Privacy Policy

Who we are

This Privacy Policy describes how Origin Labs, operated by Origin Labs LLC (“Origin Labs,” “we,” “us”), handles personal information collected through www.origin-labs.org. For any privacy question or request, contact us at support@origin-labs.org.

Information we collect

Information you provide

• Account data — email address and password (passwords are handled by our authentication provider, Supabase Auth; we never see or store your plaintext password).
• Order data — your name, shipping address, order history, and the items you purchase.
• Payment references — because payment is made peer-to-peer (Venmo, Zelle, or Cash App) or on-chain (cryptocurrency such as Bitcoin, Ethereum, or USDC), we record only the payment reference you provide (such as a payment note, transaction ID, or blockchain transaction hash) and, for crypto, any sending wallet address you supply. We never see or store card numbers or bank credentials.
• Checkout acknowledgment records — the research-use acknowledgment text and version you accept at checkout, along with the IP address and browser user agent recorded at the time of acceptance. The IP address recorded with each order is also used for the security and abuse-prevention purposes described below.
• Marketing preferences — if you join our email list or opt in to marketing texts, we record your email address, the signup source, and your consent status, along with the IP address recorded at the moment of consent (a legal record of the opt-in). If you ask to be notified when an out-of-stock item returns, we record your email address and the item you asked about, solely to send that one notification (a restock request is not a newsletter signup).
• Affiliate payout details — if you participate in our affiliate program, the payout handles you save (such as a Venmo, Zelle, or Cash App handle) and your preferred payout method, used solely to pay your commissions.
• Support messages — the contents of emails or messages you send us.

Information collected automatically

We use cookies and server logs to operate the site, which may include your IP address, browser type, pages visited, and session identifiers that keep you signed in.

We also record, in a first-party cookie, how you first arrived at the site (the referring site, campaign tags in the link, and the first page you landed on). If you place an order, that arrival information is stored with the order so we can understand which channels our customers come from. It stays on our systems; the only arrival data ever shared outside them is the ad-click identifier described under Advertising measurement below, and only when you arrived through one of our ads.

Separately, if you arrive through one of our own campaign links (a store URL carrying a short referral code), we set a short-lived first-party cookie containing only that code and the time you arrived, so a purchase made within our attribution window can be credited to the campaign that brought you here. This cookie identifies the campaign link — not you — and contains no personal information. Your browser also stores a small marker recording that it has already opened that link before, so a repeat visit is not counted as a new visitor; the marker holds nothing but the link's code and is never sent anywhere beyond confirming whether the visit is a first one. Campaign visits are stored only as daily totals per link — a count of visits and a count of distinct browsers — never as records about a person, and we do not store your IP address, a device fingerprint, or any identifier alongside them. If you place an order, the crediting is stored with the order, and the cookie expires on its own. When the campaign link belongs to a paid ad, the additional measurement described under Advertising measurement below also applies.

Traffic arriving through our campaign links is screened for automated bots using network and browser signals (including the IP address and its network of origin). These checks run in the moment and store only daily pass/block counters per link — never a record about a person.

When analytics is enabled (see Cookies & analytics below), we additionally measure how the store is used in aggregate — including shopping interactions such as pages and products viewed, searches on the site, items added to the cart, checkout steps reached, and completed purchases — to understand and improve how the store works.

How we use your information

We use personal information to:

• Process orders — verify payment, fulfill purchases, create shipping labels, and provide tracking (performance of our contract with you).
• Communicate with you — send transactional emails such as account verification, password resets, and order or shipping updates, and respond to support inquiries (performance of our contract; our legitimate interest in customer service).
• Maintain security and prevent fraud — protect accounts, verify eligibility, keep acknowledgment records, review first-time orders before payment is collected, and use the IP address and email address associated with order attempts to rate-limit and block automated or abusive checkout activity (our legitimate interests and legal compliance).
• Improve our services — understand how the site is used, including aggregate shopping behavior such as product views, searches, cart activity, and purchases, so we can improve it (our legitimate interest).
• Send email you've asked for — newsletter and offer emails if you subscribed (consent, withdrawable anytime via the unsubscribe link), and one-time restock notifications for items you specifically asked us to watch.
• Comply with law — meet record-keeping, tax, and other legal obligations.

Service providers (subprocessors)

We do not sell personal information. We share it only with the service providers that run our business, each bound to process data on our behalf:

• Vercel — website hosting and delivery.
• Supabase — database and authentication (account credentials, orders, customer records).
• Resend — transactional email delivery (receives your email address and message content).
• EasyPost — shipping label creation (receives your name and shipping address).
• Google Analytics 4 — website analytics, if and when enabled (usage data only; see Cookies & analytics below).
• Cloudflare Turnstile — bot protection at checkout, if and when enabled (evaluates limited browser and network signals, including your IP address, to distinguish people from automated traffic; no advertising use).

Payments are made directly through Venmo, Zelle, or Cash App, or on-chain via cryptocurrency (Bitcoin, Ethereum, or USDC). Each of these is an independent service or network you use under its own terms and privacy policy; none of them is our processor and we receive only the payment reference (and, for crypto, the public transaction recorded on the blockchain). We may also disclose information when required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets.

Advertising measurement

When you reach the site by clicking one of our ads on a platform such as TikTok, Meta (Facebook/Instagram), or Google, that platform appends a click identifier to the link (for example ttclid, fbclid, or gclid). We store that identifier in a first-party cookie for up to 30 days. We also set a first-party cookie holding a randomly generated visitor identifier (a random string that contains no personal information and is not derived from you or your device) for up to 12 months, so that the measurement events described below can be recognized as coming from the same browser. We do not run any advertising platform's pixel, tag, or cookie on our site.

If you then browse or buy, we report a limited set of measurement events back to the one platform that showed you the ad, from our servers: the event type (such as product viewed, added to cart, checkout started, order placed, purchase, or refund), the order total and currency, the click identifier, the random visitor identifier in hashed (non-reversible) form, your email address in hashed (non-reversible) form — and, for some platforms, similarly hashed name and city/state/ZIP — plus the IP address and browser type recorded with the visit, and an anonymized product reference that does not identify any product. We never send product names, and we never send your raw email address or other readable contact details. The purpose is to measure whether our ads work and to help the platform show them more effectively.

This happens only when you arrive through an ad; visitors who find the store any other way are not reported to any advertising platform. Each ad platform processes the data it receives under its own privacy policy as an independent business.

Cookies & analytics

We use cookies and similar technologies to:

• Keep you signed in and remember your session and cart;
• Keep transactions and your account secure;
• Remember how you first found the site (referrer and campaign tags, first-party only) for our own sales reporting;
• Credit purchases to our own campaign links when you arrive through one (a short-lived first-party cookie holding only the link's referral code — no personal information), and remember that your browser has seen a given campaign link before so repeat visits are not double-counted (a first-party marker holding only that link's code, stored on your device);
• Hold the ad-click identifier for up to 30 days when you arrive through one of our ads (a first-party cookie used only for the advertising measurement described above);
• Hold a randomly generated visitor identifier for up to 12 months (a first-party cookie containing only a random string — no personal information — used, in hashed form, solely for the advertising measurement described above); and
• Measure site traffic and usage if analytics (Google Analytics 4) is enabled — including aggregate shopping interactions such as products viewed, on-site searches, items added to the cart, and purchases. IP addresses are anonymized in analytics, and this data is not used for third-party advertising.

You can manage or delete cookies through your browser settings; disabling cookies may prevent sign-in and checkout from working. We do not allow any third party to set cookies on our site, and the only cookie-derived data ever shared with a third party is the ad-click identifier and the hashed random visitor identifier used for the advertising measurement described above.

Data retention

We keep account data for as long as your account is active. Order records, payment references, and checkout acknowledgment records are retained for as long as needed for legal, accounting, and compliance purposes. Support messages are retained as long as reasonably needed to handle your inquiry and maintain service history. When data is no longer needed, we delete or de-identify it.

Data security

We protect personal information with industry-standard measures, including encryption in transit (TLS/SSL), hashed password storage via our authentication provider, role-based access controls that limit staff access to order data, and hosting on providers with established security programs. No method of transmission or storage is completely secure, but we work to protect your data at every step.

Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of marketing messages. To exercise any of these rights, email support@origin-labs.org from the address associated with your account. We will verify your request and respond within the time required by applicable law. Deletion is subject to records we must retain for legal and accounting purposes.

California privacy notice (CCPA/CPRA)

California residents have the right to:

• Know the categories of personal information we collect (identifiers, contact details, commercial/order information, and internet activity, as described above), the purposes of collection, and the categories of service providers we disclose it to;
• Access and correct the personal information we hold about you;
• Delete personal information, subject to legal retention exceptions; and
• Non-discrimination — we will not discriminate against you for exercising your rights.

Origin Labs does not sell personal information. If you arrive through one of our ads, we disclose the limited, largely hashed measurement data described under Advertising measurement to the platform that showed you the ad, which may be considered “sharing” under the CPRA. You can opt out of that sharing at any time by emailing support@origin-labs.org with the subject “Do Not Share” — we will exclude your information from advertising measurement going forward. No other personal information is sold or shared. To exercise any California right, email support@origin-labs.org; an authorized agent may submit a request on your behalf with proof of authorization.

Children's privacy

Our site and products are intended for qualified researchers who are at least 21 years old. The site is not directed to anyone under 21, and consistent with COPPA we do not knowingly collect personal information from children under 13. If you believe a minor has provided us with personal information, contact support@origin-labs.org and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version here with an updated “Last updated” date and, for significant changes, provide notice on the website or by email.

Contact

Privacy questions and requests: support@origin-labs.org, or write to Origin Labs LLC.