Effective date: October 1, 2026
This policy explains what personal information TinyBac collects, why we collect it, who we share it with and the choices you have. TinyBac is operated by JNI BIOTECH LIMITED, RM 2702, 27/F, WU CHUNG HOUSE, 213 QUEEN’S RD EAST, WAN CHAI, HONG KONG.
Summary
- We collect what we need to sell and ship your order and to confirm that you are eligible to buy.
- If you leave checkout after providing your email, we may send one cart reminder with an unsubscribe link.
- We do not sell your personal information. We use Google Analytics, Microsoft Clarity, and HubSpot to understand visits and shopping activity; Google Analytics may also be linked to Google Ads where permitted.
- In the EEA, United Kingdom and Switzerland, Google Analytics, Microsoft Clarity, and HubSpot wait for your analytics choice; elsewhere they have no consent pop-up. A Global Privacy Control signal disables Clarity, HubSpot, and Google advertising signals.
- You can ask to see, correct or delete your information by emailing support@tinybac.com.
What we collect
When you enter the site. Your confirmation that you are 21 or older and visiting for laboratory research use. It is stored in a cookie on your device (see Cookies). It is not sent to us or to anyone else.
At checkout.
- Name, email address, shipping address, billing address and phone number.
- What you ordered, prices, taxes and shipping method.
- Your checkout confirmation (age, research use and acceptance of our Terms of Sale), with the date and time you gave it.
- Whether one cart reminder was sent, and whether you unsubscribed from future cart reminders.
- Payment information. You enter your card details into our payment provider's secure form. We receive only limited details back, such as card type, the last four digits, expiry date and the results of fraud and address checks. We never see or store your full card number.
If you create an account. Your name, email address, a password (stored only in scrambled, hashed form) and your order history.
When you contact us. Your messages and anything you attach.
Automatically. When you visit, our hosting and security providers log technical data such as IP address, browser type, device type, pages requested and times. We use it to run and protect the site.
Site analytics. Google Analytics receives public page paths, shopping step names, product identifiers and names, variants, quantities, prices, purchase amounts, tax, shipping and transaction IDs, an analytics cookie identifier, approximate location and device/browser information. We send only standard campaign parameters and click IDs, not other URL query values. Microsoft Clarity records interactions on selected public pages, together with technical device/browser information. Clarity is not loaded on account, cart, checkout, order-confirmation, admin, or other private pages. We do not intentionally send customer form entries, payment details, arbitrary URL parameters, or private-page paths to Clarity. Clarity's inputs and marked sensitive areas are masked. HubSpot receives page paths and visitor identifiers only on selected public pages with no query strings. Account, cart, checkout, order, and admin pages are excluded. In the EEA, United Kingdom and Switzerland, the analytics choice described below controls when these tools load.
We do not ask for government ID numbers.
How we use it
- To process, ship and support your order, including order and tracking emails.
- To confirm that you are eligible to buy, and to enforce our Terms of Sale and Research Use Policy.
- To prevent fraud, abuse and payment disputes.
- To contact buyers of a lot if there is a quality problem or recall.
- To keep records the law requires, such as tax and accounting records.
- To send one reminder if you entered your email during checkout and left an unpaid cart. The reminder includes a way to stop future cart reminders.
- To send other promotional email only if you sign up. Every promotional email has an unsubscribe link.
- To understand visits, shopping steps and purchases using Google Analytics, and support Google Ads attribution and audiences where permitted. In the EEA, United Kingdom and Switzerland, Google Analytics loads only after you allow analytics.
- To measure visits to selected public storefront pages using HubSpot. In the EEA, United Kingdom and Switzerland, HubSpot loads only after you allow analytics.
- To understand how visitors use selected public storefront pages using Microsoft Clarity. For visitors in the EEA, United Kingdom and Switzerland, Clarity is loaded only after they allow analytics. Visitors can change or withdraw that choice through analytics settings.
Who we share it with
We share personal information only with service providers that help us run the store, and only what each one needs.
| Service | Provider | What they receive |
|---|---|---|
| Payment processing | The payment provider displayed at checkout | Payment details, billing address, email and order amount |
| Website and store hosting | Cloudflare (storefront) and the store hosting provider | The data held in our store system, and site logs |
| Order, shipping and cart reminder email | Our configured email delivery provider | Name, email address and order details for order emails; email address and a cart-return link for a cart reminder |
| Shipping | USPS, and any other carrier named in your shipping email | Name, shipping address, and email or phone for delivery updates |
| Site analytics | Google Analytics (Google LLC) | Public page paths, shopping steps, product/amount data and purchase amounts/transaction IDs, an analytics cookie identifier, approximate location and device/browser information |
| Site analytics | HubSpot (HubSpot, Inc.) | Selected public page paths, visitor identifiers and technical browser information; no private page or query-bearing URL content |
| Site analytics | Microsoft Clarity (Microsoft Corporation) | Interactions and technical device/browser information from selected public storefront pages; no account, cart, checkout, confirmation, or admin page contents |
These providers may use your information only to provide their service to us. Our payment provider may also use payment data under its own privacy policy, for example to detect fraud.
We may also disclose information:
- when the law requires it, for example a valid subpoena or court order;
- to protect our rights, our customers or the public, including to investigate misuse of our product; and
- to a buyer or successor if our business is sold, on the terms of this policy.
We do not sell personal information. Google Analytics may be linked to Google Ads for campaign measurement and advertising features, subject to applicable choices and law. Microsoft Clarity is used for session recordings on selected public pages. Clarity is not loaded when the browser sends a Global Privacy Control signal. Google advertising signals and ad personalization are disabled when that signal is present.
Cookies
We use cookies needed to run the store. Google Analytics may set analytics and advertising cookies on measured pages. Microsoft Clarity and HubSpot may set cookies on selected public pages. In the EEA, United Kingdom and Switzerland, none of these tools loads until you allow analytics. We store that choice in browser local storage; declining or withdrawing it prevents both tools from loading and tells Clarity to deny analytics storage.
| Cookie | What it does | How long it lasts |
|---|---|---|
tb_age_ok |
Remembers that you confirmed you are 21 or older and visiting for research use, so the entry notice does not appear on every page | 30 days |
_medusa_cart_id |
Keeps your cart | 7 days |
_medusa_jwt |
Keeps you signed in to your account | 7 days, or until you sign out |
_medusa_pending_customer |
Holds your sign-up details while you confirm your email address | 1 day |
_medusa_cache_id |
Technical: helps the site show up-to-date pages | 1 day |
_medusa_locale |
Remembers your language setting | 1 year |
_ga and _ga_* |
Distinguish visits for Google Analytics on measured pages | Set by Google Analytics; you can remove them by clearing browser cookies |
_gcl_* |
Store Google Ads click information for campaign attribution when Google Ads is linked | Set by Google; you can remove them by clearing browser cookies |
hubspotutk and __hstc |
HubSpot visitor identification and page visit measurement on selected public pages | Set by HubSpot; you can remove them by clearing browser cookies |
_clck and _clsk |
Microsoft Clarity analytics identifiers and session continuity on selected public pages | Set by Clarity; you can remove them by clearing browser cookies |
The tb_analytics_consent browser local-storage entry remembers your analytics choice for the EEA, United Kingdom and Switzerland. It is not a cookie.
Our payment provider may set its own cookies on the checkout page to process payment and prevent fraud. Our hosting provider may set security cookies to block automated abuse.
If you block cookies, the entry notice will appear again and your cart will not work.
How long we keep it
- Order, payment, tax and checkout-confirmation records: as long as needed to meet tax, accounting and traceability obligations, for tax, accounting and lot traceability.
- Account information: until you ask us to delete your account. Order records are still kept for the period above.
- Support messages: as long as needed to resolve your request and related disputes.
- Server and security logs: as long as needed to maintain security and investigate incidents.
- The
tb_age_okcookie: 30 days, on your device. You can delete it at any time in your browser settings.
Your rights
Depending on where you live, state law may give you the right to:
- know what personal information we hold about you, and get a copy;
- correct it;
- delete it;
- opt out of the sale of your information, targeted advertising and certain profiling; and
- not be treated differently for using these rights.
We honor these requests from every customer in the United States, whichever state you live in.
How to ask. Email support@tinybac.com from the email address on your order or account. We may need to confirm your identity before we act. Someone you authorize can ask for you if they show proof of your permission.
Timing. We respond within 45 days. If we need more time, we will tell you why.
Appeals. If we deny your request, you can appeal by replying to our decision. If you still disagree, you can contact your state attorney general.
Global Privacy Control. When your browser sends a Global Privacy Control signal, our Google tag disables ad personalization. You can also email support@tinybac.com about your privacy choices.
We may need to keep some records, such as tax and order records, after a deletion request. If so, we will tell you.
Age
This site is for adults 21 and older. We do not knowingly collect personal information from anyone under 21. If we learn that we have, we delete it and cancel any open order.
Security
We use encrypted connections (HTTPS), limit staff access to what each person needs, and leave card data to our payment provider. No system is completely secure. If a breach affects your information, we will notify you as the law requires.
Where your information is processed
Our operator is registered in Hong Kong. Your information may be processed in Hong Kong and in the countries where our service providers operate, including the United States.
Changes to this policy
We may update this policy. When we do, we change the effective date at the top. For significant changes, we will also email customers or post a notice on the site.
Contact
Privacy questions or requests: support@tinybac.com
Mail: JNI BIOTECH LIMITED, RM 2702, 27/F, WU CHUNG HOUSE, 213 QUEEN’S RD EAST, WAN CHAI, HONG KONG