This policy explains what data Norwood Labs Ltd collects, why, and what we do with it. We also explain how website analytics and session recording work.
Who we are
Norwood Labs Ltd supplies research compounds with published laboratory data. For anything privacy related, write to support@norwoodlabs.co.uk.
What we collect
- When you place an order: your name, email address, phone number (if provided), shipping address, order contents and payment status.
- When you join the launch list: your email address.
- When you use the site chat: the conversation, a session identifier, the page and referrer, browser information and a hashed IP address. We do not store your raw IP address in the chat record.
- When you browse: page views, interactions, device and browser information, and a pseudonymous visitor identifier for analytics.
What we never see
We never see or store your card details. Card payments are handled entirely off-site by our payment processor, SpicePay. It receives your card data; our systems receive payment status and transaction details, not your card number.
How we use it
- To fulfil and dispatch your order and send order and dispatch confirmations.
- To answer support enquiries and retain chat conversations so we can follow up on them.
- To send the single launch email, if you joined the launch list.
- To measure site use, checkout events and heatmaps with PostHog and enable masked session recording.
Who we share it with
We use a small set of processors, each limited to what it needs:
- SpicePay, for hosted card payments; Fena, when you choose UK pay by bank. Manual bank transfers are handled directly by our bank. The selected provider receives the details needed to process or match your payment.
- Supabase, to store orders, waitlist entries, chat transcripts and interaction records.
- DeepSeek, to generate replies when you use the site chat. Your chat messages and relevant order information you choose to provide are sent to this provider; please do not enter sensitive information in chat.
- Resend, to send transactional and confirmation emails.
- Cloudflare, to host and protect the website.
- PostHog (EU endpoint), to measure website interactions and heatmaps and record masked sessions.
We do not sell or rent your data, and we do not run a marketing list. The launch list sends exactly one message.
How long we keep it
Order data is kept for as long as required for accounting and support. Launch list emails are stored until the launch email has been sent. Chat transcripts and interaction records are kept for customer support and audit purposes; ask us to access or erase them, subject to any legal retention requirement. We do not currently apply automatic deletion to chat records.
Cookies and analytics
We use first-party browser storage for the basket, and language preference. Checkout contact and address fields are saved automatically in this tab's session storage so you can refresh or return from a payment provider without retyping them. The draft is removed when an order is confirmed, or when you use “Not you? Clear details”; closing the tab ends the session. We do not save checkout contact or address details in persistent browser storage. Older persistent checkout details are removed when checkout is opened. PostHog stores a pseudonymous browser identifier and collects page views, interactions, heatmaps and masked session recordings for every visitor. Inputs and selected personal details are masked, but masking cannot guarantee that every detail is removed. We do not use advertising cookies.
We identify signed-in customers in analytics by a pseudonymous hash of their email, not their email address. You can restrict analytics storage through your browser settings.
Your rights
Under UK data protection law you can ask us to access, correct, or delete the data we hold about you. Write to support@norwoodlabs.co.uk with your request. You can also ask about objecting to analytics processing.
Changes
If we change this policy we will update the date above. Material changes will be reflected here.