Privacy Policy

Who we are and how to reach us

Citadel Research LLC, a South Carolina limited liability company, operates citadelresearchlabs.com. This policy explains what personal information the website collects, why, who receives it, and how long we keep it.

Questions and privacy requests: support@citadelresearchlabs.com.

What we collect

When you place an order we collect your first and last name, email address, phone number, and US shipping address. The phone number is used only for delivery and order issues, never for marketing texts.

We also record your order (the items, quantities, prices and totals), a payment reference we generate for your Zelle memo, and, when we verify your payment, the confirmation reference and amount we received. When your order ships we record the carrier and tracking number.

At checkout we record the three acknowledgements you confirm (21 or older, research use only, and the Research Use Terms with the Refunds, Shipping and Privacy policies), the time you confirmed them, and the version and exact text of the Terms, Privacy Policy and acknowledgement wording shown at that moment. For security and fraud prevention we also store your browser's user-agent string and, when our network provider reports your address reliably, a one-way keyed hash of your IP address (never the address itself).

If you join the launch waitlist we collect your email address, the time you consented, and the version of the consent wording. If you contact us by email we keep the messages we exchange.

We do not collect payment-card numbers, bank-account numbers or logins, government ID numbers, health information, precise location, or biometric data, and the site does not ask for them.

How we use it

We use your information to process, verify, ship and support your order; to send you the transactional emails about it (order received, payment confirmed, order shipped, and, if you request one, cancellation or refund updates); to respond to your questions; to prevent fraud and abuse; and to keep the business, tax and accounting records we need.

We do not sell or share your personal information, and we do not use it for advertising or profiling. We do not send marketing text messages. Waitlist emails are sent only to people who signed up and are separate from order emails; each includes a way to unsubscribe.

Paying by Zelle

You pay for your order with Zelle through your own bank. The site shows you the amount, the recipient and a payment reference to include in your Zelle memo, and your bank handles the transfer. We never see or store your bank login or account credentials.

After you pay, we record the confirmation reference and the amount received in our order records so we can match the payment to your order.

Who receives your information (service providers)

We use the following providers to run the site. They process information on our behalf and receive only what they need to do that:

Cloudflare provides our network, security, hosting and private file storage (including the secure sign-in layer for our staff area); it sees technical request data such as IP address and browser type.

Neon hosts the database that holds our order, customer and waitlist records.

Google Workspace provides our support email, so the messages you send us are stored there.

Resend delivers our transactional order emails and receives your email address, name, and the order details in each message.

Shipping carriers (such as USPS, UPS or FedEx) receive your name, shipping address and, where required, phone number so they can deliver. If we later use a shipping-label service, it will receive the same delivery details and we will update this policy.

We may also disclose information when the law requires it or to protect our rights and the security of the site. We do not sell personal information.

Cookies and similar storage

The site uses only a few functional items. A cookie named cr_gate records that this browser confirmed the entry acknowledgements; it lasts 30 days and holds no personal information. Your shopping cart is kept in your browser's local storage (key cr_cart_v1) and never leaves your device until you check out. Our staff area uses a secure sign-in session cookie, and Cloudflare Access sets its own cookies on staff sign-in; neither applies to ordinary visitors.

We do not use advertising, analytics or cross-site tracking cookies, pixels or scripts, and we do not load third-party scripts or fonts.

Do Not Track

Because the site does not track you across other websites or online services, it does not change its behavior in response to a browser's Do Not Track signal. No other party collects personal information about your online activities over time and across sites through our site.

How long we keep information

We keep information only as long as we have a reason to, and we separate records we may need to retain from data that is purely operational.

Order, payment-reconciliation and checkout-acknowledgement records are kept for as long as needed for accounting, tax, legal and dispute purposes. We have not set a shorter period, and we will not delete these records on request while we need them for those purposes, but we will correct inaccurate details.

Security and audit records are kept for as long as needed for security, fraud prevention and to show what changed on an order.

Email delivery records: the message contents we queued for delivery (your name, address and items) are removed from our delivery queue 30 days after delivery or final failure, and internal notification logs are cleared after 30 days. Staff sign-in session records are removed 7 days after they expire.

Waitlist: we keep your email until you unsubscribe or ask us to delete it. After you unsubscribe we keep only a minimal record that you did, so we do not email you again, and you can ask us to erase the rest.

Support emails are kept while needed to answer you and to resolve any issue with your order.

Your choices and requests

To ask what we hold about you, to correct it, or to ask us to delete it where we are not required to keep it, email support@citadelresearchlabs.com with the subject "Privacy request" and your order number (or the email address you gave us). Please do not send passwords or payment details.

To protect you, we will confirm the request is yours before acting: we will ask you to reply from the email address on the order and confirm the order number and details only you would know. We aim to respond within 30 days, and we will tell you if we need more time or cannot fully act and why.

You can unsubscribe from the waitlist at any time using the link shown when you sign up and in every waitlist email. Privacy requests are handled by email, not through the public order or inquiry forms.

Security

We use reasonable safeguards: connections to the site use HTTPS; access to the staff area is protected by Cloudflare Access, a password and multi-factor authentication; customer order links are random and only a hash of each link is stored; private files are kept in private storage; and staff permissions are limited by role. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

If a security incident affects your personal information, we will notify you as the law requires.

Age

Citadel Research sells only to people 21 or older. This is our own policy. The site is not directed to children and we do not knowingly collect personal information from anyone under 13. If we learn that we have, we will delete it. If you believe a child has given us information, email us.

Changes to this policy

We may update this policy. The effective date and version are shown at the top of this page; the version shown to you at checkout is recorded with your order. If we make a material change to what we collect, we will update this page before the change takes effect.