Legal
Privacy policy
Glow Works · glowworks.com.au · Last updated 27 September 2026
1. Who this covers
This policy covers Glow Works at glowworks.com.au. It explains exactly what we collect, why, and who else sees it. It is written from what the site actually does rather than from a template, so if something here is not listed, we do not collect it.
Questions about anything below go to admin@glowworks.com.au.
2. What we collect and why
| Information | Why we hold it |
|---|---|
| Email addressAccount registration | To create and sign you in to your account, and to send order confirmations. |
| Organisation, contact name, phoneCheckout and quote requests | To identify the purchasing organisation and to contact you about an order. |
| Shipping addressCheckout | To dispatch the order. |
| Order contents, totals and statusCheckout | To supply the order and to keep the sales records we are required to keep. |
| Your age confirmation and research declarationAccount registration | Accounts are for people aged 18 or over who are purchasing for research. We record that you confirmed it; we do not ask for your date of birth or any identity document. |
| Your three research declarations, with the time and the IP address they were made fromCheckout | These products are supplied for laboratory research only. The declaration is the record that you made that undertaking, and the time and IP address are what make it evidence rather than a tick. |
| Compounds, quantities and research applicationQuote requests | To prepare a quotation. |
We do not ask for, and have no use for, your date of birth, your government identifiers, or any health information about you.
3. Who else sees it
We use four services to run the site. They act on our instructions and may not use your information for their own purposes. Three of them are outside Australia, which means some of your information is handled overseas.
| Service | What it handles |
|---|---|
| SupabaseSydney, Australia | Your account, orders and quote requests — the database itself |
| VercelUnited States, with a global edge network | Hosting and delivery of the site. Request data passes through it |
| ResendUnited States | Your email address and order details, to send order and quote email |
| NOWPaymentsOutside Australia | The order number and amount. Payment is made on their page, not ours |
We will also disclose information where the law requires it — for example to a regulator or in response to a valid legal demand.
4. What we do not do
We do not sell, rent or trade your personal information to anyone, for any purpose.
We run no analytics package, no tag manager and no advertising or social media pixels. Nothing on this site tracks you across other websites, and no third party receives your browsing behaviour here.
The only cookies set are the session cookies that keep you signed in. There are no advertising or analytics cookies, which is why this site has no cookie banner — there is nothing to consent to.
5. Payment details
We never see or store your payment details. Payment is taken on our payment provider's own page, and what comes back to us is a reference and whether the payment cleared. No card number, wallet key or seed phrase touches this site.
6. How long we keep it
Order records, including the research declarations and the IP address attached to them, are kept for as long as we are required to keep business records, and for as long as the declaration may need to be produced. That is the reason the record exists, so it is not deleted on request while that period runs.
A quote request that does not become an order is kept while it is being dealt with and for our own records afterwards.
If you close your account we remove the account and its cart. Orders already placed are kept as above.
7. Keeping it secure
Your account is protected by a password you set, and the site is served only over an encrypted connection. Access to order data is restricted at the database level so that an account can read only its own records, and staff access is limited to the people who fulfil orders.
No system is perfect. If we ever become aware of a data breach that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required.
8. Getting at your information
You can ask us what personal information we hold about you, ask us to correct it if it is wrong, or ask us to delete your account. Email us and we will respond within a reasonable time, and normally within 30 days.
If you are not satisfied with how we have handled your personal information, you can complain to us first, and then to the Office of the Australian Information Commissioner at oaic.gov.au.
9. Changes to this policy
If we change how we handle personal information, we change this page at the same time and update the date at the top. We do not make changes quietly and backdate them.
See also our Terms of Sale, which cover how orders are accepted and supplied.