Draft notice: This page is a working draft. Review with qualified legal counsel before launch.

Privacy Policy

Last updated: May 16, 2026

Draft — review with legal counsel before launch. This page is a good-faith working draft based on how the Magenta Drug Test platform actually handles data today. It is not legal advice and must be reviewed by qualified counsel before going live.

Summary

We collect only what we need to fulfill your orders, manage your account, and run our business.
We do not use third-party trackers like Google Analytics, Facebook Pixel, or any advertising network. All analytics are internal to our own database.
We do not sell your personal information.
You can request access, correction, or deletion of your data at any time.

What we collect

When you place an order or create an account we collect:

Account & contact: name, email, phone (optional), shipping and billing addresses.
B2B / wholesale only: company name, EIN, industry, estimated monthly volume, current supplier, and (optionally) a tax-exempt certificate.
Order data: items purchased, totals, order status, returns, and order history.
Payment: card information is collected and stored by Stripe — we never see or store your full card number. We only retain a token, the last four digits, and a brand label so we can show "Visa ending 4242" in your order history.
Session data: a first-party session cookie (mgt_sid) so your cart works and we can measure aggregate site traffic. This cookie is opaque and is hashed with a daily-rotating salt before it touches our analytics database, so it cannot be reversed back to identify you.

We also automatically log:

Pages you visit and the page that referred you (for internal analytics).
The general type of browser/device you use (e.g. "Chrome on iPhone").
A general country (only when our hosting provider supplies it; never a precise IP address).

How we use your data

Order fulfillment — process payments, ship products, calculate sales tax, handle returns.
Account management — let you sign in, see order history, manage saved addresses and subscriptions.
Internal analytics — understand traffic patterns and improve the storefront. Aggregated only; we do not profile individual users.
Marketing — send order updates, shipping notifications, and (only if you opt in) newsletters or restock alerts.
Legal & tax — keep order records for the periods required by federal and state law.

Third-party processors

We use a small, named set of processors. Each one only sees the data it needs to do its job:

Stripe — payment processing. Stripe is PCI-DSS compliant and stores all card data on its own infrastructure.
Resend — sends transactional email (order confirmations, shipping updates, password resets).
TaxJar — calculates sales tax based on your shipping address.
Anthropic (Claude) — used by our internal content engine to draft SEO articles about drug-testing topics. Customer data is never sent to Anthropic. Only product names and SEO topics.

That's the full list. No advertising platforms, no analytics vendors, no data brokers.

At-home DNA tests & genetic data

DNA information is among the most sensitive personal data there is, so our at-home DNA tests are handled with extra care.

What we collect for a DNA order: your order and contact details (as above), the participant labels you provide (for example, "alleged father," "child"), and the cheek-swab samples you mail to our partner laboratory.
Who processes it: testing is performed by our partner laboratory. The lab receives only what it needs to run the test you ordered.
Samples: are used only to perform the test you ordered and are destroyed after testing is complete.
Results: are delivered to you privately by email and are never sold, rented, or shared with third parties for marketing, insurance, or advertising, and are never added to any genealogy or research database.
No genetic profiling: we do not use your DNA results to profile you, and we do not combine them with marketing data.
Sensitivity: while at-home, informational tests are generally not covered by HIPAA, we treat your DNA results with comparable care.
Deletion: you can request deletion of your DNA-related records at any time by emailing privacy@magentadrugtest.com.

DNA tests sold on this site are for peace of mind and personal information only and are not legal or chain-of-custody tests.

Cookies

We use exactly two cookies:

Name	Purpose	Lifetime
`authjs.session-token`	Keeps you signed in.	Session
`mgt_sid`	Stable session identifier so the cart works across pages and we can produce aggregate traffic reports. Hashed before storage.	1 year

We do not set any advertising or cross-site tracking cookies.

Data retention

Orders, invoices, refunds: retained indefinitely as required by tax and consumer-protection law.
Marketing data: deletable on request via Account → Settings → Delete account, or by emailing us.
Raw analytics page views: retained for 90 days, then deleted. Long-term reporting uses anonymous daily totals only.
Error logs: retained according to severity (critical kept indefinitely, others up to one year).

Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your data (subject to tax and legal retention requirements).
Receive a copy of your data in a portable format.
Opt out of marketing communications at any time.

To exercise any of these rights, email privacy@magentadrugtest.com or use Account → Settings → Delete account.

California residents (CCPA)

We do not sell or "share" personal information as those terms are defined under the California Consumer Privacy Act. California residents may make the requests listed above and will not be discriminated against for doing so.

European residents (GDPR)

If you are located in the EU/EEA or UK, we process your personal data under the lawful basis of contract performance (fulfilling your order), legitimate interests (running our store and preventing fraud), and consent (where you have opted in to marketing). You have the additional right to lodge a complaint with your local supervisory authority.

Children

This site is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

Security

We protect customer data with industry-standard measures: TLS for all traffic, bcrypt password hashing, strict admin role gating, audit logging of every admin write, and a strict Content Security Policy in the browser.

Changes to this policy

We will update the "Last updated" date at the top whenever we make changes. Material changes will also be sent to all customers by email.

Contact

Privacy questions: privacy@magentadrugtest.com Mailing address: Magenta Drug Test, [street address], [city, state, zip], USA