Privacy Policy

Privacy Policy

Privacy Policy, version 1.0. Published at /privacy/ on vipsupplyllc.com. Last updated: November 4, 2026. Effective: on the date VIP Supply first publishes this Policy at that address.

VIP Supply LLC, a Delaware limited liability company ("VIP Supply"), publishes this privacy policy (this "Policy").

This Policy covers the website at vipsupplyllc.com and the contact form published on it (together, the "Services"). It covers visitors in the United States. The Services are not directed to buyers in the European Economic Area, in Switzerland or in the United Kingdom, and this Policy does not describe a practice for visitors located there.

The Services are an information site for verified licensed purchasers of professional and laboratory-use biologics, diagnostics, veterinary and related supply. The Services have no storefront, no prices, no shopping cart, no checkout, no user account and no login, so the website holds no profile, no order history and no payment information. The contact form is the only place on the website where a visitor is asked to type anything.

Opening an account with VIP Supply, placing an order, receiving a shipment, making a claim and being paid a refund all happen away from the website, by email, telephone, fax and post. Those steps collect more than the contact form does, and this Policy describes them as well: Section 4.5 and Part 4 of Exhibit A say what they collect, who receives it and how long it is kept.

1. Definitions and Interpretation

"Business Day" means a day other than a Saturday, a Sunday, or a day on which commercial banks in Philadelphia, Pennsylvania are authorized or required by law to close.

"Enquiry Log" means the single file on the hosting server, outside the part of the server that serves web pages, to which the Services append every accepted contact-form submission.

"Google" means the company that operates Google Fonts and that operates the mail service to which the mailbox named in Section 3 forwards an enquiry.

"Google Fonts" means the web-font files a visitor's browser fetches from the domains fonts.googleapis.com and fonts.gstatic.com when that visitor loads a page of the Services.

"Namecheap" means the company that provides the shared hosting account, located in the United States, on which the Services and the Enquiry Log sit.

"Offender Ledger" means the record of abusive senders that the Submission Guard keeps, keyed to an email address and to an internet protocol address, and that is shared across the websites on the hosting account that use the Submission Guard (eighteen of them as at November 4, 2026) on the same hosting account.

"Personal Information" means information that identifies, relates to, describes or can reasonably be linked with a particular person or household.

"Refusal Log" means the file in which the Submission Guard records a submission it refuses.

"Rights Request" means a request a person makes under Section 16 to know about, obtain a copy of, correct or delete that person's own Personal Information, or to limit the use of it.

"Sensitive Personal Information" means Personal Information in a category that the law treats as needing extra protection, including a government identifier, a financial-account number with an access code, precise geolocation, racial or ethnic origin, religious belief, union membership, biometric information used to identify a person, health information, and information about sex life or sexual orientation.

"Submission Guard" means the anti-abuse program, installed outside the part of the server that serves web pages, that decides whether the Services accept or refuse a contact-form submission.

1.1 In this Policy: "including" introduces examples and does not limit what comes before it; "or" is inclusive unless this Policy says otherwise; the singular includes the plural; a reference to a Section is a reference to a Section of this Policy; and a reference to a day is a reference to a calendar day unless this Policy says Business Day.

1.2 A period of days in this Policy begins on the day after the event that starts it, and where the last day of a period is not a Business Day the period runs to the next Business Day.

2. Scope, Changes, and the Order in Which This Policy Reads

2.1 This Policy applies to Personal Information the Services collect, and to Personal Information VIP Supply collects from or about a licensed purchaser in opening an account, taking an order, dispatching a shipment, handling a claim and issuing a refund, however that information reaches VIP Supply, including by telephone, by fax, by post and by email. It does not apply to a website VIP Supply does not control, including each of the partner and affiliate websites the Services link to.

2.2 VIP Supply may change this Policy. VIP Supply will post the changed version with a new "Last updated" date, and for a change that materially expands how Personal Information is used VIP Supply will give notice on the Services at least fourteen (14) days before the change takes effect.

2.3 The current version of this Policy is version 1.0. VIP Supply keeps each prior version and will send a copy of a prior version to anyone who asks for it at the mailbox named in Section 3. The Services do not publish a version-history page today.

2.4 Exhibit A and Exhibit B form part of this Policy. Exhibit A is the operative inventory of what the Services collect, who receives it and how long it is kept. Where the body of this Policy and Exhibit A differ, Exhibit A controls, and the body is read as a summary of Exhibit A.

3. Who Controls the Information, and How to Reach VIP Supply

3.1 VIP Supply decides how Personal Information collected through the Services is used.

3.2 The address for a question about this Policy, for a Rights Request, for an appeal under Section 17 and for a complaint under Section 20 is info@vipsupplyllc.com.

3.3 The postal address is VIP Supply LLC, Attn: Jayesh Patel, Partner, 1700 Market Street, Suite 1005, Philadelphia, PA 19103. The telephone number is (267) 900-4229 and the fax number is (267) 900-4230.

3.4 VIP Supply has not appointed a representative in the European Economic Area or in the United Kingdom.

4. What Personal Information the Services Collect

4.1 Exhibit A lists every category of Personal Information the Services collect, where each category comes from, why it is used, who receives it, whether it is sold or shared, whether it is sensitive, and how long it is kept. Exhibit A is the operative list and this Section 4 is a summary of it.

4.2 In summary, the Services collect what a person types into the contact form, which is a name, an email address, an organisation name, a telephone number, a topic and a message; and three things the Services capture from the connection without anyone typing them, which are the visitor's internet protocol address, the visitor's user-agent string and the date and time of the submission. The Submission Guard derives four further records from the same information, and Section 8 describes each of them.

4.3 VIP Supply collects only the categories listed in Exhibit A. If VIP Supply begins collecting a new category, through the Services or in the course of a supply relationship, VIP Supply will add it to Exhibit A before the collection starts.

4.4 The contact form does not ask for Sensitive Personal Information and does not knowingly collect it, and no row in Part 1, Part 2 or Part 3 of Exhibit A records a sensitive category.

4.5 Opening an account and buying from VIP Supply is a separate process from the contact form, and it collects more than the contact form does. Part 4 of Exhibit A lists what account opening, ordering, dispatch, a claim and a refund collect. Part 5 lists what a Rights Request and an appeal collect. Both are part of the same inventory and are as operative as the first three.

4.6 One category in Part 4 of Exhibit A is Sensitive Personal Information under Section 1. Before a first shipment, a purchaser must give VIP Supply a copy of each professional licence, registration or permit that authorises the purchaser to buy and hold the products being bought, showing its number, its issuing authority and its expiry date. A professional licence or registration number is a government identifier, and Section 1 puts a government identifier inside Sensitive Personal Information. VIP Supply uses that number only to check that a purchaser may lawfully hold a product, to re-check it at least once every twelve (12) months and on each renewal date given, and to decide whether to dispatch. VIP Supply does not use it to infer a characteristic about any person, does not sell it and does not share it. The copy and the number reach VIP Supply by email at the mailbox named in Section 3, which forwards to a mail service Google operates, and they are held in that mailbox. No deletion period for that mailbox is recorded in the data map, so Exhibit A publishes none for it rather than publishing a period nothing carries out, and Section 13.4 says the same.

5. How the Services Collect It

5.1 The Services collect Personal Information directly from a person when that person completes and submits the contact form. The name, the email address and the message have to be completed for the form to be accepted; the organisation name, the telephone number and the topic are optional. Exhibit A records the length limit the code applies to each field.

5.2 The contact form carries one hidden field, named company_website, which no visitor sees. The Services never display that field, never read any value in it as part of the enquiry and never store any value from it. A submission that arrives with a value in that field is discarded as automated.

5.3 The Services capture the visitor's internet protocol address, the visitor's user-agent string and the date and time of the submission from the connection itself. The internet protocol address is recorded in full: it is not shortened and it is not hashed. The user-agent string is cut to the first three hundred (300) characters.

5.4 The Services load Google Fonts from Google when a page renders, from the two domains named in the definition of Google Fonts in Section 1, and a page makes one request for the stylesheet and a further request for each font file it needs. Those are the only requests a page of the Services makes to anyone other than Namecheap. Section 12 describes what they reveal.

5.5 The Services do not receive Personal Information about a visitor from a data broker, from an advertising platform, from an analytics provider, from a payment processor, from a shipping carrier or from a public source.

5.6 The categories in Part 4 and Part 5 of Exhibit A are not collected by the website. A licensed purchaser, or a person acting for one, sends them to VIP Supply by email to the mailbox named in Section 3, or by telephone, fax or post to the numbers and the address in Section 3, because the Services run no customer portal, no customer login and no automated order or fulfilment system. What reaches the mailbox is held in the mailbox, which forwards to a mail service Google operates. No system other than that mailbox is recorded in the data map as holding any of it, and Section 13.6 says what that means for how long it is kept.

6. Why VIP Supply Uses It

6.1 To read an enquiry sent through the contact form and to reply to it, including by telephone or by email to the address the person gave.

6.2 To decide whether the person who sent an enquiry is a licensed purchaser VIP Supply can supply, which is why the form asks for an organisation name. The topic field is used to route the enquiry to the right part of the business, which is the purpose Exhibit A states for it.

6.3 To check that a purchaser may lawfully buy and hold a product, to re-check it, to dispatch a shipment to an address and a person that a licence covers, to answer a claim about a shipment, to issue a refund to the method a charge was taken from, and to answer a dispute a cardholder raises with a card issuer. Those are the purposes of the categories in Part 4 of Exhibit A, and Part 4 states the purpose of each one.

6.4 To refuse abusive and automated submissions, which is the only purpose of the Submission Guard and of the four records Section 8 describes.

6.5 To keep a record of an enquiry VIP Supply received and of the reply it sent.

6.6 VIP Supply does not use Personal Information collected through the Services for any purpose that is not in this Section 6 and in Exhibit A. VIP Supply does not advertise to a person using Personal Information collected through the Services, does not send marketing email from the contact form, and does not use Personal Information collected through the Services to train, fine-tune or evaluate a machine-learning or artificial-intelligence model.

7. Sensitive Personal Information

7.1 The contact form does not ask for Sensitive Personal Information, does not infer it and has no field for it. Part 1, Part 2 and Part 3 of Exhibit A record no sensitive category.

7.2 Opening an account does collect one category that is sensitive under Section 1: the number on a professional licence, registration or permit, which is a government identifier. Section 4.6 states what VIP Supply does with that number and what it does not do with it. VIP Supply collects it only to check and re-check that a purchaser may lawfully hold a product, which is the purpose for which the purchaser gives it, and uses it for nothing else.

7.3 Whether a collection of that kind requires this Policy to publish a notice about limiting the use of Sensitive Personal Information, or a link for requesting that limit, and whether a separate consumer-health-data notice is required at all, are open questions. No such link is published today. This Policy states that as a position and a dependency, not as a conclusion, and Exhibit B says the same.

7.4 The message field is free text with no length limit, so a person can type anything into it, including information about a patient or a health condition. VIP Supply asks a person not to put Sensitive Personal Information, a patient identifier, a government identifier or a payment-card number into the message field. Where a person does so anyway, that text is held in the Enquiry Log and in the forwarded mailbox copy on the same terms as the rest of the enquiry, and VIP Supply will delete it on a Rights Request under Section 16.

8. The Submission Guard and the Cross-Site Offender Ledger

8.1 In plain words, and this is the part of this Policy most easily missed: an email address or an internet protocol address recorded as an abusive sender on any one of the eighteen (18) websites on the same hosting account is refused on the others as well, and the Services are one of those eighteen (18) websites. A person who was blocked somewhere else on that hosting account can therefore find that an enquiry to VIP Supply does not arrive, and a person blocked here can find the same thing on the other seventeen websites.

8.2 The Offender Ledger is the record that does this. It holds an entry keyed to an email address and an entry keyed to an internet protocol address, it is held for thirty (30) calendar days from the day the entry is made, and it is the same single record for all of those websites rather than a copy per website.

8.3 The Submission Guard also keeps, for twenty-four (24) hours from the time of a submission, the times of earlier submissions from the same internet protocol address and a signature of the submission computed with the sha256 algorithm from three inputs: the internet protocol address, the name of the form and the body of the message. VIP Supply uses those two records only to recognise a repeat of the same submission from the same place.

8.4 The Refusal Log records the internet protocol address, the user-agent string, the email address and the name given on a submission the Submission Guard refuses.

8.5 The Submission Guard, the Offender Ledger, the Refusal Log and the records in Section 8.3 sit in a directory outside the part of the server that serves web pages, so a visitor cannot reach any of them from a browser.

9. Who Receives It

9.1 Namecheap receives Personal Information because the Services, the Enquiry Log, the Offender Ledger and the Refusal Log sit on a shared hosting account Namecheap provides in the United States.

9.2 Google receives the contents of an enquiry, because the mailbox named in Section 3 forwards an enquiry email to a mail service Google operates. Google separately receives a visitor's internet protocol address through Google Fonts, as Section 12 describes.

9.3 The operators of the other websites on the same hosting account that use the Submission Guard (seventeen of them as at November 4, 2026) see the effect of the Offender Ledger on their own websites, because the Offender Ledger is one shared record rather than a copy per website.

9.4 VIP Supply will also disclose Personal Information to a professional adviser it instructs, to a party to a transaction involving the business of VIP Supply, and to a government body where the law requires it.

9.5 The Services send Personal Information to no advertising network, to no analytics provider, to no data broker and to no partner or affiliate website the Services link to. Exhibit A names the categories of recipient for each category of Personal Information, and VIP Supply does not disclose Personal Information to a recipient outside those categories.

9.6 The categories in Part 4 and Part 5 of Exhibit A reach VIP Supply at the mailbox named in Section 3, so Google receives them as the operator of the mail service that mailbox forwards to. Namecheap does not receive them, because they are not written to the Enquiry Log or to any file on the hosting account. A carrier receives a delivery address and the name of the person who is to receive a shipment, because a shipment cannot be delivered without them. Exhibit A Part 4 states the recipient of each category, and VIP Supply discloses none of them to anyone else except as Section 9.4 describes.

10. Selling, Sharing and Targeted Advertising

10.1 VIP Supply does not sell Personal Information collected through the Services, in the sense several state laws give the word "sell", which reaches a disclosure for money and a disclosure for any other thing of value.

10.2 VIP Supply does not share Personal Information collected through the Services for cross-context behavioural advertising, in the sense several state laws give the word "share". The Services run no advertising pixel, no advertising tag and no advertising software kit, which is the thing that most often turns a website into a seller or a sharer without anyone intending it.

10.3 VIP Supply does not use Personal Information collected through the Services for targeted advertising, and does not disclose it to anyone else for that purpose.

10.4 Nothing is sold and nothing is shared, so this Policy publishes no opt-out link for the sale or the sharing of Personal Information, and the Services have no such link to honour. There is nothing on the Services that a browser or device opt-out signal, including the signal commonly called global privacy control, would stop. If VIP Supply ever adds an advertising pixel, a tag or an analytics tool to the Services, VIP Supply will publish those links and will honour that signal before the tool is switched on.

10.5 VIP Supply does not charge a different price, and does not give a different level of service, because a person exercised a right under this Policy. The Services publish no price and run no loyalty or discount programme, so there is no financial-incentive notice to publish.

10.6 The sharing of the Offender Ledger across the websites on the hosting account that use the Submission Guard (eighteen of them as at November 4, 2026) described in Section 8 is not a sale and is not sharing for cross-context behavioural advertising. It is an abuse-prevention use, and Section 8 describes it in full so that nobody has to read it out of the word "share".

11. Automated Refusal of a Submission

11.1 The Submission Guard decides whether to accept or refuse a submission without a person looking at it, using the records described in Section 8 and the hidden field described in Section 5.2.

11.2 The effect of a refusal is that the enquiry does not reach VIP Supply and no reply goes out. Nothing else follows from a refusal: it changes no price, no eligibility and no account, because the Services have no account and publish no price.

11.3 A person whose submission is refused may write to the mailbox named in Section 3 from a different address, or may telephone the number in Section 3. VIP Supply will then read the enquiry by hand, and will delete an Offender Ledger entry it finds to be wrong.

11.4 The Services do not profile a person for advertising, for pricing or for eligibility, and VIP Supply makes no decision about a person by automated means alone that has a legal or similarly significant effect on that person. If VIP Supply begins to do either thing, VIP Supply will say so in this Section 11 and will offer the review the law requires.

12. Cookies, Analytics and Web Fonts

12.1 The Services set no cookie of any kind, and run no analytics tool, no advertising pixel, no tag manager, no session-recording or replay tool, no chat widget and no bot-detection widget. There is therefore no cookie notice and no consent banner to publish, because there is nothing for a visitor to accept, reject or switch off.

12.2 The Services do load Google Fonts, which means a visitor's browser makes a request to Google every time a page of the Services loads. That request reveals the visitor's internet protocol address to Google, and VIP Supply cannot see or control what Google does with it. VIP Supply receives nothing back from that request, and Google Fonts sets no cookie on the Services.

13. How Long VIP Supply Keeps It

13.1 Exhibit A states, for each category of Personal Information and for each place that category is held, the period for which it is held.

13.2 The Submission Guard code enforces two of those periods: the records described in Section 8.3 are kept for twenty-four (24) hours from the time of the submission, and an Offender Ledger entry is kept for thirty (30) calendar days from the day the entry is made.

13.3 The Enquiry Log has no deletion period. The code that writes it appends every accepted submission and deletes nothing, so the Enquiry Log grows without limit and holds every enquiry sent since the file was created. This Policy publishes that as the period, because publishing a shorter period that nothing carries out would be a promise VIP Supply breaks every day. VIP Supply will set a deletion period for the Enquiry Log, will implement it in the code, and will publish it in Exhibit A when it is implemented.

13.4 No deletion period is recorded in the data map for the Refusal Log or for the mailbox copy of an enquiry, so Exhibit A publishes no period for either and records both as not established.

13.5 Where VIP Supply finds that it has held Personal Information past a period Exhibit A states, VIP Supply will delete the excess within thirty (30) calendar days after the day it finds it, and will correct the setting that allowed it.

13.6 For the categories in Part 4 and Part 5 of Exhibit A, the only place the data map records as holding them is the mailbox named in Section 3 and the mail service it forwards to, and the data map records no deletion period for that mailbox. Exhibit A therefore publishes "not established" for each of those rows, for the same reason it does for the mailbox copy of an enquiry. Two of those rows carry a period VIP Supply has set for itself rather than one the data map records: the record of an appeal, which Section 17.3 keeps for at least twenty-four (24) months after the date of the answer, and the lot traceability record VIP Supply asks a purchaser to keep for three (3) years, which is a duty on the purchaser rather than a period VIP Supply holds anything for. VIP Supply will set a deletion period for the mailbox, will implement it, and will publish it in Exhibit A when it is implemented.

14. Security

14.1 This Section 14 describes the measures that are in place today and claims no others. The Submission Guard, the Offender Ledger, the Refusal Log and the records described in Section 8.3 sit in a directory outside the part of the server that serves web pages. The Enquiry Log sits outside that part of the server as well. This Policy does not state how many people hold credentials for the hosting account or for the mailbox, because nothing on file records it.

14.2 The Services run on a shared hosting account, which means the server also runs other websites, and Namecheap's own personnel have access to that server as its operator. VIP Supply has not had an independent security review of the Services or of the hosting account, and this Policy does not claim encryption of the Enquiry Log at rest, a logged record of administrative access, a list of authorised administrators, or any certification.

14.3 No method of transmission or storage is completely secure, and VIP Supply does not promise that the Services cannot be breached.

14.4 Where a breach of security affecting Personal Information happens, VIP Supply will notify the people and the regulators that applicable law requires it to notify, within the period that law sets. This Policy does not state a number of days for that, because the number depends on the law that applies.

15. Where the Information Is Processed

15.1 VIP Supply is in the United States and the hosting account Namecheap provides is in the United States.

15.2 Google operates its mail service and Google Fonts from infrastructure in more than one country, and the data map does not record which country processes an enquiry forwarded to the mailbox or a font request from a visitor.

15.3 VIP Supply relies on no transfer mechanism for moving Personal Information out of any other country, because the Services are not directed to buyers outside the United States and VIP Supply has put none in place.

16. Rights and How to Exercise Them

16.1 The rights a person has depend on where that person lives, and may include the right to know what Personal Information VIP Supply holds, to get a copy of it in a portable form, to correct it, to delete it, to limit the use of it, to withdraw a consent, and not to be treated differently for exercising a right. Where a state gives a person a right this Policy does not describe, that right still applies to that person.

16.2 A Rights Request goes to the mailbox named in Section 3. The Services publish no rights-request form, because the Services hold no account a person could log into. An authorised agent may make a Rights Request for another person, with written permission from that person.

16.3 VIP Supply acknowledges a Rights Request within ten (10) Business Days after the day it receives the Rights Request, and answers it within forty-five (45) calendar days after the day it receives the Rights Request. VIP Supply may extend that period once, by a further forty-five (45) calendar days, by telling the requester the reason before the first period ends.

16.4 VIP Supply verifies who is making a Rights Request before acting on it, by matching what the requester gives against what the Enquiry Log already holds, which for most requesters is the email address and the name on an earlier enquiry. Where VIP Supply cannot verify the requester, VIP Supply will withhold the information, will say why, and will tell the requester how to appeal under Section 17.

16.5 A Rights Request to delete reaches the Enquiry Log, the Refusal Log, the Offender Ledger, the forwarded mailbox copy of an enquiry, and the records in Part 4 and Part 5 of Exhibit A that are held in that mailbox. Because the Offender Ledger is one shared record for all of those websites on the hosting account rather than a copy per website, deleting an Offender Ledger entry removes it for all of those websites at once.

16.6 A deletion of the mailbox copy reaches the message in the mailbox and the message in its trash. It does not reach whatever the mail provider keeps in its own systems after that, because the data map does not record what the provider keeps or for how long, and Section 15.2 says the data map does not record which country processes it either. VIP Supply will ask the provider and will publish the answer in Exhibit A.

16.7 Where the law allows VIP Supply to keep Personal Information that a deletion request would otherwise reach, VIP Supply will say so in its answer to the request and will say which record it is keeping and why. A licence verification record and a claim file are the two most likely cases, because VIP Supply uses them to show that it released a product only to a purchaser it had verified.

16.8 VIP Supply will not charge for a Rights Request, except where a request is repetitive or excessive, in which case VIP Supply will say so and will give the requester the choice to withdraw the request.

17. Appeals

17.1 A requester whose Rights Request VIP Supply refuses may appeal by writing to the mailbox named in Section 3 with the word "appeal" in the subject line, within forty-five (45) calendar days after the date of the refusal.

17.2 VIP Supply answers an appeal in writing, with its reasons, within sixty (60) calendar days after the day it receives the appeal, and the answer tells the requester how to complain to a regulator under Section 20.

17.3 VIP Supply keeps a record of each appeal and its outcome for at least twenty-four (24) months after the date of the answer.

18. Children

18.1 The Services are an information site for verified licensed purchasers. They are not directed to a child under thirteen (13) years old, and VIP Supply does not knowingly collect Personal Information from a child under thirteen (13).

18.2 A parent or guardian who believes a child under thirteen (13) has sent Personal Information through the contact form may write to the mailbox named in Section 3, and VIP Supply will delete that information within ten (10) Business Days after the day it verifies the request.

18.3 VIP Supply does not use the Personal Information of any person, of any age, for targeted advertising or profiling, as Section 10 and Section 11 state.

19. State-Specific Notices

19.1 Exhibit B lists the notices that specific states require a website to publish, what each one has to tell a visitor, and where the wording for it sits in this Policy.

19.2 Where a state gives a person a right or requires a notice that this Policy does not describe, the right and the requirement still apply, and nothing in this Policy limits either.

20. Complaints

20.1 A person who is unhappy with how VIP Supply handled Personal Information may write to the mailbox named in Section 3, and VIP Supply will answer within thirty (30) calendar days after the day it receives the complaint.

20.2 A person in the United States may also complain to the attorney general of that person's own state.

21. Governing Law, Venue and Individual Actions

21.1 This Section 21 is VIP Supply's own position on where a dispute about this Policy would be dealt with. It is not an agreement, because nobody signs a privacy policy, and it does not take a right away from anyone.

21.2 VIP Supply's position is that Texas law governs a dispute arising out of or relating to this Policy, without giving effect to a conflict-of-laws rule that would apply the law of another state, and that the state and federal courts located in Harris County, Texas are the forum for it. VIP Supply's position is that such a dispute is for a court and not for arbitration, and this Policy contains no arbitration clause.

21.3 VIP Supply's position is that a dispute about this Policy is brought in an individual capacity, and not as a claimant or a member in a class, collective or representative proceeding.

21.4 A consumer-protection statute of the state a visitor lives in applies to that visitor whatever this Section 21 says. This Section 21 is about which forum hears a dispute. It does not reduce what a visitor is entitled to under the visitor's own state law, and it does not reduce what VIP Supply is answerable for.

21.5 This Policy contains no clause about who pays anyone's legal costs.

Exhibit A — Data Inventory and Retention Schedule

Exhibit A version 1.0, dated November 4, 2026. Every row is a field or a record that the code actually handles. No row describes a practice the code does not perform.

Part 1 — What a person types into the contact form

Part 2 — What the Services capture from the connection, with nobody typing it

Part 3 — What the Submission Guard derives, and keeps separately

Part 4 — What account opening, ordering, dispatch, a claim and a refund collect, away from the website

Every row in this Part is a category the Terms and Conditions, the Shipping and Delivery Policy or the Return and Refund Policy requires a purchaser to give VIP Supply, or a category VIP Supply records in carrying out those documents. None of it comes through the contact form. All of it reaches VIP Supply by email at the mailbox named in Section 3, or by telephone, fax or post to the numbers and the address in Section 3, and what reaches the mailbox is held in the mailbox, which forwards to a mail service Google operates. Section 5.6 and Section 13.6 say what that means.

Part 5 — What a Rights Request and an appeal collect

Notes on Exhibit A

A1. The column that asks whether a category is sold or shared carries the meaning several state laws give those two words: a disclosure of Personal Information for money or for any other thing of value, and a disclosure of it for cross-context behavioural advertising. The answer is no on every row of Exhibit A. The sharing of the Offender Ledger across eighteen (18) websites is a different thing, it is disclosed in its own right in Section 8, and the third table in Exhibit A gives it its own row.

A2. No row of Part 1, Part 2 or Part 3 records a sensitive category, because the contact form asks for none. Section 7.4 covers what happens where a person types a sensitive category into the free-text message field anyway, and note A5 covers Part 4.

A3. Where a retention cell reads "not established", the data map records no deletion period for that file or that mailbox, so this Policy publishes none rather than publishing one that nothing carries out. Section 13.3, Section 13.4 and Section 13.6 say the same thing in the body of this Policy. Every row in Part 4 and almost every row in Part 5 reads that way, because the mailbox is the only place the data map records as holding them.

A4. Transfer mechanism for Personal Information leaving the United States: none is in place, and VIP Supply relies on none. Section 15 explains why.

A5. Part 4 records one sensitive category, the number on a professional licence, registration or permit, and Section 4.6, Section 7.2 and Section 7.3 state what follows. Part 1, Part 2 and Part 3 record none, and note A2 is about those three.

Exhibit B — State-Specific Notices

Exhibit B version 1.0, dated November 4, 2026.