Privacy Policy

1. Information We Collect

When you visit our website or place an order, we may collect the following types of information:

• Contact information — name, email address, shipping address, phone number
• Payment information — we do not process card payments and do not store card numbers. For manual bank transfers (e.g., Zelle), we receive the order amount and the sender name/contact you provide so we can match your transfer; the transfer itself is handled by your bank
• Account credentials — hashed passwords and email address for account holders
• Order history — products ordered, quantities, and transaction records
• Technical data — IP address, browser type, pages visited, time on site, referral source
• Communications — messages sent through our contact form or support system

2. How We Use Your Information

We use the information we collect for the following purposes:

• Processing and fulfilling your orders, including shipping and delivery
• Sending order confirmations, shipping updates, and support responses
• Managing your account and authentication
• Complying with legal obligations, including identity verification for age compliance
• Detecting and preventing fraudulent activity, abuse, or policy violations
• Improving our website, products, and customer service
• Analyzing aggregate traffic and usage patterns (non-personally identifiable)

3. Information Sharing

PeptaCo LLC does not sell, rent, or trade your personal information to third parties. We may share your data only in the following limited circumstances:

• Service providers (processors): our database/hosting provider (Supabase) and application host (Vercel); our transactional and marketing email provider (Resend); analytics (Google Analytics 4, in consent mode); the shipping carrier used to deliver your order (e.g., FedEx); and, for manual bank-transfer payments, our bank. Each processes data only as needed to provide its service to us
• Legal compliance: When required by law, court order, or to protect the rights and safety of PeptaCo LLC or others
• Business transfers: In connection with a merger, acquisition, or sale of all or part of our business, where your data may be transferred as a business asset

4. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including order records required for legal or accounting compliance. Account data is retained until you request deletion. Support tickets are retained for a minimum of 3 years.

5. Cookies and Tracking

Our website uses browser cookies and localStorage to maintain session state, remember your cart contents, and analyze site usage. We do not use third-party advertising trackers. You may clear cookies at any time through your browser settings; however, this may affect cart and login functionality.

We use Google Analytics 4 to understand how visitors use our site (pages viewed, traffic sources, device type, approximate geographic region). This data is pseudonymized. We do not send personally identifiable information to Google, and IP addresses are anonymized. Google Analytics sets first-party cookies that expire after up to two years. You can opt out at any time by installing the Google Analytics Opt-out Browser Add-on or by enabling "Do Not Track" / private browsing in your browser. Authenticated areas of the site (account, checkout, order confirmation, support tickets, admin) are excluded from analytics tracking.

On your first visit, a consent banner asks whether to enable analytics cookies. If you click Decline, Google Analytics runs in consent-denied mode and will not store identifiers or cross-session data. Your choice is saved locally; to change it later, clear your browser's site data for this domain and the banner will reappear on your next visit.

6. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Know and access the personal information we hold about you, including the categories collected, the purposes, and the categories of third parties it is disclosed to
• Correct inaccurate personal information
• Request deletion of your personal information
• Request a portable copy of your data
• Withdraw consent where processing is based on consent
• Opt out of the “sale” or “sharing” of personal information (see below)
• Not receive discriminatory treatment for exercising any of these rights
• Use an authorized agent to submit a request on your behalf
• Appeal a denied request, and/or lodge a complaint with a data-protection authority (including the California Privacy Protection Agency or, for EU/UK residents, your local supervisory authority)

To exercise any of these rights, email info@peptapeptides.com or submit a support ticket. We verify your request against the account/order information we hold and respond within the timeframe required by applicable law (generally 45 days under the CCPA/CPRA, extendable once; about one month under the GDPR/UK GDPR).

California “Do Not Sell or Share My Personal Information.” PeptaCo LLC does not sell your personal information, and does not “share” it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We do not use third-party advertising trackers. The only analytics processing we perform (Google Analytics 4, in privacy/consent mode — see Section 5) can be declined at any time through the cookie-consent banner or the Google Analytics opt-out add-on; that is your opt-out. The categories of personal information we collect are listed in Section 1; we retain them as described in Section 4 and do not collect or use sensitive personal information for purposes that require a separate opt-out.

EU/UK residents (GDPR). Where the GDPR or UK GDPR applies, our lawful bases for processing are: performance of a contract (processing and shipping your order), compliance with a legal obligation (tax, accounting, age/eligibility), our legitimate interests (fraud prevention, securing and improving the site), and your consent (analytics cookies and any optional marketing email). You may object to processing based on legitimate interests and withdraw consent at any time. Data may be processed in the United States; we rely on appropriate safeguards for any such transfer.

7. Security

We implement industry-standard security measures to protect your data, including encrypted connections (HTTPS), hashed password storage, and access controls. No method of transmission over the internet is 100% secure; however, we take all reasonable precautions to protect your information.

8. Children's Privacy

Our website and products are intended solely for adults aged 21 or older. We do not knowingly collect personal information from minors, and in no case from children under 13 (consistent with the Children's Online Privacy Protection Act). If we become aware that a person under 21 has provided personal data in connection with a purchase, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. Continued use of our website after any changes constitutes acceptance of the updated policy.

10. Contact

This site is operated by PeptaCo LLC (operating the “PeptaPeptides” store), an Arizona limited liability company, which is the controller of your personal information. For questions, concerns, or privacy requests:

PeptaCo LLC
Mailing address: [BUSINESS MAILING ADDRESS — PENDING]
Email: info@peptapeptides.com
Or submit a support ticket →