Privacy Policy

1. Who we are

This Privacy Policy explains how Helix Aminos LLC (“Helix Aminos,” “we,” “us,” or “our”), a California limited liability company, collects, uses, and discloses information about you when you visit https://www.helix-aminos.com (the “Site”), create an account, or place orders.

• Legal entity: Helix Aminos LLC
• Mailing address: 211 S State College Blvd #1064, Anaheim, CA 92806, United States
• Privacy contact: support@helix-aminos.com

Research-use context. Helix Aminos supplies materials for laboratory and research use only, to verified researchers, with US-only fulfillment. Accounts and orders are research transactions; we collect only what we need to verify eligibility, fulfill orders, and operate the Site.

2. The information we collect

We practice data minimization — only what is operationally required for account management, eligibility, fulfillment, and payment reconciliation:

Information you provide:

• Account information — email address, first name, and (optionally) last name; a password, stored only as a salted cryptographic hash, never in plaintext.
• Eligibility attestation — at sign-up you confirm you are 21 or older; this is recorded with a timestamp and an audit event. (The verification gate is currently off in production, so age-21 is the attestation captured at sign-up. When the researcher-verification application is enabled, we additionally collect your researcher/account type, the affiliation/organization name you provide, and your research-use-only and eligibility attestations, stored immutably with a timestamp.)
• Shipping information — recipient name and US postal address for orders. Addresses are validated for deliverability (see §5).
• Order and communication information — the products and quantities you order, order history, and messages you send us.
• Marketing consent (if you opt in) — where you provide your email in exchange for a promotional/discount code, we record your email, the timestamp of consent, a hashed (irreversible) form of your IP address, and which code was issued. See the financial-incentive notice in §7a.

Information collected automatically:

• Limited first-party analytics — we use privacy-preserving, first-party, cookieless analytics (Vercel Web Analytics) to understand aggregate Site usage. We do not use third-party advertising pixels, cross-context behavioral-advertising trackers, or data-broker tags (no Meta Pixel, no Google Ads tags, no GA4).
• Security and audit logs — for account and order activity (account creation, verification/role changes, order operations, address changes, support inquiries) we record audit events that include the raw IP address and browser user-agent, used for fraud prevention, rate-limiting, and security.
• Fraud-prevention inferences — to detect abuse we generate and retain signals derived from your activity, including a normalized hash of your shipping address that can link accounts sharing an address, and related fraud flags.

Payment information. Helix Aminos does not collect or store full payment-card numbers. At launch, payments are handled through manual peer-to-peer rails (such as Zelle or Cash App) processed through your own bank or payment app; we retain only a payment reference/confirmation needed to reconcile your order. If card processing goes live in the future, card data will be handled by a PCI-compliant processor via a tokenized checkout and will not be stored on our servers.

Sensitive personal information (CPRA). We do not collect Social Security numbers, government IDs, precise geolocation, health information, financial-account numbers, or account credentials beyond your own login password. Because we do not collect sensitive personal information for purposes that trigger the CPRA “right to limit,” that right does not apply; if this changes, we will update this Policy and provide the required “Limit the Use of My Sensitive Personal Information” mechanism.

Children. The Site is intended only for persons 21 and older and is not directed to children. We do not knowingly collect information from anyone under 21.

3. How we use information

We use the information above to: create and manage your account and authenticate you; confirm eligibility and enforce access controls; process, fulfill, ship, and support your orders and deliver order and certificate-of-analysis communications; validate shipping addresses and detect and prevent fraud and abuse; reconcile payments and keep transaction records; operate, secure, debug, and improve the Site; send transactional emails and (where you opt in) occasional marketing emails; and comply with legal obligations and enforce our Terms.

4. How we disclose information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. This reflects the Site's current design: first-party cookieless analytics, no advertising networks or broker pixels, and vendors engaged only as contracted service providers. (If we ever add advertising technology that changes this, we will update this Policy and provide the required opt-out before doing so.)

We disclose personal information only to:

• Service providers / subprocessors who process it on our behalf under contract, for the purposes above (see §5);
• Payment recipients as needed to complete and reconcile your transaction;
• Legal / safety recipients when required by law, subpoena, or to protect the rights, property, or safety of Helix Aminos, our customers, or others; and
• Business transfers — a successor entity in a merger, acquisition, or sale of assets.

5. Service providers (subprocessors)

Each is contractually limited to processing information for our purposes.

6. Data retention

We keep personal information only as long as needed, then delete or de-identify it. Our standard periods:

• Account and profile information — for the life of your account; deleted on verified request, subject to the exceptions below.
• Order, payment-reference, and transaction records — retained at least 4 years (California’s limitations period for written contracts) and up to 7 years where needed for tax and accounting recordkeeping.
• Eligibility/verification attestations and audit/security logs — retained 4 years as compliance and fraud-prevention records.
• Address fraud-prevention signals — retained for the life of the account plus a reasonable period.
• Marketing-consent records — retained until you withdraw consent, plus a record of the withdrawal.
• Legacy data — some early accounts may still hold data no longer collected in the current flow (for example, a birthdate or prior research-affiliation fields). We retain these under the same account-life basis above, and you may request their deletion at any time (§7).

We may retain information longer where required by law or to resolve disputes and enforce agreements.

7. Your privacy rights (California — CCPA/CPRA)

If you are a California resident, you have the right to: know/access the categories and specific pieces of personal information we have collected; delete personal information we hold, subject to legal exceptions; correct inaccurate personal information; opt out of the sale or sharing of personal information (note: we do not sell or share personal information as defined by the CCPA/CPRA, so there is no sale or sharing to opt out of); and non-discrimination for exercising these rights.

How to exercise your rights. Email support@helix-aminos.com. We verify your request by confirming control of the account email associated with the information (and, for deletion or access of specific pieces, we may ask you to re-authenticate) before acting. You may use an authorized agent where permitted by law. We respond within the timeframes required by the CCPA/CPRA (generally 45 days, extendable once).

Global Privacy Control (GPC). We treat a GPC browser signal as a valid opt-out request. Because we do not sell or share personal information, a GPC signal has no sale/share to act on today; if that ever changes, we will honor GPC as an opt-out of sale/sharing.

7a. Notice of financial incentive (promo-code-for-email offer)

Where we offer a discount or promotional code in exchange for your email address and marketing consent (for example, a first-order discount code), this may be a “financial incentive” under the CCPA/CPRA. The material terms: you provide your email and consent to marketing; in return you receive the stated discount code. You may opt in by submitting the form and withdraw at any time by unsubscribing or emailing support@helix-aminos.com; withdrawal does not claw back a discount already applied.

Good-faith value estimate: we reasonably estimate the value of the personal information you provide (your email address) to be approximately equal to the value of the discount offered in exchange for it — e.g., a 10%-off first-order code represents both the incentive's cost to us and a reasonable proxy for the data's value. We calculate this using the expected discount redeemed against a typical first order; we do not otherwise assign a monetary value to your email. (Our current first-order code is 10% off, matching this estimate.)

8. Data security

We use reasonable administrative and technical safeguards, including encrypted transport (HTTPS), salted password hashing, hashed IP storage for marketing-capture records, role-based access controls, and audit logging on sensitive actions. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. Cookies and tracking

We use only the cookies/local storage necessary to operate the Site (for example, a signed session cookie to keep you signed in and associate your account-linked cart, and to record your age/research-access acknowledgment) and privacy-preserving, cookieless first-party analytics. We do not use third-party advertising or cross-site tracking cookies.

10. Changes to this policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Effective date” and, where appropriate, by additional notice on the Site.

11. Contact us

Questions or privacy requests: support@helix-aminos.com, or Helix Aminos LLC, 211 S State College Blvd #1064, Anaheim, CA 92806, United States.