Privacy policy
Effective 26 October 2026. We collect what an order and a research relationship need, keep it only as long as that need lasts, and never sell it. This page says exactly what that means.
What do we collect?
| When | What | Why |
|---|---|---|
| You place an order | Name, organisation, email, phone, shipping and billing address, order contents, payment confirmation (we never see full card numbers) | To fulfil, ship and support the order, and to keep the records that tax and product-traceability rules require |
| You subscribe or request a code | Email address, the date, the offer requested | To send lot reports, guides and the code you asked for |
| You contact support | Whatever you include in the message, plus your email | To answer you and keep a record of the conversation |
| You browse | Server logs (IP address, pages, browser), a local flag that remembers you have seen the first-order offer, and your cart contents stored in your own browser | To run the site, keep it secure, and not show you the same offer twice |
How is it used?
Order data is used to process, ship and support your order and to verify research-use eligibility. Email addresses on the list receive lot reports, new-compound announcements and guides, at most a few times a month, each with an unsubscribe link. We may use aggregated, anonymised browsing data to see which pages are read. We do not use your data for automated decisions with legal effect, and we do not sell or rent it to anyone.
Who is it shared with?
Only the providers needed to serve you: the carrier that delivers the parcel, the payment processor that takes payment, the email service that sends confirmations and newsletters, and the hosting provider that runs the site. Each receives only what its task requires and is bound by its own privacy terms. We disclose data to authorities when the law requires it, and we will tell you if we are permitted to.
Cookies and local storage
Google Analytics and the Microsoft Advertising tag run by default, and you can switch them off at any time. We ship to US addresses only, where the standard is opt-out rather than opt-in, so we do not interrupt your first visit with a banner. To turn them off, open Cookie settings in the footer and choose Decline, or use Choose to allow one and not the other. Decline keeps the site exactly as it is: no Google script, no Microsoft script, nothing from a third party. Your answer is kept in your browser's local storage under pepstral_consent and you can change it again whenever you like. If your browser sends the Global Privacy Control signal we regard it as Decline automatically, without you doing anything and without showing you a notice. Vercel Web Analytics runs either way because it sets no cookie and stores no identifier, as described above.
The site sets advertising cookies only if you accept marketing in the cookie banner, and only while an advertising tag is configured, which it currently is — see the paragraph above. It uses your browser's local storage for two things: your cart, and a flag that records that the first-order offer has been shown. Both live in your browser. The offer flag stays there. Your cart stays there too until you begin checkout, at which point its contents are sent with your order so we can process and support it. We also keep two items in session storage that clear when you close the tab: your confirmation that you are ordering for research, and a key that stops a double submission creating two orders. Our email service is Resend, which sends order confirmations, reminders and the newsletter. It runs entirely on our servers: it loads no script into this site, sets no cookie in your browser and receives no page-view data. It is given your email address, your name where you supplied one, and the order or message the email is about. If you start a checkout and do not complete payment, we may send up to two reminder emails to the address you entered, each with a link that stops them. We use Google Analytics 4 to count visits and see which pages are read. It loads only after you accept analytics in the cookie banner; until then no Google script runs on this site. It sets first-party cookies in your browser (named _ga and similar, expiring after two years by default) to recognise a returning browser. You can block them in your browser settings or with Google's opt-out add-on, and the site works exactly the same. We also use Vercel Web Analytics, which runs on this domain rather than through a third party and sets no cookies at all. A visitor is counted as a hash worked out from the request, discarded after 24 hours, so there is no way to follow anyone between visits or onto another site. It records the page, the referring site, country and region, browser, operating system and device type — never your IP address. If you accept marketing in the cookie banner, we also use the Microsoft Advertising UET tag. This one is an advertising tracker: it loads from bat.bing.com and tells Microsoft that a browser visited this site, so that we can measure whether a Bing advert worked and show adverts to people who have been here before. It sets cookies. Microsoft receives the page you viewed and your IP address. It does not receive your name, your email address or what you ordered — our checkout is hosted by our fulfilment partner, so no completed order ever reaches it. You can opt out in Microsoft's ad settings or with any tracker blocker, and nothing on this site changes if you do.
How long is it kept?
Order records are kept for 7 years to meet tax and traceability obligations. Support conversations are kept for 2 years. Email-list addresses are kept until you unsubscribe. Server logs are kept for 90 days.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Write to privacy@pepstral.com; we respond within 30 days. We will ask you to confirm the email address the data is held under, so that we do not disclose it to someone else.
If you live in California you also have the right to know what we collect, use and disclose about you, the right to correct it, the right to delete it, and the right to opt out of its sale or sharing — we do not sell or share personal data, so there is nothing to opt out of, and if your browser sends the Global Privacy Control signal we honour it automatically. You may use an authorised agent. We will never deny you service, charge you a different price or give you a lesser experience for exercising any of these rights. Residents of the European Economic Area and the United Kingdom additionally have the right to object to processing and to lodge a complaint with a supervisory authority.
Security
The site is served over HTTPS. Payment is handled by the processor on its own secured pages; card details never touch our servers. Access to order data is limited to the people who fulfil and support orders.
Children
The site and its products are for adults aged 21 and over. We do not knowingly collect data from anyone younger, and we delete it if we learn we have.
Changes and contact
We update this page when our practices change and show the effective date at the top. Questions go to privacy@pepstral.com or by post to Pepstral LLC (trading as Pepstral Peptides), W4637 Lakepark Drive, Fond du Lac, WI 54935 .