Akesis Pharmaceutical Products Trading is the controller of the personal data described here. Contact details are on our contact page.

Before the site can be used, visitors confirm they are 21 or older. When that confirmation is given we record the exact wording shown, the version of that wording, the time, the IP address, the browser user agent and a session identifier.

The wording is versioned deliberately: if it is ever revised, we must still be able to establish what a given person agreed to on a given date. That record is kept as evidence of the confirmation.

To view products or place an order you create an account. We collect your email address, name, and — for business accounts — your company details. If you sign in with Google, we receive your email address and basic profile information from Google in order to identify your account. We do not receive your Google password.

Where verification is required, you may be asked to provide documents such as identification, proof of address, a business licence or a tax registration. We store the file itself, its name, type and size, and the status of our review.

Documents are held in private storage and are never publicly addressable. They are retrievable only through an authenticated request by an authorised reviewer, and every such access is recorded.

Each document carries an expiry and a scheduled deletion date. Once a check has been decided we retain the decision, the reviewer and the date; the underlying document is deleted on that schedule. Retaining the outcome rather than the image is the single most effective way to limit what a breach could expose.

We keep an append-only record of actions that change who may buy or what they were sold: verification decisions, changes to verification policy, changes to payment details, batch releases and recalls, and each time a submitted document is opened. Each entry records who acted, what they did, when, the reason where one was given, and the IP address the action came from.

These records are not deleted on request, because they exist precisely to be relied upon afterwards.

Orders carry the items purchased, prices, your billing and delivery addresses, and the payment method chosen. Where an order is settled by bank transfer we do not receive or store your bank credentials; we publish our own account details and reconcile the incoming payment.

We use cookies that are necessary for the site to function: one that records the age confirmation, one that identifies your basket, one that keeps you signed in, and one used for caching. We do not use advertising or cross-site tracking cookies.

Our infrastructure is operated by third parties acting on our instructions: application hosting (Fly.io), the database (Neon), private document and certificate storage (Cloudflare R2), and transactional email (Resend). Signing in with Google involves Google as an identity provider. Each processes data only to provide those services.

Depending on where you are, you may have rights to access, correct, export or erase your personal data, and to object to or restrict certain processing. Write to us using the details on our contact page and we will respond.

Some records cannot be erased on request. Verification decisions, audit records and order documentation are retained where we are required to keep them, or where they are needed to establish or defend a legal claim.