Privacy Policy

Who we are

celloralabs.com is operated by Bio Recode LLC, 23 Emmons St, Long Branch, NJ 07740 (“Cellora”, “we”, “us”). You can reach us at support@celloralabs.com. This policy covers celloralabs.com, its subdomains (including Cellora Club at club.celloralabs.com), and the emails we send.

At a glance

• We collect what you give us when you shop, make an account, sign up for emails, write a review or send us a video, plus how you use the site.
• Card details are entered on Stripe’s secure checkout page and never reach us.
• We use advertising and analytics tags from Google (and, when switched on, Meta and TikTok) to measure and show our ads. You can turn these off at any time with Your Privacy Choices at the foot of every page, and we honour the Global Privacy Control signal from your browser.
• We do not sell your personal information for money.

What we collect, and where it comes from

From you, when you:

• Place an order: your name, email, shipping address, phone number if you give it, what you bought, any discount code, and the order total. Payment is taken by Stripe on its checkout page (including Link, Stripe’s saved-payment option). We receive confirmation that you paid, the card brand and last four digits, and a link to your receipt, never your full card number.
• Make an account: your first and last name, email address and a password (we store only a one-way scrambled version, never the password itself). You can also add a date of birth, a phone number and saved addresses. Your date of birth is optional; we keep it on your account and do not use it for anything else today. You can change or remove any of these in your account at any time.
• Sign up for emails or our offer: your email address and where you signed up (for example the sign-up pop-up or the quiz).
• Write a review: your name, email, star rating, review text, an optional photo and location, and whether you bought the product from us (“Verified buyer”). Your name, rating, review, photo and location may be shown on the site; your email never is.
• Enter a draw or send us a video (Review to win, Get featured): your name, email, social media handle, the link to your video, the product, and your permission to feature it.
• Join Cellora Club (our creator program at club.celloralabs.com): your first and last name, date of birth (to confirm you are 18 or over), email, phone number, the social media handles you give us, an optional short bio, and a record of what you agreed to (the Creator Program Terms, our use of your photos and videos, and showing your name, handle and likeness), with the date and the version of the wording. When you share content we keep the photos, videos, links, reviews and text you send, and our decision on each. We keep your points and the rewards you redeem.
• Earn from referrals (optional, in Club): your referral code and link, the visits and orders that came through them, the commission on each, the payouts we make, and how you would like to be paid. Payout details are stored encrypted and shown only to the Cellora owners who pay you. Before paying $600 or more in a year we may ask for tax information (such as a Form W-9), as US tax rules require.
• Email us: what you write and your contact details.

Automatically, when you visit:

• Site activity: the pages you view, products you look at, what you add to your bag, starting checkout and purchases, the site or ad that brought you (including campaign tags and ad click identifiers such as Google’s gclid or Meta’s fbclid), which version of a page you saw, and a random visitor id kept in your browser. Our own activity records do not store your IP address or name.
• Country: worked out from your connection at our hosting provider’s edge, kept as a two-letter code for a day, to show the right cookie notice.
• Technical data your browser sends with every request, such as IP address, browser type and device, which our hosting provider keeps in short-term logs for security and reliability.
• Email activity: whether our emails are delivered, opened and which links are clicked.
• Cookies and similar technology from Cellora and our advertising and analytics partners, described below.

From partners: confirmation of payment from Stripe, and shipping and tracking updates from our fulfilment partners. If our on-site assistant (the concierge) is available, it keeps a record of your conversation and a short profile (first name if given, the hair or skin concerns and goals you describe, hair or skin type, ingredient sensitivities you mention, and products discussed) with a device identifier in your browser. It is built not to keep what you say about pregnancy, nursing, medication or a medical condition. Conversation records are deleted 180 days after the conversation and the profile 180 days after your last visit.

How we use it

• To take, pack, ship and support your order, send order and shipping emails, and handle returns, refunds and our 30-day guarantee.
• To run your account: sign-in, order history, saved details, password resets and email-change codes.
• To send marketing emails you signed up for, with an unsubscribe link in every one.
• To show reviews and featured customer videos you gave us permission to use, and to run the draws you enter.
• To run Cellora Club: your membership, reviewing what you share, adding points and rewards, paying referral commission if you switch it on, preventing self-referral and other misuse, and featuring approved content (with your name or handle) on celloralabs.com, Looks Diary, Cellora’s social pages and ads, as you agreed when you joined.
• To understand how the site is used and improve it, including testing two versions of a page.
• To measure our advertising and show Cellora ads to people who may be interested, including people who have visited our site (see “Advertising”).
• To keep the site and our customers safe, prevent fraud and misuse, and meet our legal, tax and accounting obligations.

Advertising and analytics

Google. We use the Google tag (Google Ads) and Google Tag Manager, which loads Google Analytics and other tags we choose. Google receives the pages you view, actions such as purchases, cookie identifiers and your IP address. When you buy, we send Google the order total and the products, and your email address in a scrambled (hashed) form so Google can match the purchase to an ad you saw (“enhanced conversions”). Google Analytics data is kept for 14 months.

Meta and TikTok. When we switch on the Meta pixel or the TikTok pixel, they receive the pages you view, actions such as adding to your bag and purchases, cookie identifiers and your IP address, and use them to measure and show Cellora ads on their platforms. Meta or TikTok can link this to your account with them.

Your choice. In the United States these tags are on by default and you can turn them off at any time with Your Privacy Choices at the foot of every page (choose “Turn off”). If your browser sends the Global Privacy Control signal, we treat it as turning them off, and our own visit counts stop too. In the European Economic Area, the United Kingdom and Switzerland, Google’s tags set no cookies and are not used for ad personalisation, and the Meta and TikTok pixels and our own visit counts do not run, until you choose “Accept”; the same applies to our own tags when we cannot tell where you are. We tell Google about your choice through Google’s consent mode. You can also change ad settings in your Google, Facebook, Instagram or TikTok account, or block cookies in your browser.

Cookies and browser storage

These are the cookies and browser storage the site uses. Partner cookies are set only when the matching tag is allowed to run.

Fonts load from Google Fonts, which receives your IP address with that request.

Who we share it with

We share personal information only as needed to run Cellora, with:

• Service providers who work on our behalf and may use it only for that work: Stripe (payments and receipts), our fulfilment partner and ShipStation (packing and shipping), shipping carriers (delivery), Vercel (website hosting, and storage for images and the photos and videos Club members upload), Neon (our database), Resend (sending email), Microsoft (our support mailbox), Cloudflare (our domain), and the provider of the concierge when it is available. The concierge’s AI service processes your conversation to reply and does not use it to train its models.
• Advertising and analytics partners (Google, and Meta and TikTok when switched on), as described above.
• Others when required: to follow the law or a valid legal request, to protect our rights, customers or the public, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.

Sale and sharing. We do not sell personal information for money. Letting Google, Meta or TikTok receive information through their tags to show you ads based on your visit counts as “sharing” for cross-context behavioural advertising under California law, and may count as a “sale” or “targeted advertising” under other state laws. In the past 12 months the categories involved were identifiers (cookie ids, IP address, hashed email at purchase), commercial information (purchases) and internet activity on our site. You can opt out at any time with Your Privacy Choices or the Global Privacy Control signal. We do not knowingly sell or share the information of anyone under 16.

How long we keep it

• Order records: as long as tax and accounting rules require.
• Your account and saved details: until you ask us to delete your account.
• Email sign-ups: until you unsubscribe; we then keep your address on a do-not-email list so we honour that choice.
• Reviews and featured videos: while they are shown on the site, or until you ask us to remove them.
• Cellora Club: your membership details while you are a member; content you shared and the permissions you gave, while we use it and for as long as we need a record of your permission; commission and payout records as long as tax and accounting rules require.
• Our site activity records: for as long as they help us understand how the shop is used. Google Analytics: 14 months.
• Concierge conversations and profiles: as described above (180 days).

Security

The site runs over an encrypted connection, passwords are stored only in scrambled form, sign-in is protected against repeated guessing, and card payments happen on Stripe’s page. Access to customer records is limited to the people who need it. No system is perfectly secure, so please keep your password private and tell us at support@celloralabs.com if you think your account has been used without you.

Your privacy rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it;
• delete it;
• stop using it for marketing (use the unsubscribe link in any email, or contact us);
• opt out of the sharing, sale or targeted advertising described above (use Your Privacy Choices or the Global Privacy Control signal).

You can update most of your details yourself in your account. For anything else, email support@celloralabs.com with the request and the email address you use with us. To protect you, we confirm the request comes from you, usually by matching your email and an order or account detail. You can use an authorised agent; we will ask for your signed permission and may confirm your identity directly. We answer within 45 days (we may extend this once by 45 days and will tell you why). We will not treat you differently, or charge you more, for using your rights.

California. California residents have the rights above under the CCPA, including the right to know the categories and specific pieces of personal information we collect, the sources, our purposes and the categories of recipients (all set out in this policy), the right to correct and delete it, and the right to opt out of sale and sharing. We collect account sign-in details (email and password) only to let you sign in, and we do not use any sensitive personal information to infer characteristics about you. We do not share personal information with third parties for their own direct marketing.

Other US states. Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with privacy laws have similar rights to access, correct, delete and get a copy of their data, and to opt out of targeted advertising and sale. If we decline your request, you can appeal by replying to our answer with “Appeal” in the subject; we will respond within the time your state allows (45 or 60 days) and explain how to contact your state attorney general if you disagree.

Nevada. We do not sell covered information as Nevada law defines it. You can still ask us not to by emailing support@celloralabs.com.

European Economic Area, United Kingdom and Switzerland. We use your information to perform our contract with you (orders and your account), with your consent (marketing emails, and cookies beyond those the site needs), for our legitimate interests (running and improving the shop, preventing fraud, and featuring reviews you send us), and to meet legal obligations. You can withdraw consent at any time, object to our use of your information, ask us to restrict it or move it to another provider, and complain to your local data protection authority. We are based in the United States and your information is processed there; where the law requires, our providers protect transfers with the European Commission’s standard contractual clauses or an equivalent safeguard.

Emails

Order, shipping, refund and account emails are part of your order or account and are sent even if you do not get marketing emails. Marketing emails go only to people who signed up, and every one has an unsubscribe link that works straight away. Our emails record whether they are opened and which links are clicked so we can tell what is useful.

Children

Cellora is for adults. The site is not intended for anyone under 16 and we do not knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

When this policy changes we update the date at the top. If a change is significant, we will also tell you on the site or by email before it takes effect.

Contact

Bio Recode LLC, 23 Emmons St, Long Branch, NJ 07740. Email support@celloralabs.com.

Your Privacy Choices