Privacy Policy.

Account & order information. Name, email address, billing and shipping address, phone number, order history, and the products you purchase.

Payment information. Card payments are processed by Stripe. We never see or store your full card number, expiry, or CVC. We retain only the last four digits and brand of the card used, plus the payment status, for receipts and fraud prevention.

Communications. Messages you send us through support channels, applications to our partner program, and email/SMS preferences.

Automatically collected. IP address, device and browser information, pages viewed, referring URL, and cookie identifiers. We use this to operate the site, prevent abuse, and improve the experience.

• Process orders, ship products, and provide customer support.
• Operate your account, rewards balance, and referral activity.
• Send transactional messages (order confirmations, shipping updates, password resets, account notifications).
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.
• With your consent, send marketing or product updates. You can opt out at any time.

We do not sell your personal information. We share it only with the service providers required to run the business, including:

• Payments: Stripe (card processing, fraud screening).
• Fulfillment & shipping: our shipping carriers and warehouse partners.
• Email & messaging: our transactional email provider for order and account messages.
• Infrastructure: hosting, database, and analytics providers under contract.
• Legal: when required by law, subpoena, or to protect our rights, customers, or the public.

We use first-party cookies and similar technologies to keep you signed in, remember your cart, attribute partner referrals, and measure aggregate site performance. You can disable cookies in your browser, but parts of the site (checkout, account, rewards) require them to function.

Order, tax, and payment records are retained for the period required by applicable accounting and tax law (typically up to seven years). Account information is retained while your account is active. You can request deletion at any time, subject to legal recordkeeping requirements.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise these rights, email privacy@halobac.com. We will verify your identity before acting on a request.

Halo Bac is not directed to children under 18 and we do not knowingly collect personal information from them. Products are sold for laboratory research use by qualified adults.

We operate in the United States. If you access the site from outside the U.S., your information will be transferred to and processed in the U.S. and other jurisdictions where our service providers operate.

We use industry-standard safeguards (TLS in transit, encryption at rest, scoped access controls). No system is perfectly secure; please use a strong, unique password and notify us immediately at security@halobac.com if you suspect unauthorized access.

We may update this policy. Material changes will be posted here with a new "Last updated" date and, where appropriate, additional notice.

Questions about this policy: privacy@halobac.com.