Privacy Policy

We collect the following categories of personal information, as defined under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Cal. Civ. Code § 1798.140:

• Identifiers — name, email, phone number, shipping address, account login.
• Customer records — order history, payment confirmation references (we do not store card numbers).
• Commercial information — products purchased or considered, subscription details.
• Internet/network activity — IP address, device and browser type (user-agent), pages viewed, referrer, and timestamps via server logs. When you place an order or accept our research-use consent, the IP address and user-agent in effect are attached to that order, subscription, or consent record as a fraud-prevention and security measure and as the legal record of your acknowledgment; these fields are visible only to our administrators and are retained with the associated record (see Section 6).
• First-party site analytics— to understand aggregate site usage we record page views, product views, and cart/checkout events along with the page path, referrer, and a random per-session identifier kept in your browser's session storage (discarded when you close the tab). This analytics store contains no name, email, IP address, or user-agent and is not linked to your account.
• Geolocation data — coarse location inferred from IP for shipping eligibility and fraud screening only; no precise GPS data is collected.
• Inferences — research-domain interest segments used to tailor catalog and update emails.

To process and ship orders, provide customer support, operate and secure the platform, comply with legal obligations, prevent fraud, and communicate research updates and offers you have explicitly opted into via double opt-in.

We do not sell personal information for monetary consideration. We share data only with:

• Payment processors for order settlement (currently inactive; will be added when an active processor is connected).
• Shipping carriers (USPS, UPS, FedEx as applicable) to deliver orders.
• Email provider (Resend) for transactional messages such as order confirmations, shipping updates, and password resets.
• Marketing platform (Klaviyo) — when you create an account, begin checkout, or place an order we send Klaviyo your name, email, and (if provided) phone number to create and maintain your customer profile and to send transactional and consented marketing email. If you separately tick the box asking us to text you, we also send Klaviyo your mobile number and the date you agreed, and you may then receive recurring automated marketing text messages, including reminders about items left in your cart. Agreeing to texts is never a condition of buying anything, message frequency varies, and message and data rates may apply. Reply STOP to any message to stop them, or HELP for help. You can withdraw either consent at any time without affecting the other.
• Hosting and analytics infrastructure (Vercel, Neon Postgres) under data-processing agreements that prohibit secondary use.
• Law enforcement or regulators when legally required by subpoena, court order, or applicable statute.

We share a limited set of order information with Meta Platformsfor advertising measurement. When you place an order we send Meta a cryptographically hashed form of your email address, name, and delivery city, state, postcode and country, together with the order value and the items purchased, so that Meta can tell us whether an advertisement led to the sale. We do not send your email address or name in readable form, and we send nothing for visitors who do not place an order. Under the California Consumer Privacy Act this is a “share” for cross-context behavioral advertising, and California residents may opt out at any time using the request channels below or the “Do Not Sell or Share My Personal Information” link in the site footer.

We keep cookies to a minimum, and we set no advertising cookies at all. The site sets these first-party cookies: a session cookie (“payload-token”), which is HttpOnly and Secure and keeps you signed in; a small non-sensitive flag (“vert_account”) used only to show account-aware navigation; a flag recording that you completed the required agreements (“vert_onboarded”); a flag recording your analytics choice (“vert_consent”); and a flag recording that you confirmed you are 21 or older and a qualified researcher (“vert_age_ok”). None of them contains personal information. Your cart and the per-session analytics identifier are stored in your browser's session storage rather than in cookies, and are cleared when you close the tab.

Vercel Analytics and Speed Insights, which we use to measure aggregate site performance, are cookieless — they set no cookies and do not track you across other sites. We also run Google Tag Manager, which loads Google Analytics. It runs on every visit, sets Google's cookies, and is used for usage and advertising measurement. We also run the Meta Pixel, which does set cookies and is used for advertising measurement. It loads only after you accept in the consent banner; if you decline, or if your browser sends a Global Privacy Control or Do-Not-Track signal, it is never loaded at all.

Our first-party usage analytics run only after you opt in via the consent banner, and we automatically honor a Global Privacy Controlor Do-Not-Track signal as an opt-out (analytics stays off and no banner is shown). You can change your choice at any time using the “Your privacy choices” link in the site footer.

We employ HTTPS (TLS 1.3) for all transport, HttpOnly + Secure session cookies, server-side input validation, rate limiting on authentication endpoints, row-level access controls, and encryption at rest provided by our hosting provider. Payment processing (when activated) is offloaded to PCI-DSS-compliant processors; card numbers never touch our servers.

We retain personal information for as long as your account is active or as required to fulfill our legal, accounting, and regulatory obligations:

• Account data — for the life of the account plus seven years after deletion (tax / financial records requirement for ecommerce merchants).
• Order history — seven years from order date.
• Server and audit logs — twelve months, then aggregated or deleted.
• Email opt-in records — retained for as long as consent is active plus three years after withdrawal.
• First-party analytics events — identity-free (no name, email, or IP) and retained for aggregate trend analysis.

Depending on your jurisdiction you may have rights to:

• Know what personal information we have collected about you and how it has been used or disclosed.
• Access or receive a portable copy of your personal information.
• Correct inaccurate personal information.
• Delete personal information we hold, subject to applicable retention obligations.
• Opt out of sharing for cross-context behavioral advertising (CPRA § 1798.120).
• Limit use of sensitive personal information.
• Non-discrimination for exercising any privacy right.

If you have an account, you can exercise the most common rights yourself at any time from your account privacy page, which lets you download a portable copy of your data and permanently delete your account on the spot. You can also exercise any of these rights by emailing contact@vertpeptides.com with the subject “Privacy Request” and a description of your request. We will respond within forty-five (45) days as required by California law (Cal. Civ. Code § 1798.130(a)(2)); a single forty-five-day extension may apply if reasonably necessary. We will verify your identity before fulfilling the request. Authorized agents may submit requests on your behalf with written permission.

Do Not Sell or Share My Personal Information — California residents may use this link to opt out of sharing for cross-context behavioral advertising. We do not sell personal information for monetary consideration. We doshare hashed order information with Meta Platforms for advertising measurement, as described in Section 3, and this link opts you out of that sharing. We also honor an opt-out signaled by your browser's Global Privacy Control.

For visitors in the European Economic Area, United Kingdom, or Switzerland, we process personal data on the following Article 6 lawful bases: performance of a contract (processing orders, account creation), legitimate interests (fraud prevention, site security, analytics necessary for service quality), consent (marketing email), and legal obligation (tax records, regulatory cooperation). You may withdraw consent at any time without affecting prior processing. Contact us using the channel in Section 7 to exercise GDPR rights of access, rectification, erasure, restriction, data portability, or objection.

v e r t peptides is restricted to qualified researchers aged 21 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact contact@vertpeptides.com with the subject “Minor Data Removal” and we will delete the data within thirty (30) days without retaining it for internal use.

We are based in the United States and our infrastructure is hosted in US-based data centers. If you access the site from outside the US your data may be transferred to and processed in the US, which may not provide the same privacy protections as your home jurisdiction. For EEA/UK transfers we rely on the European Commission's Standard Contractual Clauses with our processors.

We may update this policy from time to time. The “Updated” date at the top of this page reflects the most recent revision. Material changes will be communicated by email to active account holders at least thirty (30) days before they take effect. Continued use of the site after the effective date constitutes acceptance of the current version.

Questions about this policy or your data: contact@vertpeptides.com.