Privacy Policy

Who we are

This website is run by Kaelon Labs Ltd, registered in England, company number 17490750, registered office Suite 327 Balfour Business Centre 390 - 392 High Road Ilford IG1 1BF. We are the data controller for the personal data described here. We follow the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

What we collect and why

• Account details (name, email, password, your institution if you give it) — to create and run your researcher account.
• Order details (name, delivery address, email, phone, items, payment method and payment reference) — to take payment, pack and deliver your order, and keep accounting records.
• Messages you send us through the contact form or by email — to reply to you.
• Marketing choices (whether you agreed to emails, and when) — so we only email you if you agreed or, as a customer, haven’t opted out.
• Website usage — pages visited, where you came from and basic device type. Without your consent this is counted with a daily code made from your IP address and browser that changes every day and can’t be reversed; we never store your IP address. With consent we also keep a visitor id in your browser so we can see returning visits.
• Security records — sign-ins and admin actions, to keep accounts and the site safe.

Our lawful basis

• Contract — running your account and fulfilling your orders.
• Legal obligation — keeping order and accounting records for UK tax law.
• Consent — marketing emails (unless the customer rule below applies), optional analytics cookies, GA4 and Clarity. You can withdraw consent at any time.
• Legitimate interests — keeping the site secure, preventing fraud, counting visits without cookies, and emailing existing customers about similar products (you can opt out at any time with one click).

How long we keep it

• Orders and invoices: 6 years, as UK accounting rules require. After that, personal details on the order are removed.
• Raw website analytics events and daily visit codes: 13 months.
• Saved baskets from unfinished checkouts: 30 days after the basket was last updated.
• Spam messages: 30 days.
• Email logs and marketing send records: 2 years.
• Admin security audit log: 6 years.
• Your account: until you ask us to delete it. Orders are still kept for 6 years.

Who we share it with

We never sell your data. We share only what each service needs:

• Hosting and database — Lovable and Supabase, which run our website, accounts and database.
• Shipping — Shippo, and the carrier we use for your order (Royal Mail, Evri or DPD), receive your delivery name, address, email and phone number.
• Marketing email — Resend sends our marketing emails, so it receives your email address.
• Trustpilot — when your order ships, we share your name, email address and order number with Trustpilot so it can invite you to review our service. You can ignore the invitation or unsubscribe using the link in Trustpilot's email.
• Analytics — Google Analytics 4 and Microsoft Clarity, only if you accept analytics cookies.
• Authorities, if the law requires it.

Some of these providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum.

Cookies

Essential cookies and browser storage keep you signed in, hold your basket, run checkout, protect the site and remember your privacy choice. Optional analytics (our own visitor id, GA4 and Clarity) and partner referral tracking stay off until you accept them. You can reject them and still use the whole site. Change your choice any time with “Cookie preferences” in the footer. We don’t use advertising pixels.

Your rights

You can ask us to:

• give you a copy of your data;
• correct it;
• delete it (we must still keep orders for 6 years);
• restrict or object to how we use it, including stopping marketing at any time;
• send your data to you in a machine-readable file.

Email teamkaelonlabs@gmail.com. We reply within one month. Every marketing email also has a one-click unsubscribe link. If you’re unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.

Security

All traffic is encrypted. Staff access needs 2-step login and is limited to what each person needs. No method is completely secure, but we work to protect your data.

Changes

If we change this policy we’ll post the new version here with a new date.