Privacy Policy

This policy covers supernovacompounds.com and anyone who buys from it or contacts us about an order. The controller of the data described here is Northstar Capital Group LLC, at 3617 Ox Ridge Ct, Fairfax, VA 22033.

An account is required to order, so most of what follows is attached to a registered account rather than to an anonymous visit.

What you give us:

• Your name and email address
• The shipping address and phone number on your order
• Anything you write to us in an email about an order

What the site records as you use it:

• Your cart, so it survives a reload
• A session cookie once you sign in
• Sign-in attempts against your email, so a password can be rate limited
• Basic request data including IP address, kept for abuse prevention

What we deliberately do not collect:

• Payment credentials. Orders are paid on chain. There is no card number, no bank detail and no payment token to store, because none of it ever reaches us. What we keep is the receiving address we quoted, the amount, and the transaction hash you paid with, all of which are public on the chain already.
• A free-text description of your research. There is no box asking what you plan to do with anything, and there will not be. A field like that collects a medical indication against a research-use-only product, which harms the person who wrote it and helps nobody.
• Health data, government identifiers and anything else in a sensitive category. Do not send them.

• Taking, filling and shipping your order
• Answering you when you write to us
• Sending the transactional messages an order needs, which is the confirmation, the payment receipt and the tracking
• Keeping the site and its customers safe from fraud, account takeover and abuse
• Meeting our tax, accounting and record keeping obligations

We do not sell or rent personal information, and we do not hand it to anybody for their own marketing. We do not run behavioural advertising and there is no advertising pixel on this site.

Marketing email is opt in. If we ever start sending any, it carries a working unsubscribe link and unsubscribing does not affect the transactional messages your orders need.

A short list of suppliers, each doing one job and none permitted to use your data for their own purposes:

• Hosting and application delivery, which serves the site
• A managed Postgres database, which stores everything in this policy
• Email delivery, which handles your address and the content of order messages
• A shipping carrier, which gets the name, address and phone on the parcel because otherwise it cannot be delivered

Payment is on a public blockchain. A transaction you send is visible to anybody, permanently, by design. We publish nothing linking your name to an address, but the transaction itself is not private and we cannot make it so.

We will also disclose information where the law requires it, in response to a valid legal demand, or to protect our rights or somebody's safety.

We set cookies to keep you signed in, to hold your cart, and to protect sign-in against automated attempts. That is the whole list. There is no analytics cookie and no advertising cookie.

Because there is nothing optional to consent to, there is no cookie banner. Blocking cookies in your browser is fine for browsing and will stop sign-in and checkout from working.

• All traffic to and from the site is encrypted in transit
• The database enforces row level security and has no anonymous or public role
• Database credentials live only on the server and never reach your browser
• Passwords are stored as a one-way hash and cannot be read back, by us or by anybody who takes a copy of the table
• Session cookies are httpOnly and Secure, so page scripts cannot read them
• The operator terminal is on a separate hostname, is not reachable from the storefront domain, and is rate limited
• Internal order notifications carry the order number, not your street address

No system connected to the internet is perfectly secure. Use a password you have not used elsewhere.

Your account and order history are kept while your account is open and for as long as we need them to support you and to meet tax and record keeping law. Nothing is deleted on a timer.

Carts expire on their own after a period of inactivity, currently 30 days, because a cart holding a six month old price is a support ticket waiting to happen.

You can ask us to delete your data. See below.

Write to admin@supernovacompounds.com from the address on your account and you can ask us to:

• Tell you what we hold about you
• Correct anything wrong
• Delete your account and personal data
• Stop sending you marketing, which you can also do from any marketing email

We will answer within 30 days. Deletion has one limit worth stating plainly: we keep the minimum record of a completed sale that tax and accounting law requires, with the personal detail stripped back to what those rules need. We cannot delete a blockchain transaction, because nobody can.

Depending on where you live you may have further rights, including under the California Consumer Privacy Act. Exercising any right here costs nothing and we will not treat you differently for it.

This site is not for anybody under 21 and we do not knowingly collect data from anybody under 21. If you believe a minor has given us data, write to admin@supernovacompounds.com and we will remove it.

We may update this policy. The effective date at the top changes when we do. If a change materially affects how we handle data we already hold, we will say so by email to account holders rather than only by editing this page.