Privacy policy
What this site collects, why, and what you can do about it.
What is collected
- Your email address, when you create an account or place an order.
- A phone number, only if you choose to give one at checkout. It is optional, it is used only if there is a problem with your order or the delivery, and it is never used for marketing or passed to anyone else.
- A display name, if you set one, or the name on your Google account if you sign in that way. It is used to greet you and nothing else.
- Your shipping and billing address, so an order can reach you.
- Your order history, so both of us have a record of what was sold.
- Books you let go from your cart, only if you were signed in: which ones, the price at the time, and when. Kept on your account so I can see what nearly sold, and deleted with it. See the data policy.
- Basic technical data, such as pages viewed and errors encountered, used to keep the site working.
- What you write in the contact form, along with the email address and any name or order number you give, kept so I can answer you and so there is a record of what was asked.
Card numbers are never collected or stored here. They go directly to the payment processor.
Contact form messages are kept until they are answered and for a reasonable period afterwards, because a question and its answer are often the record of what was agreed about an order. No IP address is recorded with them.
Who else sees it
- Stripe, to process payments.
- Supabase, which hosts the database and account system.
- Vercel, which hosts the site.
- Resend, which sends the email this site sends you: order confirmation, dispatch and refund notices, plus cart reminders and back-in-stock alerts if you asked for them. It handles your address and what those emails say. Every email that is not about an order carries an unsubscribe link.
- Cloudflare, which runs the domain and forwards your replies to my inbox.
- Google, if you choose to sign in with a Google account. Google confirms your address to this site; your password is never seen here.
- USPS, which needs an address to deliver a parcel.
Your details are not sold, rented or traded. See the data policy for the formal position on that.
Cookies
A cookie identifies your cart so the books you reserve stay yours while you shop. Signing in sets a session cookie. Those two are what the site needs to function at all.
Do Not Track signals are acknowledged but not acted on, because there is no agreed standard for what honouring one should mean.
Children
This site is not intended for anyone under 13, and I do not knowingly collect information from them. If you believe a child has given me data, email support@grabmyslabs.com or use the contact form, and I'll remove it.
Your rights
You can ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. Email support@grabmyslabs.com from the address on your account, or make the request through the contact form while signed in, which proves the address rather than asking me to trust it.
Requests are answered within 30 days. Some records have to be kept longer where tax law requires it, and where that applies I'll tell you which and why.
Security
Data is held in a database with row-level access rules, and the storefront can only read the columns it needs. Cost prices and internal valuations are not readable by the site at all.
Changes
This policy can change. The date at the foot of this page reflects the current version.