Privacy

Short version: we keep what an order needs and the record that you confirmed what the material is for. We do not sell anything about you to anybody, and we never see your card number.

What we collect

When you order: your name, email address, shipping address, and a phone number if you give one. Your order itself — what you bought, at what price, and which lot it came from.

The research-use confirmation you tick at checkout, with the date and time, and the network address and browser it came from. That record exists because it is the only proof of what you told us the material was for, and it is the first thing anyone auditing this shelf would ask to see.

If you join the mailing list, your email address and nothing else.

As you browse: which pages you open, how long you spend on them, how far down you read, what you search for, what you add to the basket, the page that sent you here, your country and region, and the kind of device and browser you are using. We count this ourselves, on our own servers. Your network address is not kept: it is combined with your browser type and a key that changes every day into a code that lets us count you once that day and cannot be turned back into you, or matched to you tomorrow.

We also use Google Analytics, a service run by Google, to see how visitors find and use the site. It receives the pages you open, how far you scroll, the links you follow off the site, the site that sent you here, your approximate location, and the kind of device and browser you are using, and it sets cookies in your browser to tell one visit from the next. If you place an order it also receives the order number, the total and the items, and never your name, email address or shipping address.

It is not loaded on your order status page or in any signed-in area. The page address we send it has order numbers, access codes and affiliate codes removed. We have switched off its advertising features. If your browser sends the Global Privacy Control signal, it is not loaded at all.

We do not collect card numbers. Card details go directly to our payment processor; what comes back to us is an approval, the last four digits and a reference.

What your browser keeps

Your basket and your answer to the age gate are stored in your own browser, not on our servers. Clearing your site data removes both. A random visit code lives in the tab for as long as it is open and is gone when you close it, and a note of the date you first visited stays in the browser so we can count you as returning rather than new; only that yes or no is sent to us.

Our own counting sets no cookies. Google Analytics sets measurement cookies, as described above. We do not run advertising trackers, and we do not share browsing behaviour with advertisers.

Who else sees it

Our supplier, American Peptides, receives what a shipment needs — your name, address and the lines on your order — because they pack and dispatch it. They do not receive your payment details.

Our payment processor receives what a card transaction needs, directly from you. Our carriers receive the address. Our email provider receives your address and the message.

Google receives the browsing information described above, through Google Analytics.

Otherwise, nobody. We do not sell, rent or trade personal information, and no part of this business is funded by doing so.

We will disclose records if a law or a court requires it, and we will tell you when we are allowed to.

How long we keep it

Order records, including the research-use confirmation, are kept for seven years, because tax law and product-liability exposure both run longer than a normal business record. Mailing-list addresses are kept until you unsubscribe.

What you can ask for

A copy of what we hold about you, a correction, or deletion. We will do all three, except where an order record has to be kept for the period above. Write to us and we will answer within thirty days.

There is nothing to opt out of on selling or sharing, because we do neither.

Security

The site runs over TLS. Card data never touches our servers. Access to order records is limited to the people who fulfil them, behind a password and a signed session.

If we ever have a breach that affects you, we will tell you and say plainly what was taken.

Reaching a person

[Registered company name] LLC, [Street address], [City], [ST] [ZIP]. support@touchstonepeptides.com.