Privacy Policy

Hira Compounds is an individually owned business, independently owned and operated by a single proprietor. The owner alone decides what data is collected, why it is collected, and when it is deleted. There is no third party making those calls.

This policy covers hiracompound.com, the checkout on that site, and any email or phone contact about an order. It applies whether you browse, place an order, or just write in with a question.

Contact for anything on this page: Hira Compounds, 3100 Warehime Rd, Manchester, MD 21102, United States. Phone +1 (877) 940-3557. Email support@hiracompound.com. Hours are Monday to Friday, 9:00am to 6:00pm ET.

Everything in the catalog is a research-use-only reference compound, supplied to qualified researchers and institutions for in vitro laboratory research. Buyers must be 21 or older. These items are not drugs, supplements, cosmetics or food, and they have not been evaluated by the FDA.

That shapes this policy in one important way: no health information is requested, wanted, or stored. There is no intake form, no questionnaire, no medical history field anywhere on the site.

Please do not send medical records, clinical notes, symptoms, or other personal health details by email. If something like that arrives, it is deleted rather than filed, and no reply about it can be given.

Only what an order actually needs, plus basic traffic measurement. Here is the full list.

Nothing else is gathered in the background. There is no hidden profiling, no data bought in from brokers, and no attempt to link you to activity on other websites.

Payment is arranged separately from the order, by direct bank transfer. Orders are placed instantly and sit in Processing while that is arranged. The transfer happens inside your own banking app, so the order record holds only the amount, the date and the payment reference.

If you pay by direct bank transfer, your own bank generates its own record. What gets written against your order is the amount, the date and the reference, not your account credentials.

The sending account name shown on an incoming transfer is recorded against the order so the payment can be matched to it. That is the only banking detail retained, and it is held for the same period as the rest of the order record.

Also never collected: Social Security numbers, government ID numbers, date of birth beyond a yes-or-no age acknowledgment, biometric data, precise GPS location, health or medical information, and any special category of sensitive personal information.

No advertising or retargeting pixels are installed on this site, so there is no cross-site profile of you being built from your visit.

Every field has one job. If a purpose ends, the data supporting it is scheduled for deletion rather than kept in case it becomes useful later.

Data is never repurposed for something you would not expect. Order information is not fed into marketing tools, and support emails are not mined for sales leads.

The site uses a small set of cookies and browser local storage. Most of it exists so your cart survives a page change.

Analytics measurement is aggregate. It counts visits and page views; it is not used to identify you by name, and it is never combined with your order record.

You can block or clear cookies in your browser settings at any time. If you do, the cart empties and checkout will not remember what you selected, but the rest of the site still works. Where a Global Privacy Control signal is sent by your browser, it is honored.

A handful of service providers are needed to run an online catalog and get a parcel delivered. Each one receives the minimum needed to do its part, and none is permitted to use your information for its own marketing.

No data is shared with data brokers, list builders, or advertising networks under any circumstance.

Nothing is kept indefinitely. These are the standing retention periods.

When a period expires, the record is deleted or irreversibly anonymized. Backups roll off on their own schedule, so a deleted record can persist in an encrypted backup for up to 30 additional days before it is overwritten.

Every page and the entire checkout are served over HTTPS with current TLS, so what you type is encrypted in transit. Stored data sits on access-controlled hosting with encryption at rest and routine backups.

Administrative access to the store and its database belongs to the owner only, secured with a unique password and two-factor authentication. There is no shared login and no wider access list.

Protection here is structural as well as technical. Payment is arranged directly through the bank, app or wallet you choose, so those credentials live with that provider and never form part of the order record held here.

No system is perfectly secure, and no honest policy claims otherwise. If a breach ever affected your personal information, you would be notified by email without undue delay and within any deadline your state's breach-notification law sets, along with a plain description of what was exposed and what to do next.

Your personal information is not sold, rented, traded, licensed, or shared for cross-context behavioral advertising. Not for money, not for anything else, not now and not later. There is no mailing list being monetized behind the scenes.

Under California law this counts as neither a sale nor a share, so there is nothing for you to opt out of. The opt-out right still exists and is listed below; it simply has nothing to act on.

If this business were ever transferred to a new owner, buyers with records on file would be emailed before any transfer of data, with a clear window to request deletion first.

If you live in California, the CCPA as amended by the CPRA gives you specific rights over the information described above. All of them are honored, free of charge.

In CCPA terms, the categories collected are identifiers (name, address, email, phone), commercial information (order contents and history), and internet or network activity (analytics). No sensitive personal information is collected, so the right to limit its use has nothing to limit.

Requests are answered within 45 days, with one 45-day extension if a request is unusually complex, and you are told before any extension is used. Identity is verified by matching your request to an existing order and replying to the email address used at checkout, so requests are best sent from that address.

Exercising any of these rights never affects your prices, your access to the catalog, or the service you get.

Comprehensive privacy laws now cover residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky and Rhode Island, among others. Wherever a law like that applies to you, the same rights are honored: access, correction, deletion, a portable copy, and an opt out of targeted advertising, sale, or profiling with legal effects. None of those three activities happens here.

If a request is refused, you may appeal. Email support@hiracompound.com with the word Appeal in the subject line and a decision is returned in writing within 45 days, including the state attorney general contact if you still disagree.

If your state has no privacy statute at all, you are treated the same way anyway. One standard, applied to everyone, is easier to run and fairer to buyers.

Nothing here is sold to anyone under 21. The site is not directed at children or teenagers, and no information is knowingly collected from anyone under 21 years of age, which necessarily includes anyone under 13 covered by COPPA.

Every checkout requires an acknowledgment that the buyer is 21 or older and is acquiring the material for lawful in vitro laboratory research.

If it becomes clear that an order or an account belongs to someone under 21, the order is canceled and refunded, the account is closed, and the associated personal information is deleted. A parent or guardian who believes a minor submitted information can email support@hiracompound.com and it will be removed.

Email support@hiracompound.com with Privacy Request in the subject line. Include your full name, the email address used at checkout, and an order number if you have one. Say plainly what you want: a copy, a correction, deletion, or a full list of who received your data.

Sending the request from the email address on the order is the fastest route, since that is how identity is verified. If that address is no longer reachable, expect a couple of follow-up questions matching details only the buyer would know.

A first response goes out within 10 business days and the request is completed within 45 days. There is no fee, and no limit on reasonable requests.

Deletion removes everything except records US tax and shipping law requires be retained. Those are isolated, used for nothing else, and destroyed as soon as the retention period ends. You are told exactly what was kept and why.

You can also write to Hira Compounds, 3100 Warehime Rd, Manchester, MD 21102, United States, or call +1 (877) 940-3557 during business hours, Monday to Friday, 9:00am to 6:00pm ET. Written requests are still answered by email unless you ask for a mailed reply.

Transactional email is the default: order receipts, payment instructions, shipping and tracking notices, certificates of analysis, and replies to your own messages. These are part of the order and cannot be unsubscribed while an order is open, though they stop once it is closed.

Any occasional non-transactional email, such as a restock notice, requires you to opt in first and carries a one-click unsubscribe link in every message. Unsubscribing takes effect immediately and does not affect order updates.

Your email address is never passed to another sender or added to any external mailing list.

This policy is updated when practices change, not on a schedule and not silently. The revised version is posted on this page with a new date at the top.

If a change materially affects how existing data is used, anyone who placed an order in the previous 12 months is emailed before the change takes effect, with enough notice to request deletion first.

Older versions are available on request by emailing support@hiracompound.com. This policy was last updated on September 2, 2026.