Scope
This Privacy Policy explains how Astral handles personal information when you visit the site, create or use an account, submit an order, contact support, participate in account programs, or interact with Astral email. It does not govern a third-party site after you leave Astral.
Information Astral collects
Account and eligibility information
This can include your name, email address, date of birth, stated research role, authentication identifiers, age and research-use confirmations, profile details, and communication preferences.
Order and delivery information
This can include cart and order contents, dosage and quantity, recipient name, phone number, delivery address, selected shipping service, discounts, rewards, referral attribution, payment status, provider references, shipment status, and tracking records.
Communications
Astral keeps the information you send through contact forms, support tickets, replies, account requests, and program applications, together with message text, addressing, delivery status, and attachment metadata needed to route and answer them. Astral’s application email archive does not store provider HTML or the contents of email attachments. Do not include confidential research or unnecessary sensitive information.
Technical information
The site and its providers can process IP address, browser and device details, request and security logs, timestamps, cookie or browser-storage identifiers, and activity needed to operate, protect, and troubleshoot the service.
How Astral uses information
Astral uses personal information to authenticate accounts, enforce age and researcher-access requirements, price and record orders, deliver and track shipments, maintain account history, operate rewards and referrals, answer support requests, and send service messages.
Information is also used to secure and maintain the service, prevent fraud and misuse, investigate errors, reconcile provider records, respect communication preferences, comply with applicable obligations, and establish or respond to legal claims. Marketing email is sent only under the preferences recorded for the account.
Hosted payment boundary
When Card or PayPal is offered, checkout continues on a hosted WooCommerce and PayPal surface. Payment credentials, including a full card number and security code, are entered there and are not collected or stored by the Astral storefront.
Astral and its owned checkout systems retain the order, amount and currency, payment and funding status, provider order and capture identifiers, capture time, and a limited payer summary such as a provider payer ID, name, or email when PayPal returns it. Astral does not receive or store full card numbers, card security codes, or other raw payment credentials. WooCommerce and PayPal also handle information under their own privacy practices.
Service providers and systems
Astral uses the following providers and systems for the functions described. They receive the information needed to perform those functions.
- Clerk
- Account authentication, session management, identity verification, and account metadata.
- Vercel
- Website hosting, serverless request handling, delivery, and operational logging.
- Google Analytics
- Optional, consent-based measurement of catalog, product, certificate, checkout, and confirmed-purchase activity. Google Analytics does not load unless you accept analytics in Privacy choices.
- Neon
- Application database hosting for customer, order, inventory, account-program, support, and audit records.
- Resend
- Delivery and receipt of operational, support, and consented marketing email, including delivery-status records.
- WooCommerce and PayPal
- Hosted order and payment processing when that checkout option is offered, including the contact, delivery, order, and payment information needed for the transaction.
- Shippo
- Shipping-label purchase, carrier tracking, shipment updates, and the recipient information needed to provide those services.
Astral may also disclose information when required by law, to protect the service or people, to address fraud or security, or as part of a business transaction subject to appropriate handling of the records.
Astral does not sell personal information for money.
Cookies and browser storage
Astral and Clerk use cookies or similar session technologies for sign-in and security. Astral uses first-party browser storage for functions such as the age confirmation, cart, checkout continuity, interface preferences, and local review mode.
A first-party referral cookie can be set when you follow a partner link so an eligible order can be attributed to that partner. Browser controls can clear or block storage, but doing so can prevent sign-in, cart, referral, or checkout features from working as intended.
Google Analytics is optional and remains off until you choose Accept analytics. You can review or change that choice through the Privacy choices control in the site footer. Declining analytics does not disable account, cart, checkout, or security functions.
Astral does not currently change site behavior in response to browser Do Not Track signals. You can still use browser controls to manage cookies and local storage as described above.
Retention
Astral currently keeps account and eligibility information; saved delivery addresses and communication preferences; order, payment-status and provider-reference records; shipment and tracking records; discount, rewards and referral records; support tickets and plain-text email records; applications; and security, reconciliation and audit records. These records support account operation, order fulfillment, customer support, fraud prevention, business recordkeeping, disputes, and applicable legal obligations.
Astral’s application database does not store account passwords, full card numbers, card security codes, or other raw payment credentials. Authentication and hosted-payment providers process those details under their own policies. The email archive stores message text, addressing and delivery information, and attachment metadata, but not provider HTML or the contents of email attachments.
Astral does not currently apply a fixed automatic deletion period to durable account, order, shipment, payment-reference, support, email, rewards, referral, application, security, audit, or published-policy records. Verified access, correction, or deletion requests are reviewed individually. Some records may be retained when needed for transactions, accounting, security, fraud prevention, disputes, record integrity, or legal obligations.
Prepared checkout data remains available for six hours, checkout cookies last up to 24 hours, and an unpaid order reservation is canceled after 24 hours without erasing its order record. Mailing audience previews expire after 15 minutes, obsolete rate-limit records are periodically removed, and the referral cookie defaults to 30 days. Other first-party browser storage remains until it is cleared, overwritten, or removed through browser controls or a completed workflow. Provider logs, backups, and copies follow each provider’s retention schedule.
Your choices and requests
Account controls can update certain profile details, saved addresses, security settings, and communication preferences. Marketing messages include an unsubscribe control. Browser settings can manage cookies and local storage.
You may contact Astral to ask about access, correction, deletion, or another privacy right available where you live. Astral may need to verify your identity and will respond under the rules that apply to the request.
Security and age restriction
Astral uses administrative and technical controls designed to protect personal information, including authenticated access and restricted server-side credentials. No storage or transmission method is completely secure.
The site is intended only for adults age 21 or older. If you believe a person under 21 submitted personal information, contact Astral Support.
Changes to this Policy
Astral may update this Policy as the service and its data practices change. The effective date at the top identifies the current version.
Contact
Privacy questions and requests can be sent through Astral Support.
Contact support