Privacy Policy | Compound Lab

Short version: We collect only what we need to run the shop. We do not sell your data. You can request deletion at any time by emailing us.

1. Who We Are

Compound Lab operates the website at compound-lab.com. We are a research peptide supplier operating in Thailand and Australia. For data-related enquiries, contact us at: privacy@compound-lab.com

2. What Data We Collect

We collect the following categories of personal data:

Account data: Email address and password (hashed) when you create an account.
Order data: Name, shipping address, email address, and order contents when you place an order.
Payment data: We do not store payment card details. Payments are processed by third-party providers (Stripe / PayPal).
Usage data: Pages visited, browser type, IP address (anonymised after 24 hours) — collected via Google Analytics.
Cookie data: See our Cookie Policy for details.

3. Why We Collect It (Legal Basis)

Purpose	Data Used	Legal Basis
Processing and shipping your order	Name, address, email, order contents	Contract performance
Account management	Email, password	Contract performance
Customer support	Email, order history	Legitimate interest
Website analytics	Anonymised usage data	Consent (cookie banner)
Legal compliance	Order records	Legal obligation

4. Who We Share Data With

We share data only with service providers who need it to fulfil their function:

Supabase (database hosting) — order and account data
Stripe / PayPal (payment processing) — transaction data only
Shipping partners — name and delivery address
Google Analytics — anonymised usage statistics

We do not sell, rent or trade your personal data to any third party.

5. How Long We Keep Your Data

Order records: 7 years (legal and tax obligation)
Account data: Until you delete your account
Analytics data: 14 months (Google Analytics default), then automatically deleted
Support emails: 2 years after resolution

6. Your Rights

Depending on your jurisdiction (GDPR, Australian Privacy Act, PDPA Thailand), you may have the right to:

Access — request a copy of the personal data we hold about you
Correction — request inaccurate data be corrected
Deletion — request your data be erased (subject to legal retention obligations)
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interest
Withdraw consent — at any time for cookie-based analytics

To exercise any of these rights, email us at privacy@compound-lab.com. We will respond within 30 days.

7. Cookies

We use cookies for essential site functionality, your cart, login sessions, and (with consent) analytics. For a full breakdown, see our Cookie Policy. You can manage or withdraw cookie consent at any time via the cookie settings link in the footer.

8. Data Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, and role-based database access controls. No system is 100% secure — in the event of a data breach we will notify affected users within 72 hours.

9. Children

Our website is intended for adults aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has submitted data to us, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of the website after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests:

Email: privacy@compound-lab.com
Website: compound-lab.com