Privacy Policy

Effective Date: August 3, 2026  |  Last Updated: August 3, 2026

This Privacy Policy explains how Unplastic Labs LLC, a North Carolina limited liability company ("Unplastic Labs," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you visit unplasticlabs.com, purchase a membership, complete onboarding, use the member portal, receive communications, participate in research planning, or otherwise interact with our services (collectively, the "Platform").

This Policy is a notice about our data practices. It does not create consent where consent is legally required. When consent or an affirmative choice is required, we request it separately, such as through our cookie controls or SMS onboarding choices. This Policy should be read together with our Terms and Conditions, available at unplasticlabs.com/terms.

Privacy at a Glance

We do not sell your personal information for money. Community ideas, research questions, and voting activity are not used for advertising. You control optional advertising cookies and promotional texts, and declining those optional choices does not affect your membership.

This summary is provided for convenience. The full Privacy Policy below explains our practices in detail.

1. Scope

This Policy applies to personal information processed by Unplastic Labs through the Platform. It does not govern the independent practices of third-party websites, applications, payment providers, laboratories, or other services that maintain their own privacy policies, except to the extent that Unplastic Labs receives or controls information from them.

2. Personal Information We Collect

2.1 Information You Provide

Depending on how you interact with us, you may provide:

  • Identity and contact information, including your first and last name, email address, and mobile phone number.

  • Membership and account information, including your membership tier, account identifier, onboarding status, and information used to authenticate or secure your account.

  • Optional research-interest information, including research questions, products, contaminants, exposures, or other topics you would like us to consider.

  • Community participation information, including study votes, community ideas, product or contaminant suggestions, survey responses, and related submissions.

  • Communications, including support requests, refund requests, legal or privacy requests, and messages you send to the Unplastic Labs team.

  • Communication choices, including promotional SMS selections, email preferences, and later opt-out or revocation requests.

2.2 Purchase, Payment, and Refund Information

Stripe or another payment provider processes payment information on our behalf. We do not receive or store your full payment-card number or card security code. The payment provider may collect information such as your name, email address, phone number, billing information, and payment credentials under its own privacy policy.

We may receive or access transaction information such as the amount paid, membership tier, payment and checkout status, checkout-session identifier, currency, payment method type, billing country, limited card details such as card brand and last four digits, refund status, dispute or chargeback information, and transaction timestamps.

2.3 Consent, Preference, and Compliance Records

We maintain records of communication choices and the disclosures presented during onboarding. These records may include:

  • The communication channel and purpose.

  • Whether consent was granted, denied, or later revoked.

  • The option selected.

  • The disclosure text and version presented.

  • The date and time of the choice.

  • The source page or URL.

  • IP address and browser or user-agent information.

  • Member, phone, email, and Stripe Checkout Session identifiers.

  • Technical metadata and idempotency information used to prevent duplicate records.

We use these records to honor your choices, maintain suppression records, document compliance, investigate disputes, and prevent duplicate processing. Checkout and transaction records may also contain acceptance indicators associated with terms or disclosures presented by the payment provider.

2.4 Information Collected Automatically

When you use the Platform, we and our service providers may automatically collect:

  • IP address and approximate location derived from the IP address.

  • Browser type, device type, operating system, language, screen or device settings, and user-agent information.

  • Pages viewed, links clicked, referring and exit pages, dates and times, session activity, and interactions with the Platform.

  • Authentication, security, error, diagnostic, and server logs.

  • Information used for bot detection and abuse prevention, including verification tokens and associated technical data.

  • Cookie identifiers, advertising identifiers, and attribution information, including Meta fbp or fbc identifiers when applicable.

2.5 Information From Service Providers and Other Sources

We may receive information from payment processors, hosting and authentication providers, email and messaging providers, security services, analytics and advertising services, and other vendors that help us operate the Platform. For example, we may receive a completed-purchase event from Stripe, authentication information from Supabase, or attribution information associated with an advertisement.

3. How We Use Personal Information

We may use personal information to:

  • Create, authenticate, secure, maintain, and support member accounts.

  • Process purchases, refunds, disputes, and related financial administration.

  • Complete onboarding and maintain accurate membership records.

  • Deliver The Signal, research-season information, login links, receipts, voting opportunities, security notices, service changes, and other requested membership services.

  • Send promotional email or text messages when permitted by law and, where required, based on your separate affirmative choice.

  • Record, honor, and demonstrate communication preferences, consent decisions, and opt-out requests.

  • Collect and consider votes, suggestions, messages, and community research interests when planning studies and operating the member portal.

  • Respond to questions, support requests, refund requests, privacy requests, and legal matters.

  • Operate, maintain, troubleshoot, protect, and improve the Platform and member experience.

  • Measure advertising performance, attribute completed memberships, and improve outreach, subject to your cookie choices and applicable law.

  • Detect, investigate, and prevent fraud, abuse, security incidents, unauthorized access, and violations of our Terms.

  • Comply with legal, tax, accounting, regulatory, and recordkeeping obligations and establish, exercise, or defend legal claims.

  • Create aggregated or de-identified information that is not reasonably linked to an identifiable person.

We do not use personal information to make automated decisions that produce legal or similarly significant effects concerning you.

4. Optional Research-Interest Information

Research questions, community ideas, messages, and other research-interest submissions are optional. We use this information to understand community priorities, consider possible studies, respond to messages, and operate the member portal.

We do not use research-interest submissions, community ideas, votes, or messages to the team for targeted advertising, and we do not send them to Meta.

We do not ask you to provide medical records, diagnoses, symptoms, treatment information, payment-card information, government identification numbers, account passwords, or other highly sensitive personal information through free-text fields. Please do not include that information in your submissions. If we receive sensitive information that is not reasonably necessary, we may delete or de-identify it.

5. Email and Text Communications

5.1 Account and Service Emails

We may send emails reasonably related to your purchase, account, login, onboarding, refund, research-season administration, voting, security, The Signal, service changes, and other membership services. These communications are part of providing the services you requested.

We may also send promotional emails as permitted by applicable law. Promotional emails include an unsubscribe method. Unsubscribing from promotional email does not necessarily stop transactional, account, security, legal, or other service-related email.

5.2 Current-Season Informational Text Messages

When you submit a mobile number during onboarding, we use that number to deliver The Signal when it publishes and to reach you if the lab finds something urgent that cannot wait. You may reply STOP at any time or email support@unplasticlabs.com to opt out. Opting out of text messages does not end your membership or prevent delivery through email or the member portal.

5.3 Optional Promotional Text Messages

If you separately select "Yes, text me when the next season opens," you agree to receive recurring automated marketing texts from Unplastic Labs at the number you provided about new seasons and ways to stay involved. Message frequency varies. Promotional-text consent is not required to purchase or maintain a membership. Message and data rates may apply. Reply STOP to opt out or HELP for help. You may also contact support@unplasticlabs.com.

Agreeing to our Terms or providing a number for current-season informational messages does not, by itself, enroll you in promotional text messages.

5.4 Communication Preferences and Opt-Out Records

We retain records of SMS choices, email preferences, and opt-out requests as reasonably necessary to honor your preferences, maintain suppression lists, and document compliance. We may send a one-time confirmation that an SMS opt-out was processed.

We do not sell mobile numbers or SMS consent data, and we do not share them with third parties or affiliates for their own marketing or promotional purposes. We may provide them to messaging vendors, telecommunications carriers, and other service providers that process communications on our behalf.

6. Cookies, Analytics, and Advertising Measurement

6.1 Types of Technologies We Use

The Platform may use cookies, pixels, local storage, and similar technologies for the following purposes:

  • Essential technologies needed for account authentication, security, checkout, cookie preferences, and core Platform functions.

  • Analytics technologies that help us understand traffic, performance, and how the Platform is used.

  • Advertising technologies that help us attribute memberships to advertising, measure campaign performance, and improve advertising.

6.2 Cookie Choices

Our public website provides controls to accept, decline, or manage optional analytics and advertising technologies. If you decline optional cookies, we use essential technologies only. You may later review or change your choices through the Cookie Preferences control on our website. You may also control cookies through your browser, although disabling essential technologies may affect Platform functions.

Where supported by our systems and required by applicable law, we treat a recognized opt-out preference signal, including Global Privacy Control, as an instruction not to use or disclose information for covered advertising purposes.

6.3 Meta Pixel

We use the Meta Pixel, provided by Meta Platforms, Inc., for advertising measurement. The browser-based Meta Pixel is treated as a nonessential advertising technology and is allowed to operate only when your cookie preferences permit advertising technologies.

When active, the Pixel may collect page and event information and may use identifiers such as fbp and, when you arrive through a Meta advertisement, fbc. This helps us understand whether advertising led to a visit or membership and may support advertising audiences.

6.4 Consent-Gated Meta Conversions API

When a membership purchase is completed, we may send a Purchase event to Meta through a server-to-server tool commonly called the Conversions API, but only when the consent and attribution signal passed from our website indicates that advertising measurement is permitted.

If you decline optional advertising cookies, have not provided the applicable consent signal, withdraw that consent before proceeding to checkout, or enable Global Privacy Control, our current system is designed to suppress the server-side Purchase event. Payment processing, account creation, and membership access continue because those are necessary service functions and do not depend on advertising consent.

When permitted, the event may include:

Purchase information, such as membership tier, amount, currency, event time, and transaction or event identifiers.

Customer identifiers, such as email address, phone number, first and last name, and an internal member identifier. These identifiers are normalized and transformed using a one-way SHA-256 hashing process before transmission.

Meta attribution identifiers such as fbp and fbc, when available. These technical identifiers are transmitted in their native format because Meta uses them for attribution matching.

We do not send study votes, community ideas, research questions, or messages to the team to Meta. Meta processes information under its own terms and privacy policies.

6.5 Advertising Privacy Choices

We do not sell personal information for money. Some privacy laws may define certain advertising disclosures, including use of the Meta Pixel or Conversions API, as "sharing," "sale," or processing for targeted advertising even when no money is exchanged.

Where applicable law gives you the right to opt out of that processing, you may use our Cookie Preferences control, submit a recognized opt-out preference signal, or email legal@unplasticlabs.com. We will apply verified requests and recognized signals to covered processing as required by applicable law.

7. How We Disclose Personal Information

7.1 Service Providers

We disclose personal information to vendors that perform services for us. The information provided depends on the vendor's role. Providers currently used or expected to be used may include:

  • Squarespace, for hosting and operating portions of the public website and cookie-preference tools.

  • Netlify, for hosting the member portal, deploying code, and running server-side functions.

  • Supabase, for member authentication, magic-link login, member profiles, onboarding records, communication preferences, consent records, and database infrastructure.

  • Stripe, for checkout, payment processing, purchase records, refunds, disputes, and related transaction administration.

  • Airtable, for managing proposed study information, authenticated member votes, community ideas, messages to the team, and related research-planning workflows. Depending on the submission, Airtable records may include a member's email address, name, membership tier, vote selections, idea, message, status, and submission date.

  • Cloudflare, for Turnstile bot detection, fraud prevention, and security verification. Cloudflare may receive technical information such as an IP address and verification token.

  • Resend and related email infrastructure, for magic links, transactional messages, alerts, and other email delivery.

  • Twilio, telecommunications carriers, and related messaging infrastructure, when SMS delivery and opt-out processing are enabled.

  • Meta, for consent-gated advertising measurement and attribution as described in Section 6.

  • Security, analytics, professional-advisory, accounting, legal, and other operational providers as reasonably necessary.

Our providers may change as our operations evolve. We limit disclosures to information reasonably necessary for the service being provided, subject to applicable contracts, law, and the provider's independent obligations.

7.2 Legal, Safety, and Rights

We may disclose information when we reasonably believe disclosure is required by law, subpoena, court order, or governmental request, or is necessary to protect the safety, rights, property, or security of Unplastic Labs, our members, service providers, laboratories, or others; investigate fraud or abuse; enforce our Terms; or establish, exercise, or defend legal claims.

7.3 Business Transactions

We may disclose or transfer information in connection with an actual or proposed merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or transfer of all or part of the Platform. Any recipient will be expected to handle the information consistently with applicable law and the commitments that apply at the time of transfer.

7.4 No Sale for Money

We do not sell or rent personal information for monetary payment. Your personal information is not a product we sell. As explained in Section 6, certain advertising activity may nevertheless be treated as a sale, sharing, or targeted-advertising disclosure under some state laws.

7.5 Aggregated and De-Identified Information

We may use and disclose information that has been aggregated or de-identified so that it is not reasonably linked to you. We will not attempt to re-identify information that we maintain as de-identified, except to test whether our de-identification processes are effective or as otherwise permitted by law.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide memberships, administer Research Seasons, maintain the Platform, honor communication preferences, prevent fraud, resolve disputes, enforce agreements, and comply with legal, tax, accounting, and regulatory obligations.

Retention periods vary by category. For example:

  • Account and profile information may be retained while your account is active and for a reasonable period afterward for support, reactivation, security, and recordkeeping.

  • Purchase, refund, accounting, tax, dispute, and chargeback records may be retained for the periods required or reasonably appropriate for financial and legal obligations.

  • Consent, disclosure, opt-out, suppression, and related compliance records may be retained for as long as reasonably necessary to prove and honor the applicable choice or defend a claim, including after an account is closed.

  • Votes, community ideas, messages, and research-planning records may be retained while useful for research planning, community administration, support, dispute resolution, or historical recordkeeping.

  • Security and technical logs are retained for periods appropriate to troubleshooting, security monitoring, fraud prevention, and legal compliance.

When information is no longer needed, we delete, de-identify, or securely dispose of it, subject to technical limitations and lawful exceptions. Information may remain temporarily in backups until those backups are overwritten through ordinary processes. A refund, account closure, or deletion request does not require deletion of records that we are legally permitted or required to retain.

9. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, acquisition, use, alteration, loss, or disclosure. These safeguards may include access controls, authentication, encryption in transit, security headers, bot protection, logging, vendor-management practices, and data minimization.

No transmission or storage system is completely secure, and we cannot guarantee absolute security. If a security incident involving personal information requires notice under applicable law, we will provide notice as required.

10. Your Choices and Requests

You may:

  • Use our Cookie Preferences control to review or change optional cookie choices.

  • Unsubscribe from promotional email using the method provided in the message.

  • Opt out of text messages by replying STOP or emailing support@unplasticlabs.com.

  • Request access to, correction of, or deletion of personal information associated with your account.

  • Request account closure or ask questions about our privacy practices.

  • Submit privacy requests to legal@unplasticlabs.com. Submit membership-support, refund, or ordinary communication requests to support@unplasticlabs.com. We may need to verify your identity before completing a request.

We may deny or limit a request when permitted by law, including when we cannot verify identity, the request conflicts with another person's rights, or retention is required or permitted for legal, security, fraud-prevention, transactional, consent, suppression, or recordkeeping purposes.

Closing or deleting a portal account may remove the member profile and authentication account but may not automatically erase related records held in every operational system. Transaction records, consent and opt-out records, fraud-prevention records, Airtable submissions, and records needed for legal or compliance purposes may be retained or addressed separately as described in this Policy.

11. U.S. State Privacy Rights

Depending on your state of residence, and if the applicable law applies to Unplastic Labs and to the information at issue, you may have rights such as:

  • Confirming whether we process your personal information and accessing or obtaining a copy of it.

  • Correcting inaccurate personal information.

  • Deleting personal information, subject to lawful exceptions.

  • Obtaining certain information in a portable format.

  • Opting out of sale, sharing, or targeted advertising as those terms are defined by applicable law.

  • Limiting certain uses or disclosures of sensitive personal information where the law provides that right.

  • Appealing our denial of a privacy request.

  • Receiving equal service and pricing without unlawful discrimination for exercising privacy rights.

To exercise a right, email legal@unplasticlabs.com and describe your request. We will verify and respond within the period required by applicable law. Where permitted, you may use an authorized agent. We may require proof of the agent's authority and may ask you to verify your identity directly. Appeal requests may be submitted to the same email with the word "Appeal" in the subject line.

11.1 California Notice

If the California Consumer Privacy Act, as amended, applies to Unplastic Labs and the information at issue, the categories of personal information we may have collected during the preceding twelve months include:

  • Identifiers, such as name, email address, phone number, IP address, account identifier, and cookie or advertising identifiers.

  • Customer-record and account information.

  • Commercial information, such as membership tier, purchase, refund, and transaction information.

  • Internet or electronic-network activity information.

  • Approximate location derived from an IP address.

  • Communications, community submissions, votes, and other user-provided content.

  • Inferences about research interests or advertising attribution.

  • Information that may be treated as sensitive under California law, such as account-access credentials or related authentication information.

The sources, purposes, retention practices, and categories of recipients for this information are described throughout this Policy.

We do not sell personal information for money. Our consent-gated use of advertising technologies may constitute sharing for cross-context behavioral advertising under California law. California residents may opt out as described in Section 6.5. We process qualifying opt-out preference signals as required by applicable law. We do not knowingly sell or share the personal information of people under sixteen (16).

12. Children

The Platform is intended for adults who are at least eighteen (18) years old. We do not knowingly collect personal information from children under thirteen (13), and we do not knowingly permit anyone under eighteen (18) to purchase a membership. If you believe a child has provided personal information to us, contact legal@unplasticlabs.com so we can investigate and take appropriate action.

13. International Users

Unplastic Labs is based in the United States. If you access the Platform from another country, your information may be transferred to, stored in, and processed in the United States and other countries where our service providers operate. Those countries may have privacy laws that differ from the laws where you live. Where legally required, we use appropriate measures for international transfers and honor applicable rights.

14. Changes to This Policy

We may update this Policy to reflect changes in our services, vendors, technology, legal requirements, or data practices. The updated version will state a revised Effective Date or Last Updated date. When required by law, or when a change materially affects how we handle current members' personal information, we will provide additional notice by email, through the Platform, or by another appropriate method. We will request consent when consent is legally required for a new practice.

15. Contact Us

Privacy and legal requests: legal@unplasticlabs.com

Membership support, refunds, and communication requests: support@unplasticlabs.com

Unplastic Labs LLC, North Carolina, United States