Privacy Policy
This Privacy Policy explains what personal information Nexaris Research ("we", "us") collects on nexarisresearch.com (the "Site"), why, who else handles it, how long we keep it and what choices you have. It goes with our Terms of Service. We describe what the Site actually does; we do not sell your personal data.
For Research Purposes Only. Not For Human Consumption. Products offered on this website are intended solely for in vitro laboratory, scientific, and educational research purposes only. Nothing we collect or send is medical advice, and we do not ask for or keep health information.
1. What we collect
| Information | What it is and where it comes from |
|---|---|
| Account details | Your e-mail address and, if you give it, your name and a password (kept only as a hash by our sign-in service). Optional contact details you add in your account, such as a phone number or a messaging-app handle. Your account type (free account, member or staff), membership dates and rate, the date you confirmed you are at least 21 and accepted the Terms when you created the account, and the display setting (light or dark) you choose. |
| Delivery addresses | The name, street address, city, state, postal code and country you enter at checkout or save in your account. |
| Orders | What you order, quantities, prices, totals and shipping, any notes you add, the status history of each order, tracking numbers and photos of your items that our staff may upload, and any discount, membership or invitation code you use. |
| Saved carts | Carts you choose to save in your account: the name you give each one, the shipping option, and the products, sizes and quantities in it (no prices and no payment details). You can keep up to five per shipping option and delete them at any time. |
| Payment information | Which payment method you chose, the payment reference or transaction ID you submit, and any screenshot or receipt you upload as proof of payment. Payments are made through payment apps or cryptocurrency outside the Site. We do not take or store card numbers or bank logins. |
| Support messages | Messages you send through the support chat in your account, our replies, and the e-mails you send to our addresses. |
| Membership requests | Your membership request, the amount, payment method and reference you submit, and the invitation or code applied. |
| Invitations and unsubscribes | If we invite someone: the invited e-mail address, the name and note our staff add, whether the invitation was sent, claimed or has expired, and (when it is used) the account it was claimed by. If you unsubscribe, your e-mail address goes onto a suppression list so we do not invite you again. |
| Offers and news | Whether you chose to receive offers and news by e-mail (the box at sign-up or the switch on your Account page), when you last changed that choice, and a record of each promotional e-mail we sent you and whether it was sent. If you turn it off or unsubscribe, your e-mail address goes onto the same suppression list so we do not send you promotional e-mail again. |
| Device and log data | Technical data that arrives with every request, such as your IP address, browser and device type, pages requested and times. It is processed by our hosting, security and sign-in services and used for security, abuse prevention and fixing problems. We also keep our own visit log: for each page you open on the public pages of the Site we record your IP address, the approximate location worked out from it (the country and often the region and city), the page, the website that sent you (if any), any referral code in the link, and your browser and device type. We use the visit log to see where visitors come from and to spot fraud, abuse and automated traffic. Our database also records your IP address against a few sensitive requests (for example access and sign-up requests) to limit abuse. When you place an order we also record the IP address and country it came from, and keep them with the order record to help spot fraud. When you sign in we also record the IP address you sign in from, with the time and your browser type. Sign-in addresses are kept for as long as the account exists, to help spot fraud and accounts created to abuse the Site. If your browser reports a security-policy violation on a page, we log a short line with the page address. |
| Order alerts (only if you turn them on) | If you turn on order alerts, we store a push address and keys your browser gives us, the type of browser, and when we last used them, so we can send those alerts to that device. Alerts travel, encrypted, through your browser's own notification service. Turn alerts off in My Account to delete them. Alerts are for orders and your account only. |
| Notifications | The in-account alerts (the bell) about your orders and membership. |
We do not run advertising trackers, we do not record or replay your visit (no session-replay, heat-map or keystroke-capture tools), and we do not build advertising profiles. Apart from our own visit log described above, we use an analytics provider (section 3) to count visits and see which pages and buttons are used and which products are added to carts and ordered, so we can improve the Site and spot abuse. It works with anonymous visits only: it is not given your name, e-mail address, account or order details. None of this is shared with advertisers. The fonts you see are served from this Site, not from a third party.
2. Why we use it
- To run your account and sign you in, including sending you a sign-in link by e-mail.
- To take, review, quote, fulfil and deliver your orders: confirming stock with suppliers, working out shipping, sending you the quote and payment request, checking your payment, forwarding the order for fulfilment and showing you tracking.
- To handle membership and apply the right price, code or invitation offer.
- To answer you through support chat and e-mail.
- To send service e-mails about your orders, payments, membership and account, and to alert our staff to new orders, payments, messages and sign-ups.
- To keep the Site safe: preventing fraud, abuse and automated attacks, limiting how often a form can be used, protecting staff accounts with a second sign-in step, and using the visit log to see where visitors come from and to spot unusual traffic.
- To meet our legal, tax and accounting obligations and to establish, exercise or defend legal claims.
- To send invitations only to people we choose to invite, with an unsubscribe link in every one (see E-mail and unsubscribing).
- To send offers and news only to customers who chose to receive them, with an unsubscribe link in every message (see E-mail and unsubscribing).
3. Services that handle your data
We use these providers to run the Site. Each one handles data only to provide its service to us.
| Provider | What it does for us and what it sees |
|---|---|
| Database and sign-in provider | Our database, sign-in service and file storage (uploaded payment proofs and item photos), and the server functions that process orders and send e-mail. It holds essentially all the information in section 1. |
| Hosting provider | Hosts and serves the Site. It sees the requests to the Site, including IP address and browser details, in its server logs. |
| Network security and delivery provider | Sits in front of the Site. It provides our domain name service, a security filter that blocks attacks and abusive automated traffic, and content delivery. Requests to the Site pass through this provider, which sees your IP address, browser details and the pages you request, and tells us your approximate location. (Its bot check on the sign-in forms is listed separately below.) |
| Email delivery provider | Delivers the e-mail we send: sign-in links, order and payment e-mails, staff alerts, invitations and, for customers who chose them, offers and news. It handles the recipient address and the message content. (We can switch e-mail delivery provider; the description above applies to whichever one we use.) |
| Bot-check provider | A bot check on the sign-in and sign-up forms. The provider receives technical information from your browser (such as IP address and browser data) to tell people from bots. |
| Social sign-in provider (sign-in only) | If you choose the social sign-in button on the sign-in form, that provider signs you in and tells us your e-mail address and name. It sees that you are signing in to the Site under its own privacy policy. Nothing is sent to it unless you press that button. |
| QR-code image service | Draws the QR codes you can scan to pay. To make a code, your browser sends the payment address or payment link for your order to this service, which sees that address and your IP address. |
| Analytics provider | Counts visits and shows us which pages and buttons are used and which products are added to carts and ordered, to improve the Site and to spot abuse. Your browser sends it the page address (without any query string or #fragment), the page title, the site you came from, your browser type and screen size, and a random identifier kept in your browser. For cart and order events it sends the product, pack size and quantity, never prices. Every request also carries your IP address, which the provider keeps with the events and uses to work out an approximate country and city; we use it to spot abuse and fraud. It is not given your name, e-mail address, account or order details, and it does not record sessions. Its requests go through this Site's own address. If your browser sends a Global Privacy Control or Do Not Track signal, it is not loaded at all. |
| Payment services (payment apps, cryptocurrency networks) | You pay through these yourself, outside the Site, under their own terms and privacy policies. We receive only the reference or proof you give us. Cryptocurrency transactions are public on the network. |
4. Who we share it with
- Suppliers and fulfilment partners, only as needed to fill your order. Our staff pass on what is needed for the order, such as the items and quantities and the delivery name and address. Suppliers do not get your account, payment or membership details. Supplier identities are kept confidential.
- The service providers in section 3, under their own terms and only to provide their service.
- Carriers and customs authorities, as part of delivering a parcel.
- Professional advisers, and authorities where the law requires or to protect our rights, for example in response to a lawful request, or to investigate fraud or abuse.
- A buyer or successor if our business is sold or reorganised, who would be bound to treat your information in line with this policy.
We do not sell your personal data, and we do not share it with anyone for their own advertising.
5. Cookies and local storage
The Site uses a small number of cookies and browser storage items. They are needed for the Site to work, except the analytics identifier below, which only counts visits; none is used for advertising. You can clear them in your browser settings, but you may then have to sign in or accept the disclaimer again.
| Name | Type | Purpose and lifetime |
|---|---|---|
| sb_access_token | Cookie | Your sign-in session, so the pages that need an account (shop, account, orders) know who you are. Expires after one hour and is removed when you sign out. |
| graypeppers_compliance_accepted | Cookie | Records that you have accepted the Research Use & Compliance Disclaimer. One year. |
| gp_invite_token | Cookie | Holds the token of an invitation link you opened, so the invitation can be applied when you sign up. Seven days, removed once the invitation is claimed. |
| Sign-in session (sign-in provider) | Local storage | Keeps you signed in on this browser until you sign out. |
| graypeppers_compliance_accepted_v1 | Local storage | The same disclaimer acceptance, remembered in this browser. |
| ph_ followed by an identifier (analytics) | Local storage | A random identifier and a few counters, so the analytics provider can tell that several page views come from the same browser. It holds no name or e-mail address. It is not set if your browser sends a Global Privacy Control or Do Not Track signal. |
| graypeppers_theme | Local storage | Your light or dark display choice. |
| gp_single_brand_cart and gp_single_brand_cart_owner | Local storage | Your shopping cart and which account it belongs to, so it survives a page reload. |
| gp_deal_cart_ followed by a deal number | Local storage | The cart for one promotion or group buy (each deal has its own cart), so it survives a page reload. It is emptied when you place that order. |
| graypeppers_warehouse and graypeppers_category_sorts | Local storage | Which shipping origin you last viewed and how you sorted the product lists. |
| gp_referral_code and gp_invite_msg | Local storage | A referral code or invitation message carried by a link you opened, until you sign up or sign in. |
| gp_restore_saved_cart | Session storage | Passes the saved cart you chose to restore from your account page to the shop; removed as soon as the shop has read it. |
| gp_add_on_to | Session storage | Passes the order you chose to add items to from your orders page to the shop, so the extra items are placed as a linked order; removed when that order is placed or cancelled, or the tab is closed. |
| gp_single_brand_pending_order and gp_pending_order | Session storage | Hands your cart to the checkout review page; cleared when the order is placed or the tab is closed. |
6. How long we keep it
- Order, payment, shipping and membership records (including payment proofs and the support messages tied to them) are kept for as long as we need them for accounting, tax, fraud-prevention and legal purposes, which is typically several years after the order. We cannot delete an account that has orders, support messages or membership requests attached without losing records we must keep; those accounts are closed (suspended) instead and the records kept.
- Saved carts are kept until you delete them or your account is deleted.
- Accounts with no orders can be deleted when you ask.
- Invitations expire after the date shown on them; the record of an invitation and of an unsubscribe is kept so that we do not invite you again.
- Offers and news: your choice and the record of the promotional e-mails we sent you are kept while you have an account; if you unsubscribe, the record of that is kept so that we do not e-mail you again.
- The visit log (IP address, approximate location, page, referrer and browser type of each page view) is deleted automatically after 90 days.
- The IP address and country recorded with an order are kept for as long as the order record itself.
- Sign-in addresses (the IP address, time and browser of each sign-in) are kept for as long as the account exists.
- Technical rate-limit records are used only to enforce limits on forms and checkout; server and security logs are kept by our providers for the period they set.
- When we no longer need information we delete it or remove what identifies you.
7. Security
We protect your information with measures that include encrypted connections (HTTPS) to the Site and to our database; access rules in the database so that signed-in customers can only read their own orders, addresses and messages; passwords stored only as hashes; private storage for payment proofs and item photos, opened only through short-lived links; cost, supplier and routing information kept out of customer pages; rate limits on sign-in and checkout, and a bot check on the sign-in and sign-up forms; and a second sign-in step (an authenticator-app code) for every staff account. No system is perfectly secure, so please use a strong, unique password, or the sign-in link, and keep your e-mail account secure. If we learn of a breach affecting your information we will tell you as the law requires.
8. Your choices and rights
You can see most of your information yourself in your account (profile and contact details, delivery addresses, your orders, your saved carts and your support messages), and change your profile, contact details and delivery addresses there. You can also rename and delete your saved carts. For anything else, e-mail support@nexarisresearch.com. You can ask us to:
- give you a copy of the personal information we hold about you;
- correct information that is wrong or incomplete;
- delete your information and close your account, subject to the records we must keep (see section 6);
- stop marketing e-mail to you (see section 9); and
- restrict or object to a use of your information, where the law gives you that right.
Depending on where you live (for example California and some other US states, the UK or the EEA) you may have further rights, such as to know the categories of data we hold, to port it, or to complain to your data protection authority. We will answer a request within the time the law requires, and may need to confirm that it is really you first. We do not discriminate against anyone for exercising these rights. We do not sell or "share" personal data for advertising.
9. E-mail and unsubscribing
We send service e-mails about your account, orders, payments and membership; you cannot opt out of those while you have an account or an open order. We send invitations only to people we have chosen to invite. We send offers and news (promotional e-mail) only to customers who chose to receive them, by ticking the box when they created their account or by switching on “E-mail me offers and news” on their Account page. It is off unless you turn it on, and you can turn it off at any time in the same place. Every invitation and every offer carries our mailing address and a one-click unsubscribe link that leads to our unsubscribe page; the link stops both promotional e-mail and invitations to that address, and an invitation stops working. You can also reply to the e-mail or write to support@nexarisresearch.com and ask us to stop.
10. Children
The Site is for adults of at least 21 years of age and is not directed to children. We do not knowingly collect personal information from anyone under 21. If you think a child has given us information, write to us and we will delete it.
11. International transfers
We run the Site from the United States and our providers may process data in the United States and other countries where they or their sub-processors operate. If you use the Site from outside the United States, your information will be transferred to, stored and processed in those places, where data protection laws can differ from those where you live. By using the Site you understand this transfer. Where the law requires safeguards for such a transfer, we rely on those our providers put in place, such as standard contractual clauses.
12. Links to other sites
The Site links to outside pages, for example third-party research information pages, web searches and a third-party parcel tracking page. Those sites have their own privacy practices; when you follow a link, your browser contacts them directly and we do not control what they collect. If you decline the disclaimer on the home page, you are sent to a search engine.
13. Changes
We may update this policy as the Site or the law changes. The date at the top shows the latest version. If a change is significant we will tell you on the Site or by e-mail.
14. Contact us
- Privacy questions and requests: support@nexarisresearch.com
- Anything about an order: orders@nexarisresearch.com
- Mail: Nexaris Research, 1900 W. Carla Vista Drive, Chandler, AZ 85246