Privacy Policy

Last updated: September 2026

Information We Collect

When you create an account or place an order, we collect your name, email address, shipping address, and phone number. We also collect technical information such as IP addresses, browser type, and usage data for security and analytics purposes.

How We Use Your Information

We use your information to process orders, communicate about your account, improve our services, and protect against fraud. We use security audit logging to monitor for unauthorized access attempts.

Password Security

Your password is hashed using BCrypt with a high cost factor. We never store plaintext passwords. Our system supports two-factor authentication (TOTP) for additional security.

Data Protection

All data is transmitted over HTTPS with TLS encryption. Session tokens are cryptographically random and stored as SHA-256 hashes. We implement rate limiting, account lockout, and comprehensive audit logging to protect your account.

Cookies

We use essential cookies for sign-in and session management. We also set a cart-backup cookie that keeps your cart for up to 7 days and, when you follow a link that carries a promo code or open the switching page (/switch) while it shows an offer, a cookie that remembers that code for checkout for up to 14 days. These cookies are HttpOnly and Secure and use SameSite=Lax; the short-lived two-factor sign-in cookie uses SameSite=Strict. The site also loads Google Analytics and Google Ads tags, and when card payment is available, product, cart and payment pages load Stripe's payment script for signed-in visitors; these set their own cookies.

Data Retention

Account data is retained as long as your account is active. Order records are retained for 7 years for legal compliance. Security audit logs are retained for 90 days. You may request account deletion by contacting us.

Third Parties

We do not sell your personal information. We share data with payment processors to complete transactions and with shipping carriers to deliver orders; payment processors and shipping carriers are bound by confidentiality agreements. The Google Analytics and Google Ads tags described under Cookies send usage data to Google for analytics and ad measurement.

Your Rights

You may request access to, correction of, deletion of, or a copy of personal information we hold about you, subject to applicable law. Email support@peptalabs.com with the subject “Privacy Request.”

Contact

Questions about this policy? Email support@peptalabs.com or visit our contact page.