Privacy Policy

We respect your privacy and are committed to protecting it through our compliance with this Privacy Policy. This Privacy Policy describes our policies and procedures on the collection, use, and disclosure of your information when you use our Website and tells you about your privacy rights and how the law protects you. This Policy applies to information we collect (1) on this Website and (2) in email, text, and other electronic messages between you and this Website. We use your personal data to provide and improve our Website. The data controller is PurgoLabs LLC, doing business as Purgo Labs, 10105 E Via Linda St Bld 103, Scottsdale, AZ 85258, United States. Contact: support@purgolabs.com.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. By using the Website, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, your choice is not to use our Website. By accessing or using this Website, you agree to this Privacy Policy. This policy may change from time to time. Your continued use of this Website after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Interpretations and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• You means the individual accessing or using the Website, or the company, or other legal entity on behalf of which such individual is accessing or using the Website, as applicable.
• Company (referred to as either “the Company,” “We,” “Us,” or “Our” in this Agreement) refers to PurgoLabs LLC, doing business as Purgo Labs, an Arizona limited liability company.
• Affiliate means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest, or other securities entitled to vote for election of directors or other managing authority.
• Account means a unique account created for you to access our Website or parts of our Website.
• Website refers to https://www.purgolabs.com.
• Country refers to: United States.
• Website Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Website, to provide the Website on behalf of the Company, to perform services related to the Website, or to assist the Company in analyzing how the Website is used.
• Third-party Social Media Website refers to any website or social network website through which a User can log in or create an account to use the Website.
• Personal Data is any information that relates to an identified or identifiable individual.
• Cookies are small files that are placed on your computer, mobile device, or any other device by a website, containing the details of your browsing history on that website among its many uses.
• Device means any device that can access the Website such as a computer, a cellphone, or a digital tablet.
• Usage Data refers to data collected automatically, either generated by the use of the Website or from the Website infrastructure itself (for example, the duration of a page visit).

Children’s Privacy (COPPA)

The Website is for adults. We do not knowingly collect personal information from anyone under 18, and we do not direct the Website to children under 13. We do not have actual knowledge that we collect personal information from children under 13. If a parent or guardian believes a child under 13 (or under 16 in a jurisdiction that uses that age) provided information to us, email support@purgolabs.com. We will delete that information and will not condition a child’s participation on providing more data than reasonably necessary. We do not sell or share children’s personal information. Purchases and accounts require the user to be 18 or older.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using our Website, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Billing and shipping address, City, State, ZIP/Postal code, country
• Account login credentials (stored in hashed or similarly protected form)
• Order history, cart contents, loyalty or store-credit balances, subscription or membership status
• Payment method type, last-four digits, and transaction identifiers (full card numbers are handled by payment processors, not stored by us as PAN)
• Government ID images and biometric identifiers when identity verification is required (processed by Veriff; we do not retain biometric templates)
• Support emails, chat or ticket contents, and recordings or transcripts of those communications
• Marketing and SMS consent records, opt-out requests, and message engagement
• Advertising and analytics identifiers, including cookie IDs, pixel IDs, and click IDs such as gclid, gbraid, wbraid, and similar partner click identifiers
• Usage Data

Usage Data

Usage Data is collected automatically when using the Website. Usage Data may include information such as your device’s Internet Protocol address (e.g., IP address), browser type, browser version, the pages of our Website that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

When you access the Website by or through a mobile device, we may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers, and other diagnostic data.

We may also collect information that your browser sends whenever you visit our Website or when you access the Website by or through a mobile device.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on our Website and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze our Website.

You can instruct your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if you do not accept Cookies, you may not be able to use some parts of our Website. Cookies can be “Persistent” or “Session” Cookies. Persistent Cookies remain on your personal computer or mobile device when you go offline, while Session Cookies are deleted as soon as you close your web browser. We use both session and persistent Cookies for the purposes set out below:

• Necessary / Essential Cookies
  Type: Session Cookies
  Administered by: Us
  Purpose: These Cookies are essential to provide you with services available through the Website and to enable you to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that you have asked for cannot be provided, and we only use these Cookies to provide you with those services.
• Cookies Policy / Notice Acceptance Cookies
  Type: Persistent Cookies
  Administered by: Us
  Purpose: These Cookies identify if users have accepted the use of cookies on the Website.
• Functionality Cookies
  Type: Persistent Cookies
  Administered by: Us
  Purpose: These Cookies allow us to remember choices you make when you use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide you with a more personal experience and to avoid you having to re-enter your preferences every time you use the Website.
• Tracking and Performance Cookies
  Type: Persistent Cookies
  Administered by: Third parties
  Purpose: These Cookies are used to track information about traffic to the Website and how users use the Website. The information gathered via these Cookies may directly or indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the Website. We may also use these Cookies to test new advertisements, pages, features, or new functionality of the Website to see how our users react to them.
• Session-replay Cookies (Microsoft Clarity)
  Type: Persistent Cookies
  Administered by: Third parties (Microsoft)
  Purpose: These Cookies and scripts record how visitors move through pages (clicks, scrolls, and session replay). We use this to find broken checkout steps and usability problems. Session replay can capture information you type into forms other than password fields. You can reject non-essential cookies in our cookie banner where shown.

Use of Your Personal Data

The Company may use personal data for the following purposes:

• To provide and maintain our Website, including to monitor the usage of our Website.
• To manage your Account: to manage your registration as a user of the Website. The personal data you provide can give you access to different functionalities of the Website that are available to you as a registered user.
• For the performance of a contract: the development, compliance, and undertaking of the purchase contract for the products, items, or services you have purchased or of any other contract with us through the Website.
• To contact you: to contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as mobile application push notifications regarding updates or informative communications related to the functionalities, products, or contracted services, including security updates, when necessary or reasonable for their implementation.
• To provide you with news, special offers, and general information about other goods, services, and events which we offer that are similar to those that you have already purchased or inquired about unless you have opted not to receive such information.
• To manage your requests: to attend and manage your requests to us.
• To detect, investigate, and prevent fraud, chargebacks, abusive charge activity, and violations of our Terms.
• To measure advertising performance and attribute orders to marketing campaigns, including through pixels and conversion APIs operated by advertising platforms.
• To operate artificial-intelligence tools that draft support replies, generate educational site content, and assist internal operations, as described below.
• For any other purpose with your consent.

SMS Account Authentication and Fraud-Prevention Messages

Program name: Purgo Labs Account Authentication Alerts.

Program description: We send SMS messages that contain account verification or authentication links to help confirm the purchaser is a real person, reduce fraud, and secure order/account access.

How users opt in: Users provide their phone number and explicitly opt in during checkout as part of order verification and account authentication.

Message frequency: Message frequency varies by user activity and is typically limited to authentication events associated with an order or account action.

Message and data rates: Message and data rates may apply based on your carrier plan.

Support contact: For support, email support@purgolabs.com or use our Contact Us page.

Opt out instructions: Reply STOP to opt out of SMS messages. Reply HELP for help.

We collect phone number, order/account identifiers, and message interaction data solely to deliver and secure authentication communications. We do not sell this information. We do not share phone numbers or SMS consent data with third parties or affiliates for their own marketing/promotional use.

For more details, see Twilio Support Article.

We may share your personal information in the following situations:

• With Website Providers: We may share your personal information with Website Providers to monitor and analyze the use of our Website, to contact you, or to process orders and payments.
• For Business Transfers: We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition (whether through a sale or bankruptcy, liquidation, or similar proceedings) of all or a portion of our business to another company.
• With Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include our parent company and any other subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
• With Business Partners: We may share your information with our business partners to offer you certain products, services, or promotions.
• With Other Users: When you share personal information or otherwise interact in the public areas with other users, such information may be viewed by all users and may be publicly distributed outside. If you interact with other users or register through a third-party social media website, your contacts on that website may see your name, profile, pictures, and description of your activity. Similarly, other users will be able to view descriptions of your activity, communicate with you, and view your profile.

Identity Verification for Age-Restricted Products

The Company, at its sole discretion, may utilize third-party services to perform identity verification. Veriff is utilized to verify customer identities when necessary to ensure compliance, prevent fraud, and protect our platform. During this process, Veriff may collect and process personal information, including identification documents and biometric data, in accordance with their Privacy Notice. Upon completion of the process, the Company is provided an authorization to continue a transaction if verification has passed. If the verification process is incomplete or abandoned, the associated order will be cancelled and will not be processed.

By participating in the verification process, you consent to Veriff’s handling of your personal data. The Company does not store biometric data or copies of identification documents unless legally required. For more information, please review Veriff’s Privacy Notice.

Illinois Biometric Information Privacy Act (BIPA) and similar state biometric laws: if you are asked to complete identity verification, Veriff—not Purgo Labs—collects any facial geometry or similar biometric identifiers. We do not sell biometric identifiers. We do not store biometric templates. If a biometric law applies to you, your consent is obtained in the Veriff flow, and you may refuse verification (the related order may then be cancelled). To ask about deletion of verification records we control (pass/fail and reference IDs), email support@purgolabs.com.

Where Your Data Goes (Processors and Recipients)

We do not sell your postal address list as a standalone mailing list. We do share personal information with service providers who process it on our instructions, and we may share identifiers with advertising partners as described in the California section below. Categories of recipients include:

• Hosting and infrastructure: website hosting, application platforms, and databases (including Vercel and our database providers), located primarily in the United States.
• Payment processors and membership billing: card, ACH, wallet, and crypto processors we use from time to time, including TagadaPay, Whop, SellAbroad, and other merchant or gateway partners. They receive name, contact, billing, and payment data needed to complete a charge. We do not receive or store your full primary account number.
• Fulfillment and carriers: shipping-label and logistics providers (including Shippo) and carriers such as USPS, UPS, FedEx, or DHL, who receive name, phone, email, and shipping address to deliver orders.
• Communications: email delivery providers and SMS providers (including Twilio and similar carriers such as Blooio) that receive email address or phone number to send transactional, authentication, or consented marketing messages.
• Identity verification: Veriff, which may process government ID images and biometric data as described above.
• Analytics, session replay, and advertising: measurement and ad platforms, which may include Google Analytics and advertising tools operated by Google, Meta, Snapchat, TikTok, OpenAI (ChatGPT Ads), and similar partners. We also use Microsoft Clarity, which records page views, clicks, and session replays (a video-like recording of how you use the page, which can include text you type into non-password fields). These partners may receive device identifiers, cookie IDs, truncated or hashed contact data, page-interaction data, and conversion events.
• Artificial intelligence providers: model providers such as OpenAI and Anthropic (or successors) when we send support text, prompts, or content-generation inputs to produce a draft reply or page content.
• Professional advisers and authorities: accountants, lawyers, insurers, payment networks, and government agencies when required for tax, legal process, or fraud investigations.

These providers are located mainly in the United States. If you access the Website from the EEA, UK, or another country, your information is transferred to the United States, where privacy law may differ. Where required, we rely on contractual protections such as the European Commission’s Standard Contractual Clauses, or on your consent, to make that transfer.

Artificial Intelligence Processing

We use AI tools in limited ways: (1) to draft customer-support replies from ticket or email text you send us; (2) to help generate educational website or blog content that is not about you personally; and (3) to assist internal operations such as classification or fraud signals. When a human support draft is generated, the prompt may include your name, email, order identifiers, and the text of your request. We do not use your payment card number as a model prompt. We do not sell your support transcripts to third parties for them to train public foundation models as a standalone product. Third-party AI vendors process prompts under their terms and may retain data for a limited period for abuse monitoring as described in their policies. You may request that we not use AI on a specific support thread by writing support@purgolabs.com and asking for human-only handling. AI output can be wrong; it is not medical or legal advice.

Retention of Your Personal Data

We keep personal data only as long as needed for the purposes in this Policy, including legal, tax, fraud, and dispute purposes. Typical periods (unless a longer period is required by law or an active dispute):

• Account profile: while the account is open, then up to 3 years after last activity unless you request deletion and no legal hold applies.
• Orders, invoices, tax, and shipping records: 7 years from the transaction date (tax and commercial-record requirements).
• Payment processor tokens and charge logs: as required by the processor and card-network rules, typically 1–7 years for dispute defense.
• Marketing email lists: until you unsubscribe, plus a suppression record so we do not email you again.
• SMS consent and opt-out logs: for the life of the consent plus at least 4 years (TCPA and carrier-audit practice).
• Support tickets and AI draft metadata: up to 3 years after the ticket closes.
• Identity-verification results: pass/fail and reference IDs as needed for fraud and compliance; biometric images remain with Veriff under its retention schedule, not in our product database.
• Analytics and advertising cookies: session cookies until the browser closes; persistent analytics/ads cookies generally 1–24 months depending on the vendor.
• Server and security logs: typically 30–180 days, longer if needed to investigate abuse.

When retention ends, we delete or irreversibly de-identify the data, except copies remaining in encrypted backups until those backups rotate. Usage Data used only to improve the Website is generally kept for a shorter period unless needed for security.

Transfer of Your Personal Data

Your information, including personal data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to—and maintained on—computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. The Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and no transfer of your personal data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition, asset sale, dissolution, liquidation, bankruptcy, or similar proceeding, your personal data may be transferred. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

Other Legal Requirements

The Company may disclose your personal data in the good faith belief that such action is necessary to:

• Comply with a legal obligation.
• Protect and defend the rights or property of the Company.
• Prevent or investigate possible wrongdoing in connection with the Website.
• Protect the personal safety of users of the Website or the public.
• Protect against legal liability.

Security of Your Personal Data

The security of your personal data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

If we become aware of a breach of personal information that requires notice under applicable law, we will notify affected individuals and regulators in the manner and time those laws require (for example without unreasonable delay, and where a statute sets a deadline such as 30, 45, or 60 days, within that period). Notice may be by email to the address on your account or order.

Detailed Information on the Processing of Your Personal Data

Service providers have access to your personal data only to perform their tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Analytics

We may use third-party service providers to monitor and analyze the use of our Website, including Google Analytics and Microsoft Clarity (including session replay as described above).

Usage, Performance, and Miscellaneous

We may use third-party service providers to provide better improvement of our Website, including services that monitor system performance, ensure uptime, and enhance user experience.

Links to Other Websites

Our Website may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Your Privacy Rights (United States, including California)

Depending on your state of residence (including California under the CCPA/CPRA, and similar laws in states such as Colorado, Connecticut, Virginia, Texas, and Oregon), you may have the right to: know and access the personal information we have collected about you; correct inaccurate information; delete personal information, subject to legal exceptions (for example, completed orders we must keep for tax); opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising; limit the use of sensitive personal information if we use it to infer characteristics (we do not use sensitive information for that purpose); and not be discriminated against for exercising these rights.

In the prior 12 months we have collected the categories listed above (identifiers, commercial information, internet/electronic activity, geolocation approximations from IP, inferences from browsing, and, when verification is used, government-ID and biometric data processed by Veriff). Sources include you, your device, payment and shipping partners, advertising platforms, and service providers. We use these categories for the purposes described in this Policy.

We do not sell personal information for money. Like most ecommerce sites, we use advertising and analytics cookies, pixels, and conversion APIs. Under California law that activity can be classified as “sharing” or a “sale” of identifiers and internet activity for cross-context behavioral advertising. To opt out, email support@purgolabs.com with the subject “Do Not Sell or Share My Personal Information,” use our cookie controls where shown, and enable a recognized opt-out preference signal such as Global Privacy Control (GPC) in your browser. We will process GPC as an opt-out of sale/sharing for that browser. Authorized agents may submit requests with proof of authority. We will verify requests using information we already have (such as email and recent order details) and respond within the time required by law (generally 45 days, extendable once). If we deny a request, you may appeal by emailing the same address with the subject “Privacy Appeal” and we will explain our decision in writing within the time required by your state’s law.

Some browsers send a “Do Not Track” (DNT) signal. There is no common industry standard for DNT, so we do not respond to DNT. We do honor Global Privacy Control (GPC) as an opt-out of sale/sharing for that browser, as described above.

We do not collect medical records, diagnoses, or treatment data. Educational product text on the Website is not your personal health information. We do not knowingly send health-condition data to advertising platforms. Identity documents used for age or fraud checks are used only for those purposes.

Notice of Financial Incentive (Loyalty, Points, and Store Credit)

We operate optional rewards: account points, store credit, referral or first-order bonuses, VIP or promotional gifts, and similar benefits. These programs can be a “financial incentive” under the CCPA/CPRA because they relate to collecting and retaining identifiers and commercial information (name, email, phone, account, and purchase history).

• Summary: participating customers may earn points or credit toward future research-product orders, or receive promotional gifts, in connection with an account and purchases.
• Material terms: categories implicated are identifiers and commercial information. Benefits have no cash-out value except as stated in program rules, may expire, and may be reversed for returns or fraud.
• How to opt in: create an account, accept points or credit when offered, or use a referral/promo that awards a balance.
• How to withdraw: email support@purgolabs.com and ask to close the loyalty/credit program for your account. You may still shop as a guest. Deleting an account or exercising deletion rights may forfeit unused points or credit to the extent allowed by law.
• Value of consumer data: we estimate in good faith that personal information of an active rewards customer is worth to us approximately the average annual cost of points, store credit, and gifts we issue to that customer (typically under $50 per active year). We calculate this by dividing historical reward expense by the number of active rewards accounts. The price or service difference is reasonably related to that value because rewards are funded from the commercial relationship created by the account and order data. We do not deny goods or charge a different merchandise price solely because you exercised a privacy right, except that we may not be able to operate a personalized rewards balance without an account.

California Civil Code § 1798.83 (Shine the Light): we do not disclose personal information to third parties for their own direct mail marketing. Nevada residents may email the same address to opt out of any future sale of covered information.

Rights for EEA, UK, and Similar Jurisdictions

If European or UK data-protection law applies to you, our legal bases for processing typically include: performance of a contract (orders, accounts, shipping); legitimate interests (site security, fraud prevention, limited analytics, improving the Website); legal obligation (tax and accounting); and consent (optional marketing cookies, marketing SMS, and certain AI or advertising uses where required). You may have rights to access, rectify, erase, restrict, or port your data, to object to processing based on legitimate interests or direct marketing, and to withdraw consent. You may lodge a complaint with your local supervisory authority. We do not use solely automated decision-making that produces legal or similarly significant effects about you without human involvement.

Email, SMS, and Do-Not-Contact Lists

Commercial email complies with the CAN-SPAM Act: accurate headers, identification of the sender, a valid postal address (10105 E Via Linda St Bld 103, Scottsdale, AZ 85258), and a working unsubscribe method honored within 10 business days. Marketing SMS requires prior express written consent, is not required to complete a purchase, and can be stopped by replying STOP. We keep suppression lists so we do not re-message people who opted out, except for transactional or legally required communications.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Website prior to the change becoming effective and update the “Effective Date” at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, you can contact us:

• By email: support@purgolabs.com
• By mail: PurgoLabs LLC, Attn: Privacy, 10105 E Via Linda St Bld 103, Scottsdale, AZ 85258
• Through our Contact Us page