Privacy Policy

Overview

Biohackr.Labs is committed to handling the personal information of our clients with care and discretion. This policy explains what data we collect, how we use it, and your rights regarding that data. We collect very limited information and use it only to operate our private client service.

What We Collect

We collect personal information when you voluntarily submit it through a form, communicate with us, or create a customer account:

• Account and order forms — name, email address, phone or WhatsApp number, country, goals, product interest, shipping details, selected products, order notes, WhatsApp transactional or marketing consent choices, and newsletter consent choices. Product-specific review questions may also be collected when required for order assessment.
• Contact form — name, email address, and message.
• Newsletter signup — name, email address, opt-in source, subscription preference, and unsubscribe activity for Biohackr.Labs Friday News.
• My Account customer portal — account identity and authentication data, together with the customer, order, delivery, inquiry, and protocol information made available to that account, including account-activation records.
• Batch verification — a truncated browser user-agent and, when a dedicated security salt is configured, a one-way pseudonymous hash derived from the requesting IP address. Verification scans do not display or attach customer, order, protocol, or account information.

In the production site, Google Analytics may be enabled on public marketing and educational pages to measure aggregate site use and campaign performance. It may process cookies and limited browser, device, and page-interaction data. Analytics collection is disabled on My Account, admin, staff, authentication, newsletter-preference, survey, and private batch-verification routes, and we do not use third-party advertising trackers. My Account uses essential authentication cookies to keep signed-in sessions secure. Inquiry consent records may include an IP address and browser user-agent for security and consent auditing; batch-verification scans may use the limited technical records described above for security and operational auditing. These records are not used for advertising.

How We Use Your Information

Information submitted through our forms is used solely to:

• Create and maintain your My Account profile.
• Communicate with you regarding your inquiry, order, or ongoing protocol.
• Maintain a record of your context for the purpose of providing continuity of service.
• Review and process portal order requests, arrange payment, and provide order and shipment updates.
• Send Friday News when you separately opt in to newsletter emails.
• Audit account creation, order review, and customer-service activity.

We do not use your information for marketing communications without your explicit consent. We do not sell, rent, trade, or share your personal information with any third party for commercial purposes.

Newsletter emails are sent through Resend. Each newsletter includes a preference or unsubscribe link, and you may also ask us directly to remove you from the list.

WhatsApp & LINE Communications

When you contact us or are contacted by us via WhatsApp or LINE, communications are subject to the privacy policy and terms of service of the relevant provider. Biohackr.Labs uses these channels for private client communication, support, and neutral order or shipment logistics only.

The public WhatsApp support button uses our existing manual WhatsApp Business support number. Separately, Biohackr.Labs may use a dedicated WhatsApp Business API number through 360dialog for CRM inbox handling, onboarding, service messages, approved templates, delivery state, and opt-out management. If you message or opt in to that API number, we may store your WhatsApp phone number, consent source and timestamp, message history, delivery or read status, template references, webhook audit events, and suppression records needed to operate the CRM inbox and respect opt-outs.

If you link LINE to My Account, we store the LINE user identifier, consent status, account-link audit events, and operational delivery records needed to manage logistics notifications and opt-outs. Marketing WhatsApp messages are sent only when you have separately opted in, and you can opt out at any time.

Form Submission Storage

Private inquiry submissions are stored in our Supabase database. An administrative notification is sent through Resend to our designated email address for review. The general Contact form is submitted to Netlify Forms for processing; its delivery routing depends on the current deployment configuration. My Account authentication and portal-accessible records are also hosted through Supabase. These providers process data on our behalf under their respective privacy and data-processing terms. We retain data only for as long as necessary to provide the service and meet legitimate record- keeping, security, and legal requirements.

Data Retention

We retain personal information for as long as you remain an active client or until you request deletion. If your inquiry does not result in an active client relationship, we will retain your submission for a reasonable period in case of follow-up, and then delete it. Verification-scan telemetry is currently retained for security and operational auditing without a fixed automated expiry; a documented retention period and purge control remain an operational requirement. You may request deletion of information associated with you through the contact routes below.

Your Rights

You have the right to request access to the personal information we hold about you, to request correction of any inaccurate data, and to request deletion of your information. To exercise any of these rights, contact us via the Contact page or directly on WhatsApp or LINE. We will respond to data requests within a reasonable timeframe.

Jurisdiction

Biohackr.Labs operates in Bangkok, Thailand. This privacy policy is governed by the laws of the Kingdom of Thailand. We endeavour to handle all personal data in a manner consistent with applicable data protection principles, including those under Thailand's Personal Data Protection Act (PDPA).