Privacy Policy

1. Data Controller

Advance Lab
Email: advancelab@proton.me
Hosting: Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107, USA

2. What We Collect and Why

When you place an order:

• Name, email, and shipping address — PGP-encrypted in your browser before transmission. Never stored in plaintext. Used only for order fulfillment and one-time confirmation email if you opt in.
• Payment reference (transaction ID or PaymentIntent ID) — stored in plaintext for order matching and accounting.

When you contact us:

• Name, email, and message — PGP-encrypted in your browser. Never stored in plaintext. Zeroed after 90 days.

Technical data:

• IP address — temporarily processed by Cloudflare for rate limiting and security. Not stored or logged by Advance Lab.

3. Data Processors

• Cloudflare — hosting (D1 database, R2 storage, Workers, CDN). DPA + SCC in place.
• Stripe — card payments. PCI DSS Level 1. No personal data shared (amount + order reference only).
• NOWPayments — Monero payments. No personal data shared.
• Resend — transactional email delivery. PGP-encrypted blobs are not readable by Resend.

4. Data Retention

• PGP-encrypted personal data (name, email, address): zeroed 5 years after fulfillment
• Order metadata (payment ID, items, amount): retained 10 years (French accounting law)
• Rate limit and security logs: 7–365 days depending on type

5. Your Rights (GDPR)

You have the right to access, rectify, erase, and port your data. Because most personal data is PGP-encrypted, we decrypt it offline upon your request. Contact us at advancelab@proton.me with your order number — we will respond within one month.

To file a complaint: Commission Nationale de l'Informatique et des Libertés (CNIL)

6. Full Terms & Conditions

For complete terms of service, payment terms, and the full legal framework, see our Terms & Conditions.