The legal entity acting as controller, its address, and a contact route for privacy questions.
Whether a data protection officer or representative is appointed.
02
2. What is collected
What this section must establish
Each category of personal data, why it is held, and whether providing it is required to order.
That payment card details are handled by the payment processor and are not received or stored by Cryo Labs.
How the system behaves today
Account: email address, full name, optional company name, optional phone number, and account type.
Addresses: shipping and billing addresses, retained on the account and frozen onto each order.
Orders: line items, amounts, status timestamps, carrier and tracking number.
Attestations: the accepted text, timestamp, IP address, and user agent — collected because the record must be evidentially useful.
Support and contact messages: message content, and for contact form submissions the IP address and user agent.
Live chat: the message content, an optional display name if one is offered, and the page the conversation was opened on. Answered by a person; there is no automated responder.
Site presence: while a page is open, the browser reports which page it is on so the shop can see that someone is browsing and can answer a chat. What is stored is the page address collapsed to its route shape, the referring site’s host name only, a two-letter country and, where the hosting provider’s network header supplies one, a state or province code, a page count, and timestamps. When the visitor is signed in, the presence record is linked to their account so staff can see which customer is browsing and greet them by name; anonymous visitors stay anonymous. No IP address, no user agent, and no advertising or cross-site identifier is stored against it.
Authentication: session cookies, and rate limit counters keyed by an irreversible hash rather than the address itself.
03
3. Why it is used
What this section must establish
The purpose for each category, and the legal basis where the governing regime requires one.
That the attestation record is retained for regulatory and compliance recordkeeping, and why that is a distinct purpose from fulfilling the order.
Whether customer data is sold, and the position on sharing for cross-context behavioural advertising — the advertising pixels described under Sharing are that kind of sharing under several United States state laws, and the policy must say so plainly rather than claim data is never used for advertising.
04
4. Who it is shared with
What this section must establish
Each processor, the category of data it receives, and where it operates.
Disclosure to authorities, and the standard applied before disclosing.
Treatment of data in a merger or acquisition.
How the system behaves today
Hosting and database: Supabase (Postgres, authentication, and document storage) and Vercel (application hosting).
Analytics: Vercel (Web Analytics, cookieless) and Google LLC (Google Analytics 4, when configured), each receiving page views for the public storefront with the address rewritten as described under Cookies. Both are United States processors.
Advertising: Meta Platforms, Inc. and TikTok (ByteDance), when configured. Each receives page views and shopping-step events (product page viewed, item added to cart, account registered) for public storefront pages, and on a completed order the amount paid and the currency. Neither is sent an order number, an email address, a name, or the names of the products ordered. Both are used to measure and target advertising, which is a purpose distinct from analytics and is disclosed as such here.
When a payment is confirmed, the shop’s own server also reports the purchase to Meta once, so that orders paid after leaving the site are counted. That report carries the amount and currency, an internal order identifier used only to prevent double counting, and — where the browser held them — the identifiers Meta itself set (_fbp and _fbc cookie values) with the IP address and browser user agent recorded at checkout. Those values are stored only until the report is sent and are then deleted. No email address, phone number, name, or product name is ever included.
The same confirmation also reports the purchase once to Google Analytics, so that a sale can be counted against the visit that produced it — without this the shop can see how many people arrive but not which arrivals lead to an order. That report carries the amount and currency, an internal order identifier used only to prevent double counting, and the identifier Google Analytics itself set in the browser (the _ga cookie value) recorded at checkout. It carries no item list, so the names of the products ordered are never included, and no email address, phone number or name. The stored identifier is deleted once the report is sent. The report is marked as not for advertising personalisation.
Email: Resend, for transactional and service messages such as order confirmations, sign-in links and replies to your enquiries. Omnisend, for marketing email to people who have opted in, which receives the email address, the name given, and whether the address is subscribed; every marketing message carries an unsubscribe link, and an unsubscribe made in either place is applied in both.
Live chat alerts: Telegram Messenger Inc. receives a notification containing the chat message, the page it was sent from, and any display name offered, so that shop staff can answer from their phone. Presence and chat records themselves are held in the shop’s own database, not by Telegram.
Payments: a third-party payment processor, which receives the amount and the buyer’s billing details directly.
Carriers: the shipping address and contact details, for delivery.
05
5. How long it is kept
What this section must establish
A retention period for each category, and the trigger that starts the clock.
The retention period required for attestation and order records, and the regulatory basis for it.
What happens to personal data when an account is closed, and what must survive closure.
How the system behaves today
Attestations and order line items are append-only: the database refuses updates and deletions on them, including from application code.
Addresses are archived rather than deleted, so historical orders remain resolvable.
Rate limit counters are pruned automatically and hold no directly identifying data.
Presence records are deleted seven days after the browser was last seen. A session that opened a live chat is kept, with its conversation, for ninety days and then deleted. Both windows are enforced by a scheduled database routine rather than by a manual clean-up.
This means a deletion request cannot be satisfied by erasing order and attestation history; the policy must state what is done instead.
06
6. Your rights
What this section must establish
The rights available under each applicable regime, and how to exercise them.
Identity verification before acting on a request, and the response deadline.
How a conflict between a deletion request and a mandatory retention obligation is resolved.
How to complain to a supervisory authority.
How the system behaves today
Signed-in customers can view their own orders, addresses, support history, and accepted attestations directly in the account area.
07
7. Cookies and session storage
What this section must establish
Each cookie set, its purpose, and its lifetime.
Whether any non-essential cookies are used, and the consent mechanism if so.
How the system behaves today
Session cookies are set by Supabase authentication and are strictly necessary to keep a buyer signed in.
A cryo-visitor cookie is set on the public storefront. It holds a random value with no meaning outside the shop’s own records, is HTTP-only so page scripts cannot read it, lasts thirty days, and exists so a live chat can be reconnected to the conversation it belongs to. It is not shared with anyone and is not used for advertising.
Vercel Web Analytics runs site-wide. It is cookieless and sets no identifier; it records the route visited, not the query string.
Google Analytics 4 runs on the public storefront only, when configured. It sets first-party _ga and _ga_<property> cookies, non-essential, with a two-year default lifetime.
Google Analytics is not loaded at all on the account area, checkout, cart, the sign-in and password flows, the unsubscribe link, or the admin area — no tag is rendered on those paths, so no page view is recorded for them.
The page address sent to Google Analytics is rewritten before it is sent: identifiers in the path are replaced with the route shape, the URL fragment is removed, and query parameters are dropped except an allowlist of catalogue filters. Free-text search terms are not sent.
Google Signals and advertising personalisation are disabled, and no Google Ads account is linked, so analytics data is not used to build advertising audiences.
Meta and TikTok advertising pixels run on the public storefront when configured, and set their own first-party cookies (_fbp for Meta, _ttp for TikTok) plus identifiers these networks hold. These are advertising cookies, not analytics.
The advertising pixels are not loaded on the account area, checkout, the cart, the sign-in and password flows, the unsubscribe link, or the admin area, and are not loaded on any page carrying a search term. Unlike Google Analytics they read the page address themselves and cannot be given a rewritten one, so the protection applied to them is that they are not loaded at all on those pages rather than that the address is edited.
The order confirmation page is the one exception. There, the order number is removed from the address before either pixel loads, and what is sent is the amount paid and the currency — no order number, no email address, and no product names.
Meta advanced matching and automatic event collection are switched off, so no hashed email address or phone number is sent from any form on this site, and no button or form interaction is reported.
Browser localStorage and sessionStorage are not used; a lint rule blocks their introduction.
The policy must state the consent posture actually operated: these analytics and advertising cookies are currently set without a prior consent prompt. That position was adopted when the storefront shipped within the United States only; the store now also serves a short list of international destinations including the United Kingdom and EU member states, where the ePrivacy rules and UK PECR require prior consent for non-essential cookies — so a consent prompt for visitors from those jurisdictions is an open obligation, and until one ships the policy must disclose the gap rather than imply compliance. Because the advertising pixels are sharing for cross-context behavioural advertising, the opt-out route required by United States state law must be a real one and must be named here.
08
8. Security
What this section must establish
The technical and organisational measures relied on, described accurately and without overstatement.
The breach notification process and timeline.
How the system behaves today
Row level security is enforced in the database, so a customer session can only read that customer’s own rows.
Administrative access is gated by role in both the database policies and the application middleware.
Certificates of analysis are held in a private bucket and served through short-lived signed links.
Authentication endpoints are rate limited per address and per account.
09
9. International transfers
What this section must establish
Where data is stored and processed, and the transfer mechanism where it leaves its origin jurisdiction.
The sub-processor list and how changes to it are notified.
10
10. Children
What this section must establish
That the service is not directed to children and accounts require an adult buyer.
What is done if data from a minor is discovered.
11
11. Changes to this policy
What this section must establish
How changes are notified and when they take effect.