Last updated: June 19, 2026 — Version 2.1 · Effective: June 19, 2026
This Privacy Policy describes how PGB Sciences, LLC (“PGB,” “we,” “us,” “our”) collects, uses, shares, and protects your personal information when you use our website or purchase our products. It also describes the privacy rights available to you under U.S. federal and state laws and how to exercise them.
By using our website or creating a PGB account, you agree to the practices described herein. If you do not agree, do not use our website. Our website and products are intended only for eligible adult customers acting for lawful laboratory research purposes, not for human or animal consumption or other prohibited uses described in our Terms.
1. Information we collect
We collect the following categories of personal information. These categories are the ones defined under California Civil Code §1798.140 and are used as the common framework for the multi-state rights described below.
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, email address, account username, IP address, login credentials, and age or eligibility attestations | You; site visit |
| Customer records | Shipping and billing address, phone number (optional), order contact details, and delivery instructions or carrier/tracking information | You at checkout |
| Commercial information | Order history, products purchased, store-credit balance | Your purchases |
| Internet or network activity | Pages viewed, referrer, browser/device type, session/cart cookies, bot-detection signals, device identifiers, and security logs | Site visit |
| Geolocation (approximate) | City/region inferred from IP and shipping address | Site visit; checkout |
| Financial information (limited) | Cryptocurrency transaction hashes, source/destination wallet addresses, payment amounts, selected digital asset, exchange-rate information shown at checkout, and public blockchain confirmation data | Payment networks |
| Inferences | Account-status flags (e.g., good standing, verification state), fraud-risk indicators, research-use eligibility status, and testing-program participation preferences | Internal |
We do not knowingly collect Social Security numbers, driver’s license or government-ID numbers, financial-account credentials, biometric information, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, health or genetic information, sexual orientation, or immigration status. Please do not send us medical records, prescriptions, dosing requests, treatment information, patient data, or other health information; PGB products are sold for laboratory research use only.
To the extent any information we collect qualifies as “sensitive personal information” under California Civil Code §1798.140, we use it only for purposes permitted by §1798.121(d) — namely, to provide the goods and services you request, to prevent fraud, and to ensure the security of our systems. We therefore do not offer a “Limit Use of Sensitive Personal Information” link.
2. How we use your information
We use the information we collect for the following business purposes:
- To process and fulfill orders, including confirming age and research-use eligibility, verifying cryptocurrency payments on-chain, screening for state or shipping restrictions, and arranging shipment with our fulfillment partner.
- To create, verify, and maintain your account, including authentication, password reset, eligibility attestations, account reviews, and account-security communications.
- To communicate with you about your account, orders, returns, refunds, and customer-support requests.
- To send transactional emails and, if you provide a mobile number or opt in where required, transactional text messages (order confirmations, shipping notifications, testing-result notifications, account notices, and security alerts).
- To prevent, detect, investigate, and address fraud, chargeback or refund abuse, cryptocurrency-payment abuse, bot activity, security incidents, and violations of our Terms, Acceptable Use Policy, research-use restrictions, or shipping restrictions.
- To comply with our legal, tax, and accounting obligations.
- To improve site reliability, performance, and the customer experience.
- To invite verified-purchase members to participate in our independent testing program. Participation is voluntary and requires affirmative opt-in. You can decline or withdraw at any time. The testing laboratory does not receive donor identity from PGB, and we use testing-program information only to administer the program, communicate results or logistics, verify eligibility, and maintain program integrity.
We do not use your personal information for behavioral advertising, profiling for automated decision-making that produces legal or similarly significant effects, or any purpose materially different from those listed above.
3. How we share your information
We do not sell or “share” (as defined under CCPA/CPRA, including for cross-context behavioral advertising) your personal information. We have not sold or shared personal information in the 12 months preceding the effective date of this policy and do not intend to.
We disclose limited personal information to the following categories of service providers, only as necessary for them to perform services for us:
| Category | Purpose | Data shared |
|---|---|---|
| Web hosting + database | Operate the site | All site-collected data |
| Email-delivery provider | Send transactional email and related account/order notices | Email, name, order summary, account status, and notification metadata |
| Anti-spam + bot-detection (hCaptcha) | Verify registrations, logins, checkout activity, and forms are human; detect abuse and automated access | IP address, browser and device data, interaction signals, and other hCaptcha or bot-detection data |
| Fulfillment partner (ShipSync) | Pack and ship orders; handle order support; help apply shipping restrictions and address validation | Name, shipping address, order contents, phone (if provided), delivery instructions, tracking information, and restriction-related order status |
| Shipping carriers (UPS, USPS, FedEx) | Deliver packages | Name, shipping address, phone (if provided), delivery instructions, and tracking number |
| Independent testing laboratory | Test product purity and identity and administer voluntary testing-program logistics | Shipment tracking number, vial photos, sample or batch identifiers, and logistics information only; no donor identity from PGB |
| Tax / accounting professionals | Tax filings and audit | Aggregate transaction records as required by law |
Each service provider is contractually limited to using your information only for the purpose we direct and must apply reasonable security safeguards. We may disclose personal information when required by law, valid legal process, tax or accounting obligations, payment-network or blockchain investigations, or to protect our rights, enforce our Terms and policies, prevent prohibited product use or diversion, or protect your safety or the safety of others. Cryptocurrency payment details may also be visible on public blockchains outside PGB’s control, including transaction hashes, wallet addresses, timestamps, amounts, and network confirmations.
4. Cookies and tracking technologies
We use a small number of first-party cookies, local/session storage, and similar technologies for site operation, security, fraud prevention, checkout, account login, age-gate/eligibility confirmation, and internal referrer attribution. We do not use third-party advertising cookies, cross-site trackers, Google Analytics, Meta Pixel, or any behavioral-advertising technology.
| Cookie / Storage | Purpose | Duration |
|---|---|---|
woocommerce_* |
Cart contents and checkout session | Session to 2 days |
sbjs_* (first-party referrer) |
Internal first-party referrer attribution and site performance; no cross-site tracking | 6 months |
pgb_cg_age_ok |
Records that you confirmed you are 21+ and viewed eligibility/research-use notices | 30 days |
| WordPress auth cookies | Keep you logged in | 14 days |
| hCaptcha session storage | Anti-bot verification at registration, login, checkout, and forms | Session |
You can clear or block cookies at any time through your browser settings. Blocking cart, auth, age-gate, security, or hCaptcha storage may prevent you from completing checkout, logging in, verifying eligibility, or submitting forms. Because we do not sell or share personal information or use targeted advertising, we do not currently provide a cookie-based “Do Not Sell or Share” or targeted-advertising opt-out.
5. How long we keep your information
| Category | Retention |
|---|---|
| Account record (name, email, login) | Until you delete your account, then 30 days for backup purge, unless needed for legal, security, eligibility, or dispute records |
| Order records and shipping addresses | 7 years (tax and recordkeeping obligation) |
| Cryptocurrency transaction hashes and addresses | 7 years (tax and accounting recordkeeping obligation) |
| Testing-program participation and donor records (if applicable) | 3 years from the testing round |
| Customer-support correspondence | 2 years from last contact |
| Session cookies, hCaptcha/bot-detection data, and server/security logs | 30–90 days, unless retained longer for investigation, security, abuse prevention, or legal compliance |
| Terms-acceptance audit log | For the life of your account, then 7 years (legal-record obligation) |
Cryptocurrency transaction information may also be permanently visible on public blockchains outside PGB’s control — see Section 11. Deleting PGB account or order records does not remove public blockchain records maintained by decentralized networks, wallet providers, block explorers, or other third parties.
Where law requires longer retention, we keep the relevant records for the legally required period. We may also retain limited records where reasonably necessary to complete transactions, comply with tax/accounting obligations, resolve disputes, enforce our Terms and policies, document consent or eligibility attestations, prevent fraud or abuse, preserve safety and security, or comply with legal process. When the applicable period ends, we delete, de-identify, or anonymize the data where feasible.
6. Security
We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encrypted transport (HTTPS/TLS) for all site traffic, encrypted password storage, role-based access controls, two-factor authentication for administrators, anti-bot challenges at registration, sign-in, checkout, and forms, logging and rate-limiting against credential-stuffing attacks, and vendor-access controls. No system is completely secure, and public blockchain transactions are not controlled by PGB, so we cannot guarantee absolute security or confidentiality of information visible on public networks.
If we discover a personal-information security incident that legally requires notification, we will notify affected individuals and the appropriate authorities in the manner and timeframes required by applicable law.
7. Your rights
Depending on where you live, you may have some or all of the following rights regarding your personal information. To exercise any of these rights, email [email protected] from the address on file with your account, or write to us at the postal address listed in Section 16.
- Know / Access: request a copy of the personal information we hold about you and information about how it has been collected, used, disclosed, sold, or shared during the applicable lookback period.
- Correct: request correction of inaccurate personal information.
- Delete: request deletion of your personal information. As permitted by California Civil Code §1798.105(d) and the analogous provisions of other state privacy laws, we may retain information that is necessary to (a) complete the transaction for which it was collected, including providing the goods you have ordered; (b) detect security incidents, prevent fraud, or investigate malicious activity; (c) comply with a legal obligation, including tax and accounting recordkeeping; (d) preserve our Terms-acceptance audit log as a legal record; or (e) for other internal uses reasonably aligned with the context in which the information was provided. The retention periods in Section 5 reflect these exceptions.
- Opt-out of sale, sharing, targeted advertising, or certain profiling: exercise any applicable right to opt out of the sale or sharing of personal information, targeted advertising, or profiling that produces legal or similarly significant effects. As described in Sections 2 and 3, we do not sell or share personal information, use targeted advertising, or engage in such profiling; these rights are included here for completeness.
- Limit use of sensitive personal information: as described in Section 1, we do not use sensitive personal information for purposes that require a “Limit Use” link; this right is included here for completeness.
- Portability: receive an exportable copy of certain personal information in a common, machine-readable format.
- Non-retaliation / nondiscrimination: we will not deny service, change pricing, provide a different level or quality of service, or otherwise penalize you for exercising applicable privacy rights, except as permitted by law or where information is necessary to provide the requested service, fulfill an order, comply with law, or enforce our Terms and safety restrictions.
We will verify your identity before processing a request, using information already in our records (account email, recent order detail, account status, or other reasonable verification information). We will not require you to create a new account to submit a request, but we may require you to use an existing account or provide matching information to protect your data. For deletion or portability requests, we will respond substantively within 45 calendar days of receipt, extendable by up to 45 additional days with notice to you. For other requests, we will acknowledge receipt within 10 business days and respond substantively within the timeframe required by the applicable law (typically 30 to 45 days).
You may use an authorized agent to submit a request on your behalf. We will require verification of the agent’s authorization, such as written permission or proof of power of attorney where applicable, and may separately verify your identity and ask you to confirm the request directly unless prohibited by law.
8. California-specific rights (CCPA / CPRA)
If you are a California resident, you have the rights described in Section 7 above, exercised in accordance with California Civil Code §1798.100 et seq.:
- Notice at Collection: the categories listed in Section 1, the purposes listed in Section 2, the sharing description in Section 3, and the retention periods in Section 5 together constitute our Notice at Collection under California Civil Code §1798.100(a). We do not collect categories of personal information beyond those listed.
- Do Not Sell or Share My Personal Information / Opt Out of Targeted Advertising: we do not sell personal information, share personal information for cross-context behavioral advertising, or process personal information for targeted advertising. There is therefore no opt-out link required, but you may confirm this status with us at any time using the contact information below.
- Shine the Light: under California Civil Code §1798.83 you may request information about disclosures we have made to third parties for their direct marketing purposes. We do not make such disclosures.
- Response timeline: acknowledge receipt within 10 business days; substantive response within 45 calendar days, extendable by 45 days with notice.
9. Other state rights
If you reside in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, or another state with a comprehensive privacy law that applies to PGB, you may have rights under your state’s law that are substantially similar to those described in Section 7 (access, correction, deletion, portability, opt-out of sale, sharing, targeted advertising, and certain profiling, and non-retaliation). Some states also provide rights concerning sensitive data or revocation of consent. We do not sell or share personal information, use targeted advertising, or engage in profiling that produces legal or similarly significant effects.
To exercise a state right, use the contact information in Section 16. We will acknowledge receipt within the timeframe required by your state’s law (typically 10 to 45 days) and respond substantively within the period your state’s law requires (typically 45 to 60 days), extendable as the law permits.
If we deny a request, you may appeal that decision by replying to our denial or using the contact information in Section 16 with “Privacy Appeal” in the subject line. We will respond to the appeal within 60 days or any shorter period required by applicable law, explain our decision in writing, and provide information about contacting your state’s attorney general or privacy authority if you are not satisfied with the resolution.
Specific rights, timelines, and procedures vary by state. The descriptions in this Section 9 are summaries provided for convenience; the controlling law is the privacy statute of your state of residence.
10. Children’s privacy
PGB sells products only to adults age 21 and over. Our website is not directed to children or teens, and we do not knowingly collect personal information from anyone under 21, including children under 13. If you are a parent or guardian and believe a child or person under 21 has provided us with personal information, contact us at [email protected] and we will delete it, subject to any legally required security, fraud-prevention, or compliance records.
11. Cryptocurrency payments and blockchain
We currently accept payment in cryptocurrency only, using the assets disclosed at checkout. When you pay with cryptocurrency, your transaction is recorded on a public, permissionless blockchain network (including Bitcoin or Solana networks, depending on the asset). Blockchain records are immutable: transaction hashes, source and destination addresses, amounts, timestamps, and network confirmations may be public, cannot be deleted by PGB, and may be visible to anyone using a blockchain explorer or analytics service.
Because we do not control public blockchain networks, we are technically unable to alter, delete, or modify the records they contain. Your right to delete (Section 7) therefore extends only to personal information held in our systems and does not require PGB to alter public blockchain data, records held by wallet providers, exchanges, block explorers, analytics providers, or other third parties we do not control. This limitation is consistent with the exceptions in California Civil Code §1798.105(d) and the analogous provisions of other state privacy laws for information a business cannot reasonably modify or must retain for legal, accounting, security, or transaction-completion purposes.
12. Communications and SMS
PGB communicates with members primarily by email and through the on-site account dashboard. We do not send marketing SMS or text-message communications. If we later offer optional transactional SMS for order, shipping, account-security, or testing-program notices, we will request any consent required by law, use the mobile number only for the disclosed transactional purpose, and allow you to opt out as legally required. If you receive an SMS purporting to be from PGB that you did not request or expect, do not respond and report it to [email protected].
13. International users
Our services are offered only in the United States. We ship to U.S. addresses only, do not process or fulfill international orders, and do not market or direct our services to users in any other jurisdiction. If you access the site from outside the United States, you do so on your own initiative, your information will be processed in the United States, and you are responsible for compliance with any local laws; however, accessing the site from outside the United States does not make you eligible to purchase products or circumvent our U.S.-only shipping policy.
14. Account deletion
You may request deletion of your account at any time by emailing [email protected]. We will delete the account and associated personal information within 30 days, subject to the legal-retention exceptions in Sections 5 and 7 and the public-blockchain limitations in Section 11. Records we are legally required or permitted to retain (such as tax records, transaction records, security logs, eligibility attestations, and the Terms-acceptance audit log) will be retained for the applicable period and then deleted, de-identified, or anonymized where feasible.
This 30-day commitment is our operational practice and is shorter than the 45-day legal-response window described in Section 7. The 45-day window is the legal maximum permitted by applicable privacy statutes; the 30-day window reflects what we typically deliver.
15. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. When we make changes that materially expand the categories of personal information we collect, the purposes for which we use it, the third parties with whom we share it, or our practices concerning sale, sharing, targeted advertising, sensitive personal information, or automated profiling, we will notify existing account holders by email or through the account dashboard before the change takes effect where required by law. Continued use of the site after notification constitutes acceptance of the updated policy, subject to any consent or opt-out rights required by applicable law.
16. Contact
Privacy questions, requests, appeals, authorized-agent submissions, or complaints can be sent to us by either of the following methods. Please include enough information for us to verify and process the request, such as the email address associated with your account and the state in which you reside; do not include medical, dosing, patient, or other unnecessary sensitive information.
- Email: [email protected]
- Postal mail: PGB Sciences, 8 The Green #25239, Dover, DE 19901, United States
Order-related support is handled through our fulfillment partner ShipSync at support.pgb.shipsync.pro. Privacy rights requests should still be directed to PGB using the contact information above, even if your request relates to order fulfillment or shipping data handled by ShipSync.