargeback.

None of this is used for advertising, and no category is used for anything not named on the list above. The list is exhaustive rather than illustrative — if a use is not on it, we are not making it. Adopting a new purpose means updating this policy first, and asking for consent first wherever the law requires consent.

4. Third-Party Services

These are the providers that receive personal information from us, and what each one receives.

Resend — delivers our transactional email and, where you opted in, our marketing email. It receives your email address, your name where the message uses it, the content of the message, and delivery events such as bounces.
Shippo — returns live rates and issues the shipping label. It receives the delivery name, the delivery postal address, an email address for tracking notifications, and the weight and dimensions of the parcel. It returns rate, label, and tracking data to us. The carrier that moves the parcel also receives the name and address printed on the label. We ship within the United States, so a delivery address we hand over is an address in the United States.
the peer-to-peer payment services listed at checkout — you deal with the payment service directly. What you enter there is collected by that service under its own privacy policy, not by us. We receive confirmation that a payment was made and the reference that ties it to an order.
Hosting and infrastructure — the provider that serves vantabiochem.com and stores the store database holds the order and account records described above in the ordinary course of hosting them.
Professional advisers and legal process — we disclose personal information where a law, a subpoena, or valid legal process requires it, or where it is needed to establish or defend a legal claim. We tell you when we are permitted to.
A business transfer — if the business or its assets are transferred, order records transfer with them, and this policy continues to apply to information collected under it until it is replaced with notice to you.

We give personal information to no advertiser, ad network, data broker, social platform, or analytics network. Every provider named above is limited to the fields required to perform its function, acts on our instructions, and may not repurpose what it receives for itself.

5. Sale, Sharing, and Targeted Advertising

We do not sell personal information. Under the state privacy laws, a sale reaches a disclosure to a third party for monetary or other valuable consideration, and that is the meaning we are using — not a narrower one.

We do not share personal information. Share is California's term for disclosing it for cross-context behavioral advertising, and we do not do that either.

We do not process personal information for targeted advertising. We run no ad tags, build no audience segments, buy none, and disclose no order data for advertising or measurement.

This describes how the store is configured as of the date at the top of this policy. If it ever changes, we will update this policy, give the notice the applicable law requires, and provide a working opt-out before the change takes effect. In the meantime you still hold the opt-out right described in the section on Your Rights. Send the request and we will record and honor it, even though there is currently nothing for it to stop.

6. Sensitive Personal Information

State privacy laws define a separate category of sensitive personal information: government identifiers, financial account credentials, precise geolocation, biometric data, racial or ethnic origin, religious belief, union membership, sexual orientation, immigration status, health information, and the contents of communications where the business is not the intended recipient.

We do not collect any of it. We do not ask for it, we do not infer it, and we do not sell or share it. Because we do not process sensitive personal information, the opt-in consent that the Virginia-family statutes require before processing it does not arise here.

We do not collect health information, and we do not derive an inference about a person from what an order contains. Order contents are not used to build a profile, are not matched to any outside data set, and are not disclosed to anyone for retargeting or audience building.

Messages you send us are addressed to us, so they fall outside the sensitive category — we are the intended recipient. We still treat them as private and use them only to answer you.

The age confirmation captured at checkout records that you attested to a minimum age. It is not a date of birth, an identity document, or a health record.

7. Email Communications

Transactional email relates to an order you placed. It includes the order confirmation, notice that an order is awaiting payment, the shipped notice, the delivered notice, and our replies to you. The shipped notice sends on the carrier's first physical scan — not when a label is bought and not when a tracking number is saved. The delivered notice sends on the delivery scan. An order stays pending until payment is confirmed, and we may email you about a pending order during the 48-hour payment window described in the Terms of Sale & Service. Transactional email about an open order is not something you can opt out of while the order is open; it is how we tell you what is happening to it.

Marketing email, where we send it, goes only to addresses that opted in. It is never a condition of ordering.

Every marketing email identifies itself as an advertisement, uses accurate headers and a subject line that matches the content, and carries our postal address: Salt Lake City, Utah.
Every marketing email carries an unsubscribe link that works from a single page, with no account, no login, and no reason required. You can also reply to the message, or write to support@vantabiochem.com.
The unsubscribe mechanism keeps working for at least 30 days after the message was sent.
We act on an opt-out within 10 business days, and usually sooner.
We do not sell, rent, lease, or transfer an opted-out address to anyone, for any purpose, at any price.
Resend sends on our behalf. We remain responsible for what is sent on our behalf, and we authorize no one else to email you using an address you gave us.

An opted-out address goes onto a suppression list. That list exists so the opt-out keeps being honored; it is described in the section on Data Retention.

8. Data Retention

Each category has its own period or, where a fixed period would be a guess, a stated criterion. There is no single "as long as necessary" rule here.

Order records — seven (7) years from the order date, because tax, accounting, and dispute-defense obligations run on that kind of clock.
Consent record — kept with the order for the same seven (7) years, because it is the evidence of what was confirmed and against which document text.
Shipping, label, and tracking records — kept with the order record for the same seven (7) years, because a delivery dispute is an order dispute.
Account records — kept while the account exists. When you close it, or ask us to, the account record and the bcrypt password hash are deleted within the deadline in the section on Your Rights. Order records already created remain for the order-record period above.
Messages — kept while we are handling the request. A message about an order is then held with that order record for the order-record period. A message unrelated to an order is deleted once the request is closed and any follow-up period has passed.
Marketing list — your address stays on it until you unsubscribe or the address hard-bounces off it.
Suppression list — kept indefinitely. The only way to honor an opt-out permanently is to remember it. It holds the email address and the date of the opt-out, and nothing else, and it is never used to send you anything.
Server logs — kept only as long as they are useful for security monitoring, abuse detection, and debugging, then overwritten on a rolling basis. They are not used to build a profile of you.
Cart, session, and age-gate data — held in your browser on your own device until you or your browser clears site data. We do not retain a copy.

When a period ends, the record is deleted or de-identified. We do not keep something because it might be useful one day, and we do not extend a period without changing this policy first.

9. Cookies and Local Storage

The store's browser storage is functional. There are three things in it, and this is all of them.

Cart — the items you added, so the cart survives a page change.
Session — a value that keeps you signed in during a visit.
Age gate — a flag recording that the gate was answered, so it does not reappear on every page.

All three live in your browser's local storage, on your device. Clearing your browser's site data for vantabiochem.com clears all three: the cart empties, the session ends, and the age gate asks again.

What is not here: advertising cookies, tracking pixels, third-party ad tags, cross-site tracking, session recording, fingerprinting, and analytics that build a profile of a visitor. None of it is wired into this store. Server-side, we keep the routine logs described in the section on Information We Collect, on the terms described in the section on Data Retention.

Do Not Track. Some browsers send a Do Not Track signal. There is no common standard for what a site must do in response to one, and we do not treat it as a separate instruction — we do not track you across other sites or over time in any case, so there is nothing for it to switch off. We do act on Global Privacy Control, which is described in the section on State Privacy Rights.

10. Data Security

What we do:

Passwords are stored as bcrypt hashes. They are never stored in plain text and cannot be read back by us.
We never hold card numbers or bank credentials, because no card processor is configured for this store. The safest record is the one that does not exist.
Administrative access to orders, stock, and pricing is limited to the people who operate the store.
Each provider named in the section on Third-Party Services receives only the fields its function needs.
We collect the categories listed in this policy and no others, which keeps the amount of information at risk small.

No system is completely secure, and we make no promise that it is. We do not guarantee that transmission over the internet or storage on any system is proof against every attack, and you should treat any statement to the contrary — from anyone — as untrue.

If personal information is exposed in a way that triggers a breach-notification law, we will notify affected people and any regulator that law requires, without unreasonable delay, and tell you what was involved and what to do about it. Every state has such a law and none of them has a size threshold, so this applies to us regardless of how small the store is.

Two things you can do: use a password you do not use anywhere else, and tell us at support@vantabiochem.com if you think someone else has been in your account.

11. Age Restriction

Checkout requires you to confirm that you are at least 21. That confirmation is stored with the order as part of the consent record.

This is a self-attestation, not an identity check. We do not collect a government identity document, we do not run an age-verification service, and we do not ask for a date of birth.

The store is not directed to anyone under 21, is not marketed to minors, and we do not knowingly collect personal information from anyone under 21. We do not knowingly collect personal information from a child under 13 in any circumstance.

If you believe a minor has given us personal information, write to support@vantabiochem.com with enough detail to find the record. We will delete it, tell you what we deleted, and cancel any order attached to it.

12. Your Rights

We grant these rights to everyone who asks, wherever you live. We do not check whether a particular statute covers this store before honoring a request, and we will not argue a threshold at you.

Know and access — what we hold about you, where it came from, why we have it, and who received it.
Portability — a copy in a portable, machine-readable format.
Correction — fix information that is wrong.
Deletion — delete what we hold, subject to the records we are required to keep.
Opt out of sale, sharing, and targeted advertising — available to you even though, as described in the section on Sale, Sharing, and Targeted Advertising, none of those things happens here.
Opt out of profiling that produces legal or similarly significant effects. We do not profile anyone, so there is nothing running to opt out of.
Limit the use of sensitive personal information — we collect none, and the right stands anyway.
Non-discrimination — we will not deny you service, change your price, degrade what you receive, or treat you differently because you exercised a right.

How to make a request. Email support@vantabiochem.com, or write to VantaBioChem LLC at Salt Lake City, Utah. Say what you want and give us an email address or postal address to reply to. You do not need an account, and we will not ask you to create one, sign in, or use a portal in order to make or complete a request.

Verification. We may ask you to confirm information we already hold — the order number and the email address on the order, for example — so we do not hand your record to someone else. We will not demand a new identity document to verify a request.

Authorized agents. Someone may make a request for you. We may ask for written permission signed by you, and we may ask you to confirm the authorization directly.

Timing. We respond within 45 days of receiving a request. Where a request is complex, we may extend once by a further period of the same length, and we will tell you within the first period that we are doing so and why. An opt-out request is acted on within 15 business days. Requests are free; we may decline or charge for one that is manifestly unfounded or repetitive, and if we do, we will say so and explain why.

Where we cannot fully comply. Some records have to stay — a completed order record inside the period in the section on Data Retention, for example. When that happens we will tell you which category we kept, and why.

Appeals. If we refuse a request in whole or in part, we will tell you why in writing and tell you how to appeal. To appeal, write to support@vantabiochem.com with "Appeal" in the subject line, or post it to the address above marked for the attention of appeals. We will review the decision and reply in writing within 45 days, with our reasons. If we deny the appeal, that reply will include a method of contacting the Attorney General of your state so you can complain about the outcome. You may complain to your state Attorney General at any time, whether or not you appeal to us first — most publish a consumer complaint form on the official state website.

13. State Privacy Rights

Everything in the section on Your Rights is available to everyone, without a residency test. What follows is what specific state laws add.

California. The categories we collect, the sources they come from, the purposes we use them for, the categories of third parties that receive them, and the retention period for each are all set out above, and together they are our notice at collection. This policy is reachable from the pages where we collect information — checkout, account creation, and the contact form — as well as from every page of vantabiochem.com. We do not offer financial incentives in exchange for personal information. How we treat a Do Not Track signal is stated in the section on Cookies and Local Storage.

Global Privacy Control. We recognize the Global Privacy Control signal sent by a browser or a browser extension. Where the signal is present, we treat it as a valid opt-out of sale, sharing, and targeted advertising for that browser, with no further step required from you and no request for your identity. Because there are no sale, share, or advertising tags on this store, the signal changes nothing operationally — it is honored regardless. GPC is set per browser and per device. A signal you set in one browser does not carry to a different browser, a different device, or the same browser after you clear its site data.

Nevada. Nevada law requires a designated request address for opting out of the sale of covered information. Ours is support@vantabiochem.com, and it is monitored. We do not sell covered information as Nevada defines it. Send the request to that address anyway and we will record and confirm it.

Texas and Nebraska. Neither statute uses a consumer-count threshold, so we do not rely on being small. Texas requires a specific published notice from any business that sells sensitive personal data. We do not sell sensitive personal data — we do not collect it at all — so that notice does not appear here. If that ever changed, we would post the required notice in the same location and manner as this policy, and obtain consent, before any such sale.

Virginia, Colorado, Connecticut, and the states that followed them. The appeal process these laws require, including the route to your state Attorney General, is in the section on Your Rights.

14. Changes to This Policy

We can change this policy. When we do, the current version is posted at vantabiochem.com with a new date at the top, and we summarize what changed. Where a change is material and we hold your email address because of an order or an account, we will send notice to that address.

A change is not retroactive. It applies to information collected after the new date. Where a change would materially alter how we handle information we already hold, we will ask for your consent or give you a way to object before applying it to that information. Continuing to use the store is not, by itself, how we treat you as having agreed to a material change.

15. Contact

Privacy questions and rights requests — support@vantabiochem.com. This is also the designated request address named in the section on State Privacy Rights.
Appeals of a refused request — support@vantabiochem.com.
Orders, delivery, and account help — support@vantabiochem.com.
Anything else — support@vantabiochem.com.
Post — VantaBioChem LLC, Salt Lake City, Utah.

Write to us at the postal address if you would rather not email, and say how you want to be answered. We reply to privacy requests within the deadline in the section on Your Rights.