Global Compliance Addendum

Version 2026.05.22. Supplements the Data Use Policy and Terms of Service.

We ship only inside the United States. Visitors may reach the site from anywhere. The following rights apply to anyone who fits the definition, regardless of where they live, on top of our baseline US-default privacy posture.

GDPR (EU) and UK-GDPR

You have the right to:

• Access (Article 15) — request a copy of your data
• Rectification (Article 16) — correct inaccurate data
• Erasure (Article 17) — be forgotten, subject to a 7-year recordkeeping requirement on order/attestation/audit data
• Restrict processing (Article 18)
• Data portability (Article 20) — receive your data in JSON or CSV
• Object (Article 21)
• Not be subject to automated decision-making (Article 22) — we do not run automated decisions that produce legal effects
• Lodge a complaint with your supervisory authority

Lawful bases we rely on:

• Contract (Art 6(1)(b)) — to take an order, ship it, and provide an account
• Legitimate interest (Art 6(1)(f)) — fraud prevention, audit log, operational analytics with no PII
• Consent (Art 6(1)(a)) — newsletter, exit-intent capture
• Legal obligation (Art 6(1)(c)) — recordkeeping for research-material commerce

We do not transfer personal data outside the United States. Email [email protected] to exercise any right; we respond within 30 days.

CCPA / CPRA (California)

You have the right to know, delete, correct, opt out of sale, opt out of sharing for cross-context behavioral advertising, limit use of sensitive personal information, and non-discrimination. We do not sell personal information. We do not engage in cross-context behavioral advertising. Email [email protected].

PIPEDA (Canada)

You may access, correct, and challenge our handling. We comply with the 10 fair-information principles. Privacy officer: [email protected].

LGPD (Brazil)

You may confirm, access, correct, anonymize, port, erase, and be informed about sharing of your data. Email [email protected].

Australia Privacy Act / APPs

We adhere to the Australian Privacy Principles for personal information of anyone we serve. Email [email protected].

Singapore PDPA

You may withdraw consent, access, correct, and complain. Data protection officer: [email protected].

Other jurisdictions

Equivalent rights in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Florida (FDBR), Iowa (ICDPA), Tennessee (TIPA), Indiana, Montana, New Jersey, Delaware, New Hampshire, Minnesota, Maryland (MODPA), South Carolina, and Switzerland (FADP) are honored within their statutory windows. Email [email protected].

Identity verification

To prevent fraudulent rights requests, we may ask you to verify your identity (typically by re-confirming an order number plus the email on file). We will never ask for a government ID or sensitive data over email for a rights request.

Children

We do not knowingly collect data from anyone under 21. If you believe a minor has used the site, contact [email protected] immediately for prompt erasure.

Automated decision-making

We do not run automated decisions that produce legal effects. Our fraud screening is rules-based and reviewed by a human before any account suspension or order refusal.

Sensitive personal information (CPRA, GDPR Special Categories)

We do not knowingly collect SPI. If you submit it (for example, in a support ticket), we will redact it on intake. We do not infer or process special-category data.

International data transfers

We do not transfer personal data outside the United States. If we ever do, we will use Standard Contractual Clauses (SCCs) or an Adequacy Decision where applicable, disclose it on the Data Use Policy, and obtain re-consent where required.

Complaints and supervisory authorities

You may complain to your local supervisory authority. The list is published by the EDPB for EU members and by each national authority elsewhere.

Contact

[email protected] (privacy / DSARs) [email protected] (data-protection officer alias) [email protected] (legal team) [email protected] (security incidents)