Privacy Policy

Effective date: July 4, 2026

Bioline Labs ("Bioline Labs," "we," "us," or "our") operates the website biolinelabs.com and any related mobile applications (collectively, the "Services"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, the choices you have, and how you can contact us. By using the Services, you agree to the practices described in this Privacy Policy.

Bioline Labs is a United States-based supplier of research peptides and related research compounds. All products are sold strictly for research use only (RUO). They are not drugs, foods, dietary supplements, cosmetics, or diagnostic or clinical products, and they are not intended for human or animal consumption. The Services are age-gated and intended solely for qualified researchers who are 21 years of age or older.

1. Scope of This Policy

This Privacy Policy applies to personal information we collect through the Services, including when you browse our website, create an account, place an order, contact support, or use our mobile applications. It does not apply to third-party websites, services, or platforms that we do not control, even where we link to them or where they process transactions on our behalf. Those third parties handle information under their own privacy policies.

2. Information We Collect

We collect information that you provide directly, information generated automatically when you use the Services, and information we receive from the limited third parties that help us operate the business. We handle the following categories of information.

Account information:

- Email address - Name - Hashed password (we store a cryptographic hash, never your plain-text password) - Connected sign-in provider details, if you choose to sign in with Google or Apple

Order and fulfillment information:

- Shipping address and billing address - Order and purchase history - Order-related messages and support correspondence

Consent and compliance information:

- Age-gate acknowledgements and terms acceptances, each recorded with a timestamp, the IP address used, and the browser or device user-agent string, so that we can demonstrate that required disclosures were presented and accepted

Technical and usage information:

- IP address - Device and browser information - Basic usage activity necessary to operate, maintain, and secure the Services

Payment information:

- We do not store payment card numbers. Payments are handled through the payment methods described in Section 4. When you pay by cryptocurrency or by a peer-to-peer method, the relevant processor handles the transaction and we receive only the confirmation and reference details needed to associate a payment with your order.

3. How We Use Your Information

We use the information we collect for the following purposes:

- To create and manage your account and authenticate your sign-in, including through connected providers you choose - To process, fulfill, and ship your orders, and to calculate order totals, including sales tax where applicable (for example, in Ohio) - To communicate with you about your orders, respond to support requests, and send transactional and service messages such as order confirmations, shipping updates, and account notices - To operate our shopping cart, remember your age-gate acknowledgement, and provide core site functionality - To maintain records of age-gate and terms acceptances for legal and compliance purposes and to defend the legitimacy of those acceptances if ever questioned - To detect, prevent, and investigate fraud, abuse, security incidents, and other prohibited or unlawful activity, and to protect the rights, property, and safety of Bioline Labs, our customers, and others - To comply with our legal, tax, accounting, and recordkeeping obligations - To operate, evaluate, maintain, secure, and improve the Services

We rely on your consent (for example, your age-gate and terms acceptances), the need to perform our contract with you (for example, fulfilling your orders), our legitimate business interests (for example, securing the Services and preventing fraud), and compliance with legal obligations (for example, tax and order retention) as the bases for these uses.

4. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use advertising trackers. We disclose information only to the limited categories of service providers and third parties described below, and only as needed for them to perform services for us or as required by law.

- Payment processors: cryptocurrency payment processors (NOWPayments and Bitflow) and manual peer-to-peer payment methods (Venmo and Zelle), to process and confirm payment for your orders - Shipping carriers: for example, UPS, to deliver your orders and provide tracking - Transactional email provider: Resend, to send order, account, and service emails on our behalf - Address autocomplete and validation providers: Google Maps Platform and Geoapify, to help you enter and verify accurate shipping and billing addresses - Hosting, content delivery, and security providers: our self-hosted server operates behind Cloudflare, which provides content delivery, performance, and security protection - Social sign-in providers: Google and Apple, when you choose to sign in using one of those accounts

We may also disclose information when we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or a governmental request; to enforce our terms and policies; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Bioline Labs, our customers, or others. If Bioline Labs is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy.

5. Cookies and Local Storage

We use only essential and functional cookies and local storage. These are limited to what is necessary to operate the Services and include:

- Authentication and session cookies that keep you signed in and secure your account - Shopping cart storage that remembers the items you have added - Age-gate acknowledgement storage that records that you confirmed you meet our age requirement

We do not use advertising cookies, cross-site tracking, or third-party ad networks. Because these cookies and storage items are strictly necessary to provide the Services you request, they are always active while you use the Services. You can control cookies through your browser settings, but disabling essential cookies may prevent parts of the Services, such as signing in or checking out, from working.

6. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

- Account information is retained for as long as your account remains active and for a reasonable period afterward to support account recovery, security, and dispute resolution. - Order, purchase, and transaction records, including associated shipping and billing address information, are retained for the periods required by applicable tax, accounting, commercial, and recordkeeping laws. These legally required retention periods apply even if you request deletion of your account, and typically require records to be kept for several years. - Age-gate and terms acceptance records are retained for as long as necessary to support our legal and compliance obligations and to defend the validity of those acceptances. - Technical and security logs are retained for a limited period appropriate to operate and secure the Services and to investigate incidents.

When information is no longer required for these purposes, we delete it or de-identify it using reasonable measures.

7. Security

We take the protection of personal information seriously and maintain administrative, technical, and organizational safeguards designed to protect it against unauthorized access, use, alteration, disclosure, and loss. These measures include:

- Storing passwords only as cryptographic hashes, never in plain text - Encrypting data in transit using industry-standard TLS - Operating behind Cloudflare for network security and protection against common web attacks - Not storing payment card numbers on our systems - Restricting internal access to personal information to those who need it to operate the business, and separating sensitive credentials from ordinary application data - Maintaining audit and access controls, monitoring, and logging to detect and respond to potential security issues

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you believe your account has been compromised.

8. Your Rights and Choices

Subject to applicable law and to the legal retention obligations described in Section 6, you may exercise the following rights regarding your personal information:

- Access: request a copy of the personal information we hold about you - Correction: request that we correct inaccurate or incomplete personal information - Deletion: request that we delete your personal information, understanding that we must retain certain order, tax, and compliance records for the periods required by law and may retain information as needed to prevent fraud, resolve disputes, or enforce our agreements - Marketing opt-out: unsubscribe from any non-essential marketing communications at any time using the unsubscribe mechanism in those messages or by contacting us; note that we will still send transactional and service messages related to your account and orders, which are not marketing

You can update much of your account information directly by signing in to your account. To exercise any of these rights, contact us at [email protected]. We will respond within the time required by applicable law. To protect your privacy and security, we will take reasonable steps to verify your identity before acting on a request, and we may decline requests where permitted by law or where honoring them would require us to violate a legal retention obligation. We will not discriminate against you for exercising your privacy rights.

9. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides you with additional rights regarding your personal information. Subject to certain exceptions and to the legal retention obligations described in this Privacy Policy, you have the right to:

- Know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collecting it, and the categories of third parties to whom we disclose it - Request correction of inaccurate personal information - Request deletion of personal information we have collected from you - Opt out of the sale or sharing of your personal information - Not be subjected to discrimination for exercising your privacy rights

We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is no need to opt out of those activities. The categories of personal information we collect, the purposes for which we use them, and the categories of third parties to whom we disclose them are described in Sections 2, 3, and 4 of this Privacy Policy. To exercise your California rights, contact us at [email protected]. You may use an authorized agent to submit a request on your behalf, in which case we may require proof of the agent's authorization and verification of your identity. We will not discriminate against you for exercising any of these rights.

10. Children and Age Restriction

The Services are intended only for qualified researchers who are 21 years of age or older, and access is age-gated. The Services are not directed to children, and we do not knowingly collect personal information from anyone under 21, including children under 13. If you are under 21, you may not use the Services or provide any information to us. If we learn that we have collected personal information from a person under the applicable age without appropriate authorization, we will delete that information promptly. If you believe a minor may have provided us personal information, please contact us at [email protected].

11. International Users and Data Transfers

Bioline Labs is based in the United States, and our Services are operated and our information is stored and processed in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States and potentially other jurisdictions where we or our service providers operate. The data protection and privacy laws of the United States may differ from those of your country. By using the Services or providing information to us, you consent to the transfer and processing of your information in the United States and elsewhere as described in this Privacy Policy.

12. Payments, Sales, and Related Terms

Order totals may include sales tax where applicable, such as in Ohio. We accept manual peer-to-peer payment methods and cryptocurrency payments as described in Section 4. All sales are final. We offer a limited replacement policy for items that arrive wrong, damaged, or are lost in transit, where a claim is submitted within 48 hours of delivery or expected delivery, together with photographic evidence. This Privacy Policy governs the handling of personal information; the terms of sale and replacement are set out in our Terms of Service and are also provided at the point of purchase.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or the Services. When we make changes, we will revise the effective date at the top of this Privacy Policy and post the updated version on the Services. If we make material changes, we will take reasonable steps to provide additional notice, such as through the Services or by email. Your continued use of the Services after an updated Privacy Policy takes effect constitutes your acceptance of the changes.

14. Governing Law

This Privacy Policy and any dispute arising out of or relating to it or to our handling of your personal information are governed by the laws of the State of Ohio, United States, without regard to its conflict-of-laws principles, except where other mandatory privacy laws apply to you.

15. How to Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

- Bioline Labs - Email: [email protected] - Website: biolinelabs.com

We will make reasonable efforts to respond to your inquiry and to resolve any concerns in accordance with applicable law.