Privacy Policy

Account Information: When you register, we collect your name, email address, and age verification status. Passwords are cryptographically hashed and cannot be viewed or recovered by our team.

Order Information: Shipping addresses, order history, product selections, and transaction records are stored to fulfill orders and provide customer support.

Payment Information: Payment processing is handled entirely by Stripe, our PCI-compliant payment processor. Pepta.US does not store, process, or have access to your full credit card numbers, CVV codes, or banking details. Only a transaction reference ID is retained for order tracking.

Usage Data: We collect standard web analytics data including pages visited, time spent on pages, browser type, device type, and referring URLs. This data helps us improve our product catalog and website experience.

Communication Records: If you contact our support team, we retain the content of those communications to provide better service and maintain support history.

We use collected information for the following purposes:

• Order Fulfillment: Processing purchases, shipping products, and providing tracking information
• Account Management: Maintaining your account, order history, and preferences
• Product Recommendations: Suggesting relevant products based on your browsing and purchase history, including products with similar research applications and health benefit profiles
• Customer Support: Responding to inquiries, processing returns, and resolving issues
• Service Improvement: Analyzing usage patterns to improve our product catalog, website functionality, and product information pages
• Security & Compliance: Maintaining audit logs of account actions, detecting fraud, and ensuring compliance with applicable regulations
• Communications: Sending order confirmations, shipping updates, and important product safety notifications

We implement multiple layers of security to protect your personal information:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS)
• Encryption at Rest: Sensitive data stored in our databases is encrypted using industry-standard encryption algorithms
• Password Security: Passwords are hashed using bcrypt with multiple salt rounds, making them computationally infeasible to reverse
• Access Controls: Internal access to customer data is restricted to authorized personnel on a need-to-know basis
• Audit Logging: All sensitive account actions (login, order placement, profile changes) are logged with timestamps and IP addresses for security monitoring
• Payment Security: Payment processing is outsourced to Stripe, which is PCI DSS Level 1 certified — the highest level of payment security certification

We do not sell, rent, or trade your personal information to third parties. We share information only in the following limited circumstances:

• Payment Processing: Transaction data is shared with Stripe to process payments securely
• Shipping: Name and shipping address are shared with our logistics partners to fulfill orders
• Legal Requirements: We may disclose information if required by law, court order, or government regulation
• Business Protection: We may share information to protect the rights, safety, or property of Pepta.US, our customers, or the public

Pepta.US uses essential cookies to maintain your login session and shopping cart. We may also use analytics cookies to understand how visitors interact with our website. These cookies do not contain personally identifiable information.

You can control cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of your account and shopping experience.

Active Accounts: We retain your account information for as long as your account remains active.

Order Records: Order history and transaction records are maintained for a minimum of 7 years for legal, tax, and compliance purposes.

Account Deletion: You may request complete deletion of your account and personal data by contacting [email protected]. Upon request, we will delete your account data within 30 days, except for records we are legally required to retain.

Inactive Accounts: Accounts that have been inactive for more than 24 months may be flagged for review. We will notify you before any action is taken on an inactive account.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing communications at any time

To exercise any of these rights, contact us at [email protected].