Privacy policy

Who this covers

This policy applies to goldstandardanalytics.com, the client portal, the sample intake, the equipment shop and marketplace, the Telegram and WhatsApp bots, the REST API and MCP server, and the WooCommerce plugin. It covers clients who submit samples, contributors to group pools, marketplace buyers and sellers, and visitors who verify a certificate.

The controller is Gold Standard Analytics LLC, 5151 Mitchelldale St A10, Houston, TX 77092.

What we collect

• Account data: name, email, mobile number, ship-from and billing address; for companies, legal name and EIN. Email and mobile are verified by one-time code.
• Order data: services, compounds, lot numbers, declared amounts, add-ons, notes to the bench, shipping label and tracking numbers.
• Payment data: we never see or store card numbers. Stripe, Mercury and Paygate process payments and return a token, a status and the last four digits where applicable.
• Chain-of-custody records: receiving video and photographs of your package and containers, accession numbers, instrument files, chromatograms, calibration references and analyst signatures.
• Chat data: if you use the Telegram or WhatsApp bot, the platform user ID, the messages you send the bot, and the link to your lab account.
• Marketplace data: listings, offers, payouts and the know-your-business (KYB) verification handled by DIDIT for sellers.
• Technical data: IP address, browser, pages viewed and, unless you opt out (in the EEA, the UK and Switzerland, only with your consent), the analytics events and advertising measurement described under Who we share it with and Cookies.

Why we use it

• To receive, test and report on your samples and to issue certificates.
• To take payment, issue invoices, purchase shipping labels and send transactional email and SMS.
• To operate the public certificate database and the Gold Standard Mark.
• To meet record-retention duties under our quality program (procedures modelled on ISO/IEC 17025, not accredited; GLP-style data integrity; electronic records with an audit trail).
• To prevent fraud, forged certificates and misuse of the marketplace.
• To measure which of our ads on TikTok, ChatGPT and Google lead to visits, sign-ups, orders and payments, and to show our ads to people likely to want testing, unless you opt out (in the EEA, the UK and Switzerland, only with your consent).
• To improve the site, only with your consent to analytics.

What is published, and what never is

Every certificate we sign is public. Certificates issued with a verification code can be checked at /verify. A public certificate shows: accession number, compound or product, matrix, lot number, results, specifications, verdict, methods, instrument ID, issue date, signing analyst, SHA-256 hash and, if the submitter is a listed vendor, the vendor name.

A public certificate never shows: your personal name (unless you are the named business submitter), email, phone, address, payment details, or any contributor to a group pool. Every certificate is published, pass or fail; an order cannot opt out. Orders accepted before September 23, 2026 keep the publication choice made on them, and a record opted out then resolves as "This record exists but is not public" with issue date and verdict only.

Receiving footage and photographs are retained 90 days and shown to the submitting client and, for group pools, to contributors. They are not public.

Who we share it with

• Payment processors: Stripe (cards, wallets, Klarna and supported cryptocurrency), Mercury (invoices, ACH, wire, payouts), Paygate (cryptocurrency).
• Shipping: UPS, to create labels and track packages.
• Messaging: Twilio (SMS), our email provider, Telegram and Meta (WhatsApp) when you use those channels.
• Identity verification: DIDIT, for marketplace seller KYB only.
• Infrastructure and analytics providers under data-processing agreements.
• Advertising: TikTok, OpenAI (ads in ChatGPT), Google (Google Ads) and RunAds (which manages our Google Ads), unless you opt out (in the EEA, the UK and Switzerland, only with your consent). On our public pages and the sample intake (never in the client portal, sign-in or account pages, payment, quote or review links, or private certificate links) their tags tell them the pages you view, the services and tests you add, and when you start checkout, enter payment details, place an order, pay or create an account, with the amounts, and the ad you arrived from; TikTok, Google and RunAds also receive what you type in the intake's search box. For an order, a payment or a sign-up, TikTok, OpenAI and Google also receive your email address and phone number hashed (SHA-256) first, so they can match it to their users, and our server tells TikTok and OpenAI the same with your customer ID hashed, your IP address and browser. RunAds receives no email address or phone number. We never send test results, certificates, lot numbers, sample notes, addresses or payment card details.
• Regulators, courts and law enforcement when required by law. We publish an annual count of such requests.
• We do not sell personal data for money. Some state privacy laws, including California's and Texas's, treat letting an advertising platform measure our ads as "selling" or "sharing" personal data for targeted advertising. You can opt out of it at any time (see Cookies), and we treat your browser's Global Privacy Control signal as that opt-out.

How long we keep it

• Certificates and the raw data behind them: permanently, as immutable records. Retractions are logged, never deleted.
• Chain-of-custody video and photographs: three years, then destroyed, unless a dispute is open.
• Retained samples: 90 days, then destroyed as regulated waste.
• Account and order records: for the life of the account plus seven years for tax and quality-record duties.
• Chat transcripts with the bots: 12 months.
• Analytics: 14 months, aggregated.

Your rights

You can access, correct, export or delete your account data, opt out of analytics (or withdraw your consent to it), opt out of advertising measurement (the "sale" or "sharing" of personal data for targeted advertising), and choose whether your name appears on future certificates. Every certificate itself is always published; you cannot opt a result out of the public record. Certificates already published cannot be deleted because the public record is the product; we can, on request, remove a vendor name from a published record where the law requires it.

Texas residents have rights under the Texas Data Privacy and Security Act; California residents under the CCPA/CPRA; EU and UK residents under the GDPR and UK GDPR. We honor these rights for everyone regardless of residence. Requests: team@goldstandardanalytics.com. We respond within 30 days and verify identity before acting.

Cookies and local storage

Necessary: sign-in session, your intake draft, cart, cookie choice. These do not track you across sites.

Fraud prevention: we use Stripe to process payments. To help detect fraud, Stripe's script runs on our pages and collects identifying information about the devices that connect to its services, such as browser and device characteristics and how pages are used. Stripe uses this information to operate and improve the services it provides to us, including fraud detection, and does not use it for advertising. You can read Stripe's privacy policy at https://stripe.com/privacy.

Analytics (on unless you opt out; in the EEA, the UK and Switzerland, only with your consent): Google Analytics records the pages you view, your searches in the intake and the order steps, to show us how the site is used, with its cookies _ga and _ga_<id>. Google signals and ad personalization are off for it, so it is not used to advertise to you.

Advertising (on unless you opt out; in the EEA, the UK and Switzerland, only with your consent): the TikTok pixel's cookies (_ttp, _tt_enable_cookie, ttcsid), OpenAI's (__oppref, the ChatGPT ad you arrived from, 30 days; __obref; __oaiq_consent), Google Ads' (_gcl_au, _gcl_aw), RunAds' (_ra_vid, _ra_sid, _ra_gclid, _ra_fbclid, _ra_utm), and three of ours: gsa_ad, which remembers your choice, gsa_ttclid, which keeps the TikTok ad you arrived from for 30 days, and gsa_signup, which lasts ten minutes after you create an account so the next page can count it. To opt out, open Cookie preferences on this page and choose Necessary only, or untick Allow advertising, or turn on Global Privacy Control in your browser. From then on nothing about your visits, sign-ups, orders or payments is sent to an advertising platform from this site. If you are signed in when you opt out, or open a payment on this site afterwards, your choice is also kept with your account, so a payment for an order you placed earlier is not reported either.

Outside the EEA, the UK and Switzerland there is no cookie banner: analytics and advertising measurement run unless you opt out. In those regions a small panel asks first, and only necessary cookies are used until you choose (gsa_region, a necessary cookie, records that the panel applies to you). You can change your choices at any time with the Cookie preferences button on this page (the footer's "Do not sell or share my personal information" link leads here), or by clearing site data in your browser.

SMS and messaging consent

By verifying a mobile number you agree to receive transactional texts about your orders: receipt confirmation, invoice, shipping label, package received, certificate published, and one-time verification codes. Message frequency depends on your orders. Message and data rates may apply. Reply STOP to end, HELP for help. We do not send marketing texts and we do not share mobile numbers or consent with third parties for marketing.

Children

The service is for adults and businesses. We do not knowingly collect data from anyone under 18.

Security

Data is encrypted in transit (TLS 1.2 or higher, HSTS) and at rest. Card data never touches our servers. Access to laboratory records is role-based and logged. Certificates are hashed with SHA-256 and the hash is published so any alteration is detectable.

Changes

We post changes here with a new effective date and, for material changes, email account holders 30 days in advance. Effective September 7, 2026.

Updated October 26, 2026: advertising measurement with TikTok, OpenAI, Google and RunAds, and Google Analytics with your consent (Who we share it with, Cookies).

Updated October 27, 2026: Google Analytics runs unless you opt out (in the EEA, the UK and Switzerland, only with your consent), and the cookie banner gave way to Cookie preferences on this page (Cookies).