Privacy Policy

Advance Lab is committed to protecting your privacy. This policy explains how personal data is collected, processed, and protected.

1. Data Controller

Advance Lab
Email: advancelab@proton.me
Hosting: Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107, USA

2. What Is Collected and Why

When you place an order:

  • Name, email, and shipping address — PGP-encrypted in your browser before transmission. Your name and shipping address are never stored in plaintext. Your email is stored separately in plaintext to enable order confirmations, shipping notifications, and order tracking. Used only for transactional purposes.
  • Payment reference (transaction ID or PaymentIntent ID) — stored in plaintext for order matching and accounting.

When you contact us:

  • Name, email, and message — PGP-encrypted in your browser. Never stored in plaintext. Zeroed after 90 days.

Technical data:

  • IP address — temporarily processed by Cloudflare for rate limiting and security. Not stored or logged by Advance Lab.

3. Data Processors

  • Cloudflare — hosting (D1 database, R2 storage, Workers, CDN). DPA + SCC in place.
  • Stripe — card payments. PCI DSS Level 1. No personal data shared (amount + order reference only).
  • NOWPayments — Monero payments. No personal data shared.
  • Resend — transactional email delivery. PGP-encrypted blobs are not readable by Resend.

4. Data Retention

  • PGP-encrypted personal data (name, address): zeroed 5 years after fulfillment
  • Email address (plaintext, for notifications + tracking): zeroed 90 days after fulfillment
  • Order metadata (payment ID, items, amount): retained 10 years (French accounting law)
  • Rate limit and security logs: 7–365 days depending on type

5. Your Rights (GDPR)

You have the right to access, rectify, erase, and port your data. Because your name and shipping address are PGP-encrypted, they are decrypted offline upon your request. Your email is already stored in plaintext and can be provided directly. Use the contact form with your order number — response within one month.

To file a complaint: Commission Nationale de l'Informatique et des Libertés (CNIL)

6. Full Terms & Conditions

For complete terms of service, payment terms, and the full legal framework, see the Terms & Conditions.