Privacy Policy

We collect the following categories of personal information, as defined under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Cal. Civ. Code § 1798.140:

• Identifiers — name, email, phone number, shipping address, account login.
• Customer records — order history, payment confirmation references (we do not store card numbers).
• Commercial information — products purchased or considered, subscription details.
• Internet/network activity — IP address, device and browser type (user-agent), pages viewed, referrer, and timestamps via server logs. When you place an order or accept our research-use consent, the IP address and user-agent in effect are attached to that order, subscription, or consent record as a fraud-prevention and security measure and as the legal record of your acknowledgment; these fields are visible only to our administrators and are retained with the associated record (see Section 6).
• First-party site analytics— to understand aggregate site usage we record page views, product views, and cart/checkout events along with the page path, referrer, and a random per-session identifier kept in your browser's session storage (discarded when you close the tab). This analytics store contains no name, email, IP address, or user-agent and is not linked to your account.
• Geolocation data — coarse location inferred from IP for shipping eligibility and fraud screening only; no precise GPS data is collected.
• Inferences — research-domain interest segments used to tailor catalog and update emails.

To process and ship orders, provide customer support, operate and secure the platform, comply with legal obligations, prevent fraud, and communicate research updates and offers you have explicitly opted into via double opt-in.

We do not sell personal information for monetary consideration. We share data only with:

• Payment processors for order settlement (currently inactive; will be added when an active processor is connected).
• Shipping carriers (USPS, UPS, FedEx as applicable) to deliver orders.
• Email provider (Resend) for transactional messages such as order confirmations, shipping updates, and password resets.
• Marketing platform (Klaviyo) — when you create an account, begin checkout, or place an order we send Klaviyo your name, email, and (if provided) phone number to create and maintain your customer profile and to send transactional and consented marketing email. We do not currently send SMS messages.
• Hosting and analytics infrastructure (Vercel, Neon Postgres) under data-processing agreements that prohibit secondary use.
• Law enforcement or regulators when legally required by subpoena, court order, or applicable statute.

We do not currently share your personal information with third-party advertising or analytics partners for cross-context behavioral advertising, and we use no third-party advertising or social-tracking pixels. If that ever changes, California residents can opt out using the request channels below.

We keep cookies to a minimum. The site sets two first-party cookies: a session cookie (“payload-token”), which is HttpOnly and Secure and keeps you signed in, and a small non-sensitive flag (“vert_account”) used only to show account-aware navigation — it contains no personal information. Your cart and the per-session analytics identifier are stored in your browser's session storage rather than in cookies, and are cleared when you close the tab.

Vercel Analytics and Speed Insights, which we use to measure aggregate site performance, are cookieless — they set no cookies and do not track you across other sites. We do not use third-party advertising or social-tracking pixels on this site and we do not build cross-site advertising profiles.

Our first-party usage analytics run only after you opt in via the consent banner, and we automatically honor a Global Privacy Controlor Do-Not-Track signal as an opt-out (analytics stays off and no banner is shown). You can change your choice at any time using the “Your privacy choices” link in the site footer.

We employ HTTPS (TLS 1.3) for all transport, HttpOnly + Secure session cookies, server-side input validation, rate limiting on authentication endpoints, row-level access controls, and encryption at rest provided by our hosting provider. Payment processing (when activated) is offloaded to PCI-DSS-compliant processors; card numbers never touch our servers.

We retain personal information for as long as your account is active or as required to fulfill our legal, accounting, and regulatory obligations:

• Account data — for the life of the account plus seven years after deletion (tax / financial records requirement for ecommerce merchants).
• Order history — seven years from order date.
• Server and audit logs — twelve months, then aggregated or deleted.
• Email opt-in records — retained for as long as consent is active plus three years after withdrawal.
• First-party analytics events — identity-free (no name, email, or IP) and retained for aggregate trend analysis.

Depending on your jurisdiction you may have rights to:

• Know what personal information we have collected about you and how it has been used or disclosed.
• Access or receive a portable copy of your personal information.
• Correct inaccurate personal information.
• Delete personal information we hold, subject to applicable retention obligations.
• Opt out of sharing for cross-context behavioral advertising (CPRA § 1798.120).
• Limit use of sensitive personal information.
• Non-discrimination for exercising any privacy right.

If you have an account, you can exercise the most common rights yourself at any time from your account privacy page, which lets you download a portable copy of your data and permanently delete your account on the spot. You can also exercise any of these rights by emailing contact@vertpeptides.com with the subject “Privacy Request” and a description of your request. We will respond within forty-five (45) days as required by California law (Cal. Civ. Code § 1798.130(a)(2)); a single forty-five-day extension may apply if reasonably necessary. We will verify your identity before fulfilling the request. Authorized agents may submit requests on your behalf with written permission.

Do Not Sell or Share My Personal Information — California residents may use this link to opt out of sharing for cross-context behavioral advertising. We do not currently sell personal information for monetary consideration; this link ensures the same protection if our practices ever change. We also honor an opt-out signaled by your browser's Global Privacy Control.

For visitors in the European Economic Area, United Kingdom, or Switzerland, we process personal data on the following Article 6 lawful bases: performance of a contract (processing orders, account creation), legitimate interests (fraud prevention, site security, analytics necessary for service quality), consent (marketing email), and legal obligation (tax records, regulatory cooperation). You may withdraw consent at any time without affecting prior processing. Contact us using the channel in Section 7 to exercise GDPR rights of access, rectification, erasure, restriction, data portability, or objection.

VERT Peptides is restricted to qualified researchers aged 21 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact contact@vertpeptides.com with the subject “Minor Data Removal” and we will delete the data within thirty (30) days without retaining it for internal use.

We are based in the United States and our infrastructure is hosted in US-based data centers. If you access the site from outside the US your data may be transferred to and processed in the US, which may not provide the same privacy protections as your home jurisdiction. For EEA/UK transfers we rely on the European Commission's Standard Contractual Clauses with our processors.

We may update this policy from time to time. The “Updated” date at the top of this page reflects the most recent revision. Material changes will be communicated by email to active account holders at least thirty (30) days before they take effect. Continued use of the site after the effective date constitutes acceptance of the current version.

Questions about this policy or your data: contact@vertpeptides.com.