Privacy policy
Effective 10 September 2026. We collect what an order and a research relationship need, keep it only as long as that need lasts, and never sell it. This page says exactly what that means.
What do we collect?
| When | What | Why |
|---|---|---|
| You place an order | Name, organisation, email, phone, shipping and billing address, order contents, payment confirmation (we never see full card numbers) | To fulfil, ship and support the order, and to keep the records that tax and product-traceability rules require |
| You subscribe or request a code | Email address, the date, the offer requested | To send lot reports, guides and the code you asked for |
| You contact support | Whatever you include in the message, plus your email | To answer you and keep a record of the conversation |
| You browse | Server logs (IP address, pages, browser), a local flag that remembers you have seen the first-order offer, and your cart contents stored in your own browser | To run the site, keep it secure, and not show you the same offer twice |
How is it used?
Order data is used to process, ship and support your order and to verify research-use eligibility. Email addresses on the list receive lot reports, new-compound announcements and guides, at most a few times a month, each with an unsubscribe link. We may use aggregated, anonymised browsing data to see which pages are read. We do not use your data for automated decisions with legal effect, and we do not sell or rent it to anyone.
Who is it shared with?
Only the providers needed to serve you: the carrier that delivers the parcel, the payment processor that takes payment, the email service that sends confirmations and newsletters, and the hosting provider that runs the site. Each receives only what its task requires and is bound by its own privacy terms. We disclose data to authorities when the law requires it, and we will tell you if we are permitted to.
Cookies and local storage
The site sets no advertising cookies. It uses your browser's local storage for two things: your cart, and a flag that records that the first-order offer has been shown. Both live only in your browser and are never sent to us. Analytics, when enabled, use a first-party, cookie-light configuration; the tool in use is listed here when installed.
How long is it kept?
Order records are kept for 7 years to meet tax and traceability obligations. Support conversations are kept for 2 years. Email-list addresses are kept until you unsubscribe. Server logs are kept for 90 days.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Residents of California, the European Economic Area and the United Kingdom have additional statutory rights, including the right to object to processing and to lodge a complaint with a supervisory authority. Write to privacy@pepstral.com; we respond within 30 days.
Security
The site is served over HTTPS. Payment is handled by the processor on its own secured pages; card details never touch our servers. Access to order data is limited to the people who fulfil and support orders.
Children
The site and its products are for adults aged 21 and over. We do not knowingly collect data from anyone younger, and we delete it if we learn we have.
Changes and contact
We update this page when our practices change and show the effective date at the top. Questions go to privacy@pepstral.com or by post to Pepstral Peptides, W4637 Lakepark Drive, Fond du Lac, WI 54935 .
