Privacy policy

1. Controller

• [[LEGAL NAME OF THE COMPANY — to be completed]] — [[COMPANY REGISTRATION NUMBER — to be completed]]
• [[REGISTERED ADDRESS — to be completed]], [[CITY — to be completed]], [[COUNTRY — to be completed]]
• E-mail: support@oxpeptides.com

This policy applies to oxpeptides.com (the "Site"). It follows the applicable Federal Act on Data Protection (FADP) and, where applicable, the GDPR and US state privacy laws.

2. Data we collect

2.1 Order data

• Name, shipping address, e-mail address, phone number if provided
• Products ordered, amounts, order and payment status, tracking number
• Subscription status and the tokenised cancellation link sent by e-mail

Card numbers are never seen or stored by us: they go directly to the payment processor. We receive only a payment confirmation and, where applicable, the last four digits.

2.2 Stock alerts

When you ask to be notified that a product is back in stock, we store your e-mail address and the product concerned, only to send that notification.

2.3 Age-gate and attestation log

The Site asks every visitor to confirm being at least 21 years old, and every buyer to attest that the purchase is for laboratory research. We log the date and time, the IP address, the browser user agent, the terms accepted and the version of the terms. This log is our proof that the attestation was made.

2.4 Technical data

• IP address, browser type, pages visited, timestamps (server logs)
• A signed cookie holding the attestation token, and a session cookie for the checkout

The Site does not use advertising trackers.

3. Why we use it (legal bases)

• Fulfilling your order — performance of the contract.
• Age-gate and attestation log — legal obligation and legitimate interest in proving the conditions of sale were met.
• Stock alerts — your consent, withdrawable at any time by replying to the e-mail.
• Security and fraud prevention — legitimate interest.

4. Processors

Data is shared only with the providers needed to run the Site and deliver orders:

• Vercel — hosting of the Site (United States).
• Supabase — database holding orders, stock alerts and the attestation log.
• Resend — transactional e-mails (order confirmation, shipping, stock alerts, subscription links).
• Payment processor — card, Apple Pay and Google Pay payments.
• Fulfillment partner in California — receives name, shipping address and order contents to prepare and ship the parcel; the carrier receives the same for delivery and tracking.

Each provider is bound by a data-processing agreement and processes the data only for the purpose above. We never sell personal data.

5. International transfers

The hosting, database, e-mail and fulfillment providers are in the United States. Transfers rely on the providers' contractual safeguards (standard contractual clauses or equivalent).

6. Retention

• Order data: 10 years (accounting and legal obligations).
• Attestation log: as long as the related order records, and at least 5 years.
• Stock-alert e-mails: until the notification is sent or you withdraw consent, and at most 12 months.
• Server logs: 90 days.

7. Your rights

You can ask for access to your data, its correction, its deletion (subject to legal retention), a copy in a portable format, and object to or restrict a processing. Write to support@oxpeptides.com; we answer within 30 days. You may also lodge a complaint with the supervisory authority of your country of residence.

8. Cookies

The Site uses only strictly necessary cookies: the attestation token (2 years), the checkout session, and the subscription/tracking links you open. No consent banner is needed for these; no third-party advertising cookie is set.

9. Changes

This policy may be updated; the date at the top identifies the version in force. See also the terms of service and the legal notice.