Scope
This Privacy Policy applies to personal information processed through the Kiln website, Kiln accounts, passwordless authentication, research-access workflows, orders, support channels, partner applications, and related services. It does not replace the privacy terms of independent third parties whose services you choose to use.
Information we collect
Depending on how you use Kiln, we may process identifiers and contact information such as your name, email address, telephone number, billing or delivery address; account and authentication records; research self-attestation information such as research field, organization, and intended research purpose; order, product, transaction, refund, shipping, and payment-status information; support communications; partner or creator application information; and records reasonably necessary for fraud prevention, security, compliance, and dispute resolution.
We may also receive technical and usage information such as IP address, browser and device information, approximate location derived from network information, referral source, pages viewed, interactions with the site, timestamps, and similar diagnostic, security, or attribution data.
Kiln does not intend to collect medical records or information about personal administration, dosing, treatment, or self-experimentation with Research Products. Do not submit health, dosing, treatment, or personal-use information through research-access or support forms unless a separate regulated service expressly asks for it under its own privacy terms.
Research-access information
Kiln records research-access information as a purchaser self-attestation tied to a verified account. It is used as an account and purchase control and is not a credential, professional license, medical record, or independent certification by Kiln. Kiln may retain the attestation, its version, timestamps, account linkage, and related audit events as reasonably necessary for compliance, fraud prevention, account security, dispute resolution, and enforcement of the Terms.
Authentication information
Kiln may send one-time security codes to your verified email address and maintain server-side authentication challenges, session identifiers, timestamps, attempt records, and security logs. Kiln does not intend to use authentication codes for marketing. Authentication and session records may be retained for the period reasonably necessary to operate and secure the account system and investigate abuse or unauthorized access.
Payment information
Payments are processed by approved third-party payment providers. Kiln may receive payment status, transaction identifiers, limited payment-method information, fraud signals, and related records, but does not intend to store full payment-card numbers or card security codes on Kiln systems.
How information is collected
We collect information directly from you when you create or access an account, request or enter an authentication code, submit a research confirmation, submit a form, place an order, contact support, apply for a program, or otherwise provide information. We also receive information automatically through the site and from service providers involved in authentication, commerce, payments, fulfillment, delivery, databases, fraud prevention, analytics, and similar operations.
How we use information
We may use personal information to operate and secure the site; authenticate accounts; record and enforce research-access requirements; process, fulfill, track, and resolve orders; communicate transactional information; provide support; prevent fraud, abuse, prohibited transactions, and security incidents; maintain product, lot, fulfillment, and compliance records; enforce our Terms and policies; comply with legal, tax, payment-network, and regulatory obligations; analyze site performance; and improve Kiln products and services.
Where permitted by law, we may also use contact and attribution information for marketing, measurement, or communications consistent with your choices and applicable consent requirements.
How information is disclosed
Kiln may disclose personal information to service providers and contractors that perform functions for us, including commerce and customer-record providers, payment processors, email and authentication providers, hosting and infrastructure providers, database providers, fulfillment partners, carriers, fraud-prevention and security providers, analytics or attribution providers when enabled, and professional advisers such as lawyers, accountants, insurers, and auditors. Current infrastructure may include providers such as Shopify, Stripe, Resend, Vercel, and Neon or their successors.
We may also disclose information when reasonably necessary to comply with law or valid legal process, protect customers or Kiln, investigate suspected fraud or misuse, enforce agreements, respond to emergencies, or complete a merger, financing, acquisition, sale, restructuring, bankruptcy, or transfer of all or part of the business.
Sale and sharing of personal information
Kiln does not sell personal information for monetary consideration. If Kiln later uses advertising or measurement technology that constitutes a sale, sharing, or targeted-advertising disclosure under an applicable privacy law, Kiln will provide any notice and choice mechanism required by that law before relying on that practice.
Cookies and similar technologies
Kiln and its service providers may use cookies, local storage, session storage, pixels, or similar technologies for authentication, cart and checkout continuity, fraud prevention, security, preferences, site functionality, diagnostics, and measurement. Some technologies are necessary for the site to function. Browser or device controls may allow you to limit certain non-essential technologies, although doing so may affect site functionality.
Retention
We retain personal information for as long as reasonably necessary for the purposes described in this policy, including to maintain and secure accounts, document research confirmations, fulfill and document orders, preserve lot and transaction records, prevent fraud, resolve disputes, satisfy legal, tax, accounting, payment-network, insurance, and compliance obligations, and enforce agreements. Retention periods vary by record type and legal requirement.
When information is no longer reasonably required, we may delete, de-identify, or aggregate it, subject to applicable law and technical limitations such as routine backups.
Security
Kiln uses administrative, technical, and organizational measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. No website, transmission method, authentication system, or storage system can be guaranteed completely secure, and Kiln does not promise absolute security.
Your privacy rights
Depending on where you live and whether an applicable law covers Kiln, you may have rights to request access to, correction of, deletion of, or a portable copy of certain personal information; to receive information about categories of collection and disclosure; to opt out of certain sales, sharing, targeted advertising, or profiling; to limit certain uses of sensitive information; or to appeal a privacy-request decision.
Kiln will honor privacy rights that apply to us and to your request. We may need to verify your identity or authority before completing a request, and legal exceptions may permit or require us to retain certain information. We will not unlawfully discriminate against you for exercising an applicable privacy right.
To submit a privacy request, email support@shopkiln.com with the subject “Privacy request.” If applicable law permits an authorized agent to act for you, we may require proof of authorization and identity verification.
Children and age restrictions
Kiln commerce and research-access services are intended for adults. We do not knowingly collect personal information from children under 13, and restricted purchasing features are not intended for anyone under 18. If you believe a child has provided personal information to Kiln, contact us so we can review the record and take appropriate action.
Third-party services and links
The site may link to or rely on third-party services. Their independent privacy practices are governed by their own policies. Kiln is not responsible for independent third-party privacy practices except to the extent applicable law provides otherwise.
Processing locations
Kiln and its service providers may process information in the United States and other locations where they operate. Where applicable law requires safeguards for cross-border transfers, those safeguards will be used as required.
Changes to this policy
Kiln may update this Privacy Policy as the site, account system, services, vendors, or legal requirements change. The updated policy will identify its effective date. Where law requires additional notice or consent for a material change, Kiln will provide it.
Contact
Privacy questions and requests may be sent to support@shopkiln.com.