Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

We do not collect geolocation data, biometric data, financial account numbers, or racial/ethnic origin information.

2. How We Use Your Information

• Process and fulfill your orders
• Send order confirmations, shipping updates, and tracking information
• Respond to customer inquiries and support requests
• Send promotional emails or SMS messages — only with your explicit prior written consent
• Improve our website and services
• Comply with legal obligations

We do not use your sensitive personal information (account credentials) for any purpose other than authentication.

3. SMS / Text Marketing

If you opt in to SMS marketing (by checking the opt-in box on our website), you provide prior express written consent to receive recurring automated marketing text messages from Prime Axis Labs at the mobile number you provide.

Messages are sent directly from (832) 407-7239 (Prime Axis Labs business phone). Your phone number is stored securely in our database (Supabase — see Section 5). SMS opt-in records, including timestamp and IP address, are retained for a minimum of 4 years to comply with TCPA record-keeping requirements (28 U.S.C. §1658). For more information, view our Terms of Service.

4. Cookies and Local Storage

• Session management: Supabase authentication cookies keep you logged in. Strictly necessary; cannot be disabled without breaking login.
• Shopping cart: Cart contents stored in browser local storage (Zustand). Stays on your device until checkout. Not transmitted to our servers until you place an order.
• Age gate: SameSite=Strict cookie records that you have confirmed you are 21 or older.
• Analytics: Anonymized session analytics. No personally identifiable information is shared with analytics providers.

You can disable cookies in your browser settings, but doing so will prevent login functionality. We do not use cookies for cross-site tracking or behavioral advertising.

5. Third-Party Services

We share personal information with the following categories of service providers, solely to operate our website and fulfill orders. Each is contractually prohibited from using your data for any purpose other than performing services on our behalf.

6. Information Sharing

We do not sell, trade, or rent your personal information. We share personal information only:

• With service providers listed in Section 5, who are contractually prohibited from using your data for any purpose other than performing services for us
• If required by law, court order, subpoena, or government regulation
• To protect the rights, property, or safety of Prime Axis Labs, our customers, or the public
• In connection with a merger, acquisition, or sale of assets — you will be notified and given the opportunity to opt out before your data is transferred to a new entity operating under different privacy practices

Shine the Light (Cal. Civ. Code §1798.83): We do not share personal information with third parties for their direct marketing purposes. California residents may request information about any such sharing by contacting us at [email protected].

7. Data Security

We protect your personal information using: TLS/SSL encryption for all data in transit; Supabase Row Level Security (RLS) restricting database access to authorized users only; HSTS headers enforcing HTTPS on all connections. No data transmission or storage system is 100% secure. In the event of a data breach affecting your personal information, we will notify affected individuals as required by applicable law, including within 72 hours where required under California Civil Code §1798.82.

8. Data Retention

• Order records (name, address, order history): minimum 7 years for tax and legal compliance
• SMS opt-in records (timestamp, IP, consent text): minimum 4 years (TCPA, 28 U.S.C. §1658)
• Internet activity (pages viewed, referrer): 13 months
• Account credentials: duration of account; deleted within 30 days of account deletion request
• Support communications: 3 years from last interaction

If you request deletion of your account, we will remove your personal data within 30 days, except where retention is required by law (e.g., order records for tax purposes).

9. Your Rights

• Access: Request a copy of the personal data we hold about you, including in a portable format.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Opt-out of marketing: Unsubscribe from emails via any marketing email. Opt out of SMS by replying STOP.
• Authorized agent: You may designate an authorized agent to submit requests on your behalf. We will verify the agent's authorization before processing.

To exercise any right, contact us at [email protected] or by phone at (832) 407-7239.

10. Your California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under Cal. Civ. Code §§1798.100–1798.199:

• Right to Know (§1798.110): Request the categories and specific pieces of PI collected, the purposes, sources, and categories of third parties with whom it is shared.
• Right to Delete (§1798.105): Request deletion, subject to legal exceptions.
• Right to Correct (§1798.106): Request correction of inaccurate PI.
• Right to Data Portability: Receive a copy of your PI in a structured, machine-readable format.
• Right to Opt-Out of Sale or Sharing (§1798.120): We do not sell your PI. We do not share your PI for cross-context behavioral advertising.
• Right to Limit Use of Sensitive PI (§1798.121): We collect account credentials (sensitive PI) only for authentication and do not use them for any secondary purpose. No further limitation is needed, but you may contact us to confirm (CPRA Reg §7027(m)).
• Right to Non-Discrimination (§1798.125): We will not deny service, charge different prices, or provide different quality of service based on your exercise of these rights.
• Authorized Agent (§1798.130(a)(1)(A)): You may designate an authorized agent to make requests on your behalf. Provide written authorization and we will verify before processing.

Shine the Light (Cal. Civ. Code §1798.83): We do not disclose personal information to third parties for their direct marketing purposes. California residents may request a list of any such disclosures (none exist) by contacting us at the above address.

11. Children's Privacy

Our website is not directed to children under the age of 13. We do not knowingly collect personal information from anyone under 13, in compliance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §6501). Additionally, our products are restricted to individuals 21 years of age or older as a condition of purchase. If you believe we have inadvertently collected information from a minor under 13, please contact us immediately at [email protected] and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice by email before changes take effect. We will update the effective date at the top of this page. Your continued use of our website after the 30-day notice period constitutes acceptance of the updated policy. For non-material changes (e.g., clarifications), we will update the effective date without prior notice.

13. Contact Us

For privacy questions, data subject requests, or to exercise your rights: