Privacy Policy.

The short version.

We use the details needed for orders, accounts and messages you send us. There are no advertising pixels and no third-party trackers on this site — nothing here reports to Google, Meta or an ad network. Visits are counted on our own server, with no cookie and nothing written to your device. The only cookies we set keep you signed in and remember your language. Nothing is sold or rented to anyone. If you use the chat, a functional token on your device lets you resume it; automatic replies use an AI service.

Who is responsible.

The controller for everything described here is YOUNGLAB, shipping from inside the European Union. Anything on this page: write to [email protected].

What we take, and why.

• To fulfil an order — name, email, phone, delivery address and any note you add, plus the vials, prices and payment method. Without them nothing can be shipped or confirmed. Legal basis: performance of the contract.
• If you open an account — email, name and a hashed password (we never see the password itself), so you can sign in and read your order history.
• Payment — for a card or PayPal link we see only what the provider reports on the payment; for crypto, the invoice, the address, the amount and the transaction hash. A card or PayPal payment happens on the provider's own page and returns to us as an outcome, never as card details: we never see or store a card number, because none is ever entered on this site.
• Server logs — the ordinary request records our server and Cloudflare keep, IP addresses included, used to keep the site up and block abuse. Legal basis: legitimate interest in a working, non-abused shop.
• Chat and contact enquiries — the text you send, the page you wrote from and, if supplied, your email for follow-up. We store the conversation to answer you. Automatic chat shares message text with the AI services described below. Legal basis: our legitimate interest in answering enquiries and, for order-related requests, steps to perform the contract.

Cookies.

We use functional cookies to keep you signed in and remember your language choice. If you use the chat, a random conversation token is stored in localStorage so you can resume it in the same browser; this is not an advertising or analytics identifier. Clear site data to remove it. Our visit counting does not use cookies or localStorage.

How we count visits.

We keep our own basic statistics — which pages are read and for how long, which link led here, roughly which country, phone or laptop. On top of that we record what people press while they browse — a search term, a product added to the cart, a checkout started, a click that leaves the site, a newsletter signup — each entry stored as an action name with the page it happened on, roughly where on the page it was pressed and when it happened, never as anything that identifies who pressed it. A shop that cannot see what visitors are looking for cannot improve at answering them. All of it runs on the same server as the shop: nothing reaches Google Analytics or any other company, and none of it leaves the European Union.

No cookie is set and nothing is written to your device, so there is nothing to consent to and nothing to clear. To separate one visit from another we store a one-way hash of your IP and browser mixed with a secret that rotates every midnight — it cannot be reversed into your address, and the same visitor yields a different value tomorrow, so the records cannot follow anyone across days. They delete automatically after 180 days. Legal basis: legitimate interest in a working shop, using the least identifying method we could build.

Who else touches it.

• Contabo GmbH — provides the server the shop and its database run on, located in France, within the EU.
• Cloudflare — sits in front of the site for security and speed, so requests travel through it.
• Resend — sends the order and account emails, so it processes your address and their contents.
• The carrier — receives the name and address on the parcel, and nothing about the contents beyond what the label legally requires.

Cloudflare and Resend are US companies. When you use automatic chat, your message text and recent conversation are sent through OpenRouter to the configured AI provider (currently DeepSeek) to generate a reply. Do not send medical information, passwords or payment details in chat. Your optional email is stored separately for our team to follow up and is not included as an email field in AI requests. These services may process data outside the EU. We do not sell your data to advertisers or data brokers.

How long it is kept.

Orders and invoices stay as long as accounting law requires. Account data stays until you ask for deletion. Server logs rotate away within weeks. Chat and contact messages are kept to handle your enquiry and follow-up. Contact us to request their deletion; clearing browser storage removes only your local chat token, not the messages stored on our server.

Your rights.

Under the GDPR you can request a copy of your data, have it corrected or deleted, restrict or object to its use, and receive it in portable form. Write to [email protected] and you have an answer within one month. If you believe we have handled it badly, you can complain to the data protection authority in your country.

One limit, plainly: deleting an account does not remove an order we are legally required to keep on file.