Privacy policy

Vial Case Privacy Policy

Effective Date: July 1, 2026

This Privacy Policy explains how Vial Case ("Vial Case," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit or make a purchase from vialcase.com (the "Site"). Vial Case is an online retailer, based in Las Vegas, Nevada, USA, that sells vial, peptide, and syringe organizer cases, related accessories, and custom-printed vial labels. We ship within the United States and internationally, including to the United Kingdom and the European Union.

We believe in full transparency about the technologies we use. This policy discloses, by name, every analytics, advertising, session-recording, payment, and third-party service we use so that you can make informed choices. Please read it carefully, especially the sections on Session Recording & Communications Monitoring and "Sale" and "Sharing" of Personal Information.

1. Information We Collect

We collect the following categories of personal information, depending on how you interact with the Site:

  • Identity & contact data: name, email address, phone number, and billing and shipping addresses.
  • Account & credential data: login information (stored in hashed form by our platform), and session/security tokens (for example, secure_customer_sig and Shopify session cookies).
  • Order & transaction data: the products you view, add to cart, and purchase; order value and history; cart contents; currency; and returns/refunds.
  • Payment data: your payment card number, expiration date, and security code, or your PayPal/other wallet account details. This data is collected and processed directly by our PCI-DSS-compliant payment processors and is not stored on Vial Case's own systems.
  • Device, network & technical data: IP address, browser type and version, operating system, device type and identifiers, screen resolution, language/locale, and referring/exit pages.
  • Usage & interaction data: pages viewed, links and buttons clicked, mouse movements, scrolling, taps, and — through our session-recording tool — a reconstructed recording of your visit (see Section 3).
  • Approximate geolocation: city- or region-level location derived from your IP address.
  • Custom label / user-generated content: if you use our on-site vial-label designer, the design text, layout, and choices you enter; and, for product reviews, your reviewer name, email, review text, rating, and any uploaded photos.
  • Marketing & communications data: your email/SMS subscription status and consent, and engagement with our messages (such as opens and clicks).
  • Inferences: preferences and characteristics we or our advertising partners derive from the above (for example, advertising audience segments).

Sensitive personal information. We do not intentionally collect government IDs, precise (GPS-level) geolocation, biometric data, health information, racial/ethnic origin, religious beliefs, sexual orientation, or the contents of your private communications. Payment-account information and account login credentials may be considered "sensitive" under some laws; we use these only to process your orders, operate your account, and secure the Site, and not to infer characteristics about you. Please do not submit sensitive medical or health information (for example, details about a medical condition) through label designs, reviews, or the contact form; our products are storage and organization accessories and are not medical devices.

2. Tracking & Analytics Technologies

We and our third-party partners use cookies, pixels, tags, software development kits (SDKs), local storage, and similar technologies to operate the Site, understand how it is used, and market our products. The table below names each provider we use, what it does, and links to that provider's own privacy policy. Our on-site session-recording tool (Microsoft Clarity) loads only after you click "Accept All" on our cookie banner; if you choose "Reject Non-Essential," or your browser sends a Global Privacy Control (GPC) signal, it does not load. Other analytics and advertising technologies are delivered through Shopify's platform and its marketing channels; you can limit or opt out of them using the browser settings, provider opt-outs, GPC, and the "Do Not Sell or Share" options described in Sections 6 and 7.

Provider Purpose Provider Privacy Policy
Shopify (platform host) Hosts the store; runs cart, checkout, and customer accounts; sets essential first-party cookies; provides platform analytics (ShopifyAnalytics, window.__st) and fraud/risk screening. shopify.com/legal/privacy
Shop Pay / Shop app Accelerated checkout and cross-device cart sync; shares email, phone, and order data with Shopify's Shop network. shop.app/privacy
PayPal Alternative payment method; PayPal's JavaScript SDK loads on the Site and collects payment and device data and sets its own cookies. paypal.com/us/legalhub/privacy-full
Google Analytics 4 (ID G-N7ZH1JT9JX) Website measurement — page views, events (product views, add-to-cart, checkout, purchase), device/browser data, and approximate location; sets a client-ID cookie. policies.google.com/privacy
Google Ads / Merchant Center (ID MC-SP1VJLC6L8) & conversion linker Conversion measurement, Google Shopping listings, and remarketing/audience building across Google Search, YouTube, Gmail, and the Display Network; sets _gcl_* cookies. Delivered via Google Tag Manager (the Google & YouTube channel), which loads Google's tags. policies.google.com/privacy
Microsoft Clarity (project wo5cjqhxfj) Session recording / session replay and heatmaps — records and reconstructs your visit, including mouse movement, clicks, scrolls, and page navigation (see Section 3). privacy.microsoft.com/privacystatement
Meta (Facebook / Instagram) Advertising and conversion measurement. We may transmit purchase/checkout events and hashed customer identifiers (email, phone, IP) to Meta server-side via its Conversions API for ad measurement and retargeting. facebook.com/privacy/policy
TikTok Advertising and conversion measurement. We may transmit purchase/checkout events and hashed identifiers to TikTok server-side via its Events API for ad measurement and retargeting. tiktok.com/legal/page/row/privacy-policy/en
Judge.me Product reviews and user-generated content; collects reviewer name, email, review text, and photos; may send review-request emails. judge.me/privacy
Accessibility widget On-site accessibility overlay that adjusts display for accessibility; logs impressions/usage in local storage. Provider policy available on request via our contact form
Simprosys Google Shopping Feed Shopify app that submits our product catalog (titles, descriptions, images, prices, availability) to Google Shopping. Contains product data, not customer personal data. simprosys.com/privacy-policy
Securify Browser/bot protection and store security screening to prevent abuse and fraud. Provider policy available on request via our contact form
Cookie-consent banner (vc_consent) Records your Accept All / Reject choice and gates our session-recording tool (Microsoft Clarity) until you consent; also respects your Global Privacy Control preference. N/A (first-party)

We also use first-party local storage for personalization and functionality — for example, a recently-viewed list, custom label design keys (va_*) when you use the label designer, and Shop/PayPal SDK keys. Checkout may present a bot-protection challenge (such as reCAPTCHA/hCaptcha) that collects device and behavior signals to distinguish humans from bots.

3. Session Recording & Communications Monitoring

Please read this section carefully and note the consent statement at the end.

We use Microsoft Clarity, a session-recording and analytics tool, to help us understand how visitors use our Site and to improve it. Clarity uses cookies and similar technologies to record and reconstruct your interactions with the Site as a session replay. This may include your mouse movements, clicks and taps, scrolling, the pages and content you view, how long you spend on each page, and general information about your device, browser, and approximate location. Clarity also generates aggregated heatmaps.

Session recording captures your interactions with our web pages. We configure Clarity to mask text you type into form fields (such as name, address, and payment fields) so that keystrokes into those fields are not recorded in readable form. We do not use this tool to capture the content of your private communications, and we do not intercept messages in transit.

Because session-recording technology captures your on-Site activity in a way that a law such as the California Invasion of Privacy Act (CIPA) and similar state wiretap and eavesdropping laws may treat as a "recording," we want your informed consent before it runs. By clicking "Accept All" on our cookie-consent banner and continuing to use the Site, you expressly consent to the recording of your interactions with the Site by Vial Case and its analytics provider (Microsoft Clarity) as described in this section. If you do not consent, choose "Reject Non-Essential" on the banner, and we will not load the session-recording tool. We also honor a Global Privacy Control (GPC) browser signal as a choice not to load session recording. You may withdraw consent at any time by updating your cookie choices or contacting us.

Certain advertising partners (Meta and TikTok) may also receive event data about your checkout and purchases through server-side integrations, as described in Sections 2 and 6. This is event/conversion data — not a recording of your session.

4. How We Use Your Information

  • Operate, host, and secure the Site and your customer account.
  • Process, fulfill, ship, and track your orders, and handle returns and refunds.
  • Process payments and prevent fraud, chargebacks, and abuse (using IP address, device signals, and geolocation for risk scoring).
  • Provide the custom label designer and produce your custom-printed labels.
  • Respond to your inquiries submitted through our contact form and provide customer support.
  • Send you transactional messages (order confirmations, shipping updates) and, with your consent, marketing email/SMS.
  • Measure and analyze Site traffic, performance, and usability (including via analytics and session recording).
  • Advertise our products, measure ad conversions, and build advertising audiences and retargeting.
  • Display and manage product reviews and other user-generated content.
  • Comply with legal, tax, accounting, and anti-money-laundering obligations, and enforce our terms.

5. How We Share and Disclose Information

We disclose personal information to the following categories of recipients, as described elsewhere in this policy:

  • Platform & hosting providers: Shopify (and its sub-processors), which host the store and process orders and accounts.
  • Payment processors: Shopify Payments (powered by Stripe), PayPal, and Shop Pay, to process transactions and screen for fraud.
  • Analytics & session-recording providers: Google Analytics and Microsoft Clarity.
  • Advertising partners: Google Ads/Merchant Center, Meta, and TikTok, for conversion measurement, remarketing, and audience building.
  • Marketing/communications providers: our email and SMS platform(s) that deliver transactional and marketing messages.
  • Reviews & content providers: Judge.me.
  • Fulfillment & shipping providers: shipping carriers (such as USPS) and Pirate Ship, to label and ship your orders.
  • Product-feed & security apps: Simprosys (Google Shopping feed) and Securify (bot/security screening).
  • Professional advisors & authorities: lawyers, accountants, and government or law-enforcement bodies where required by law, or to protect our rights, safety, or property.
  • Business transfers: a successor entity in the event of a merger, acquisition, financing, or sale of assets.

Each vendor may engage its own sub-processors to deliver its services. A current list of key sub-processors is available on request through our contact form. Most of these providers act as our service providers/processors and are contractually restricted to using your data only to perform services for us; disclosures to advertising partners, however, may constitute a "sale" or "sharing," as described next.

6. "Sale" and "Sharing" of Personal Information & Your Right to Opt Out

Under the California Consumer Privacy Act, as amended by the CPRA, and similar U.S. state laws, providing online identifiers and event/conversion data to advertising partners for cross-context behavioral advertising, remarketing, and audience-building can be considered a "sale" or "sharing" of personal information — even though no money changes hands. Based on our current setup, our use of Google Ads/Merchant Center, Google Analytics (advertising features), Meta, and TikTok may constitute a "sale" or "share" of the following categories: online identifiers, internet/network activity, approximate geolocation, commerce information, and advertising inferences.

We do not "sell" or "share" your payment data or the contents of your account for advertising, and we do not knowingly sell or share the personal information of anyone under 16.

You have the right to opt out of the sale and sharing of your personal information. You can do so by:

  • Choosing "Reject" on our cookie-consent banner before non-essential tags load;
  • Using our "Do Not Sell or Share My Personal Information" request page at vialcase.com/pages/data-sharing-opt-out;
  • Sending a Global Privacy Control (GPC) browser signal, which we honor as an opt-out of session recording and as your request to opt out of the sale/sharing of personal information; or
  • Contacting us through our contact form.

7. Cookies & Your Choices

Consent banner. Our banner (which records your choice in vc_consent) lets you Accept All or Reject non-essential cookies. Essential cookies (Shopify sessions, cart, security tokens like secure_customer_sig, and fraud screening) are strictly necessary to operate checkout and cannot be disabled while you shop.

Browser controls & GPC. You can block or delete cookies in your browser settings and enable Global Privacy Control (GPC). We honor a GPC signal as an opt-out of session recording and as a request to opt out of the sale/sharing of your personal information.

Per-provider opt-outs:

Email & SMS. You can unsubscribe from marketing emails via the "unsubscribe" link, and stop marketing texts by replying STOP. Transactional messages about your orders are not marketing and may still be sent.

8. Your Privacy Rights

California (CCPA/CPRA). California residents have the right to: know and access the categories and specific pieces of personal information we collect, use, disclose, and sell/share; delete personal information; correct inaccurate information; opt out of the sale/sharing of personal information and of targeted advertising; limit the use of sensitive personal information; and not be discriminated against for exercising these rights. The categories of personal information we collect, use, and disclose/share are described in Sections 1, 5, and 6.

Nevada (SB 220). Nevada residents have the right to submit a verified request directing us not to make any covered "sale" of certain personal information. You may submit such a request through our contact form.

Other U.S. states (Virginia, Colorado, Connecticut, Utah, and similar). Residents of these states have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, "sale" of personal data, and certain profiling. Where applicable, you may appeal a decision on your request by contacting us again through our contact form.

UK/EU (GDPR / UK GDPR). If you are in the UK or EEA, you have rights to access, rectify, erase, restrict, and port your personal data, to object to processing (including direct marketing), and to withdraw consent. Our legal bases are: performance of a contract (orders/accounts), consent (non-essential cookies, session recording, and marketing), legitimate interests (Site security, fraud prevention, and basic analytics), and legal obligations. You may lodge a complaint with your local supervisory authority.

International transfers. We and our providers (including Shopify, Google, Microsoft, Meta, TikTok, and PayPal) are based in or process data in the United States and other countries. For UK/EU shoppers, these cross-border transfers are made under appropriate safeguards, such as Standard Contractual Clauses and the providers' Data Processing Agreements.

How to exercise your rights. Submit requests through our contact form at vialcase.com/pages/contact-us. We will verify your identity before responding and will not discriminate against you for exercising your rights. You may use an authorized agent where the law permits.

9. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this policy — for example, to complete your orders, maintain your account, and provide support — and thereafter as required to comply with legal, tax, accounting, and record-keeping obligations, resolve disputes, and enforce our agreements. Order and transaction records are typically retained for the period required by tax and commercial law. Analytics, advertising, and session-recording data are retained according to each provider's retention settings (for example, Microsoft Clarity and Google Analytics apply their own default retention windows). When information is no longer needed, we delete or de-identify it.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, and we rely on PCI-DSS-compliant payment processors so that full payment card numbers are never stored on our own systems. Our platform and payment providers employ encryption in transit, tokenization, and fraud screening. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11. Children's Privacy

Our Site is intended for adults. We do not knowingly collect personal information from anyone under 16 years of age, and we do not sell or share the personal information of minors. If you believe a child has provided us with personal information, please contact us and we will delete it.

The Site may contain links to third-party websites, plug-ins, and services (including social media and payment providers). We are not responsible for the privacy practices of those third parties, and this policy does not apply to them. We encourage you to review the privacy policies of any third-party site you visit.

13. International / Cross-Border Users

Vial Case operates from the United States. If you access the Site or purchase from outside the U.S. (including the UK and EU), you understand that your information will be transferred to, stored, and processed in the United States and other countries where we and our providers operate, under the safeguards described in Section 8.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above and, where required, provide additional notice. Your continued use of the Site after an update constitutes acceptance of the revised policy.

15. Contact Us

Vial Case
Las Vegas, Nevada, USA

For any privacy question or to exercise your rights, please contact us through our contact form at vialcase.com/pages/contact-us. To opt out of the sale/sharing of your personal information, use vialcase.com/pages/data-sharing-opt-out.