Privacy policy

This policy explains what data we collect, why, how long we keep it, and what rights you have. It applies to this site and to orders placed through it.

1. Data controller

[BIZNESI: plotëso — registered name and registered address]

For any question about data: info@biocode.fit

2. What we collect

When you place an order: your name, email, phone number, delivery address and the items ordered. We need these to send the parcel and issue the invoice.

When you open an account: your email, password (stored hashed — we never see it), name and any addresses you save.

When you browse: the contents of your cart and wishlist, linked to your account or — if you are a guest — to an anonymous token stored in a cookie.

When you use the BioHack generator: your answers about health goals, diet, caffeine, medication and life stage, together with the generated protocol. These are stored so you can reopen the link later.

When you write a review or a message: the text, and the email and name you give.

Automatically: your IP address and request time, used only to limit abuse (repeated form submissions, for example). We do not use IP for profiling.

We do not collect card payment data. Payment is cash on delivery, to the courier.

3. Legal basis

• Performance of a contract — the order, delivery, invoice and returns.
• Legal obligation — retention of invoicing records under tax law.
• Consent — the email newsletter and analytics cookies. You may withdraw it at any time.
• Legitimate interest — site security and abuse limiting.

4. Cookies

We use essential cookies so the site works: your login session, the guest cart, and your cookie choice itself. These need no consent because without them the site does not function.

Analytics cookies do not load until you consent through the banner at the bottom of the page. If you choose "Only what is needed", no analytics script runs — it is not loaded at all, rather than loaded and unused.

5. Who we share it with

Only the providers we need in order to operate:

• Supabase — database and authentication (servers in the European Union).
• Vercel — site hosting.
• Resend — sending order emails and the newsletter.
• The courier — your name, address and phone number, for delivery only.

We do not sell personal data. We do not share it for advertising.

6. How long we keep it

• Order records: for the period tax law requires.
• Account: until you close it; after that only invoicing records remain.
• Guest cart: 30 days.
• Contact messages: 24 months.
• Newsletter: until you unsubscribe.

7. Your rights

Under Law No. 06/L-082 on Protection of Personal Data you have the right to:

• request a copy of the data we hold about you;
• correct it if it is inaccurate;
• request its deletion;
• withdraw consent;
• complain to the Information and Privacy Agency.

From your account page you can download a complete copy of your data yourself, at any time. For deletion, write to info@biocode.fit — we respond within 30 days.

Note that deletion does not remove invoicing records the law requires us to keep. Those are anonymised where possible.

8. Security

All connections are encrypted (HTTPS). Access to data is restricted at the database level, not only in the application. Passwords are stored hashed.

9. Children

This shop is not directed at people under 18 and we do not knowingly collect data from them.

10. Changes

The date of the last change is shown at the top of this page.