PRIVACY POLICY
Above All Peptides (“Above All Peptides,” “we,” “us,” or “our”), operates aboveallpeptides.com (the “Site”). This Privacy Policy explains what information we collect, why, who we share it with, and the choices you have.
This Policy is part of and incorporated into our Terms and Conditions of Use and Sale.
1. Summary
- We collect only what we need to verify eligibility, process orders, ship products, prevent fraud, and comply with law.
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
- We do not collect health information, and we do not infer anything about your health. Our products are laboratory research materials, not treatments. We do not ask about your health, and you should not send us health information.
- We do not knowingly collect information from anyone under 21.
- You can request access, correction, or deletion of your information at any time, regardless of where you live.
2. Information We Collect
2.1 Information you give us
Account and contact information. Name, email address, phone number (if provided), password, and any business or institutional affiliation you supply.
Order and shipping information. Billing address, shipping address, order contents, order history, and delivery instructions.
Eligibility verification information. Where we require it under Section 7 of our Terms and Conditions, confirmation of age, your representation of qualified-researcher or laboratory-professional status, and any institutional affiliation, business documentation, or identification you provide to substantiate it.
Communications. The content of emails, contact form submissions, and support messages, and any records of our correspondence with you.
Marketing preferences. Your email and SMS subscription status and consent records, including timestamp and the version of the terms you accepted.
2.2 Information collected automatically
IP address, browser type and version, operating system, device identifiers, referring URL, pages viewed, timestamps, approximate location derived from IP address (city or region level, not precise geolocation), and cookie identifiers. See Section 8.
2.3 Information from third parties
Shipping data. Carriers provide tracking, delivery confirmation, and address validation results.
2.4 Payment card information
We do not collect, process, transmit, or store your full payment card number, CVV, or bank account credentials. Payment details are submitted directly to our PCI-DSS-compliant payment processor, [PROCESSOR NAME]. We receive only a transaction identifier, the last four digits of the card, card brand, expiration month and year, authorization outcome, and billing address for verification purposes.
2.5 Information we do not collect
We do not collect, and we ask you not to provide:
- health conditions, diagnoses, symptoms, medications, or treatment history;
- height, weight, body measurements, lab or bloodwork results;
- descriptions of personal use of any product;
- government identification numbers, Social Security numbers, or biometric or genetic data;
- precise geolocation data.
If you send us health information unsolicited, we will not enter it into our systems, will not use it for any purpose, and will delete it. Note also that describing personal use of a research product violates Section 8 of our Terms and Conditions.
3. How We Use Information
We use information only for these purposes:
| Purpose | Examples |
|---|---|
| Order fulfillment | Processing payment, packing, shipping, delivery, customer service |
| Eligibility verification | Confirming age and qualified-purchaser status per our Terms and Conditions |
| Fraud and security | Fraud screening, chargeback prevention and response, abuse detection, account protection |
| Transactional communication | Order confirmations, shipping and delivery notices, product or lot notices, policy changes |
| Marketing, with consent | Email and SMS about products, restocks, and offers, where you opted in |
| Site operation and improvement | Aggregate analytics, error diagnosis, performance, catalog and content decisions |
| Legal and compliance | Recordkeeping, tax, accounting, responding to lawful requests, enforcing our terms, defending claims |
We rely on the necessity of performing our contract with you, our legitimate interest in operating securely and lawfully, your consent where required, and compliance with legal obligations.
We do not use your information for automated decision-making that produces legal or similarly significant effects.
4. What We Do Not Do
To be unambiguous:
- We do not sell your personal information for money or other valuable consideration, and have not in the preceding twelve months.
- We do not share your personal information for cross-context behavioral advertising.
- We do not sell or share sensitive data, including any category that could constitute consumer health data.
- We do not build health-based audience segments, lookalike audiences, or health-interest retargeting lists.
- We do not rent, trade, or license customer lists.
- We do not use your information for any purpose materially different from those in Section 3 without telling you first.
5. When We Disclose Information
We disclose personal information only to the following categories of recipients, each bound by contract to process it solely on our instructions and to protect it:
Legal and safety disclosures. We may disclose information where we reasonably believe it is required by law, subpoena, warrant, court order, or other lawful process; where necessary to establish, exercise, or defend legal claims; to enforce our Terms and Conditions; or to protect the rights, property, or safety of any person. Consistent with Section 9 of our Terms and Conditions, we may report suspected unlawful activity to appropriate authorities.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will require the recipient to honor this Policy, and we will notify you of any material change in how your information is handled.
6. Data Retention
We retain information only as long as necessary for the purposes in Section 3 or as required by law.
| Data | Retention period |
|---|---|
| Order and transaction records | [7] years — tax, accounting, and chargeback defense |
| Eligibility and acknowledgment records (terms version, timestamp, IP) | [7] years — evidence of purchaser representations |
| Account information | Duration of the account, then [180] days after closure |
| Marketing consent and opt-out records | Duration of consent plus [1] year, to honor and evidence opt-outs |
| Support communications | [3] years |
| Server and security logs | [90] days |
| Analytics data | Aggregated or de-identified after [14] months |
Longer retention applies where required by legal hold, active dispute, chargeback, or regulatory inquiry. Note that our payment processor may independently retain transaction data under its own schedule, including in connection with rolling reserve or dispute obligations.
7. Your Rights
We extend the following rights to every customer, regardless of where you live, whether or not a statute requires it.
- Access. Request a copy of the personal information we hold about you.
- Correction. Ask us to correct inaccurate or incomplete information.
- Deletion. Ask us to delete your information, subject to records we must retain for legal, tax, accounting, fraud-prevention, or dispute-defense reasons. We will tell you what we retained and why.
- Portability. Receive your information in a portable, machine-readable format.
- Opt out of marketing. Unsubscribe from email or SMS at any time. You cannot opt out of transactional messages about orders you have placed.
- Withdraw consent. Where we rely on consent, withdraw it at any time, without affecting processing already carried out.
- Non-retaliation. We will never deny service, charge different prices, or provide a lesser experience because you exercised a privacy right.
- Appeal. If we deny a request, you may appeal by replying to our decision. We will respond within
[45]days with a written explanation.
To make a request: email services@aboveallpeptides.com with the subject line “Privacy Request.” We will acknowledge within 10 business days and respond within 45 days, extendable once by a further 45 days where reasonably necessary, and we will tell you if we need the extension.
Verification. To protect your information, we will verify your identity before acting, ordinarily by confirming control of the email address on the account and matching two data points against our records. We will not request more information than necessary, and we will not create new records solely to verify you.
Authorized agents. An agent may submit a request on your behalf with written, signed authorization. We may contact you to confirm.
If you are a Washington or Nevada resident: consistent with Section 2.5, we do not collect consumer health data as defined by the Washington My Health My Data Act or Nevada SB 370, we do not sell it, and we do not share it. If you believe we hold consumer health data about you, email us and we will investigate and delete it. We do not use geofencing around any health care facility.
8. Cookies and Tracking
We use the following categories:
Strictly necessary. Session management, cart contents, authentication, security, load balancing, and fraud prevention. These cannot be disabled without breaking the Site.
Analytics. Aggregate measurement of traffic and Site performance.
We do not use advertising, retargeting, or cross-site tracking cookies, and we do not host third-party advertising pixels. Given that ad platforms prohibit our category entirely, we have no reason to.
Your controls. Most browsers let you block or delete cookies. [Analytics and preference cookies are set only after you consent, and you can change your choice at any time via "Cookie Settings" in the footer.]
Global Privacy Control. We honor the Global Privacy Control (GPC) signal as a valid opt-out of sale and sharing. Because we do not sell or share personal information, this has no practical effect on our processing.
Do Not Track. Browser DNT signals lack a common standard; we do not respond to them separately, but we honor GPC as described above.
9. Security
We maintain administrative, technical, safeguards appropriate to the sensitivity of the information we hold, including:
- TLS encryption in transit across the Site and at checkout;
- encryption at rest for stored customer records;
- outsourcing of card processing to a PCI-DSS-compliant provider, so card data never touches our systems;
- role-based access limited to personnel who need it, with unique credentials and mandatory multi-factor authentication on all administrative accounts;
- logging and monitoring of administrative access;
- contractual security and confidentiality obligations on all service providers;
No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly at services@aboveallpeptides.com if you suspect unauthorized access.
Breach notification. If a security breach affects your personal information, we will notify you as required by applicable law.
10. Age Restriction
The Site is not directed to children, and our products may not be purchased by anyone under 21. We do not knowingly collect personal information from anyone under 21. If we learn we have, we will delete it promptly. If you believe a minor has provided us information, contact services@aboveallpeptides.com.
11. Marketing Communications
Email. We send marketing email only to people who opted in. Every message includes a one-click unsubscribe, honored within 10 business days as required by the CAN-SPAM Act, and ordinarily immediately.
SMS. We send marketing text messages only with your prior express written consent, obtained through a separate, unchecked-by-default checkbox that is never bundled with acceptance of our terms or with completing a purchase. Consent to marketing texts is not a condition of any purchase. Reply STOP to any message to opt out, HELP for assistance. Message and data rates may apply. Frequency varies. We retain records of your consent, including timestamp and the disclosure language you accepted.
Transactional messages — order confirmations, shipping updates, and notices about products you purchased — are not marketing and continue regardless of marketing preferences.
12. Changes to This Policy
We may update this Policy. When we do, we will revise the “Last updated” date and post the new version here. If we make a material change to how we use or disclose personal information, we will notify you by email at least [30] days before it takes effect, where we have your address, and where required we will obtain your consent. Continued use of the Site after the effective date constitutes acceptance of the revised Policy.
Suggested text: Our website address is: https://aboveallpeptides.com.
Cookies
Suggested text: If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.
If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.
If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.
How long we retain your data
Suggested text: If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
What rights you have over your data
Suggested text: If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.