Privacy Policy

What we collect

• Order information — name, email, shipping address, and the items you bought. Payment card details go directly to our payment processor and never touch our servers.
• Voluntary submissions — reviews, contact messages, newsletter and restock signups.
• Basic technical data — the standard server logs (IP address, browser type, pages requested) needed to run and secure the site.
• Affiliate program records — a partner’s account, publication, proposed placement and terms acceptance, plus qualifying order references and the commission, reversal and payout ledger.
• Customer activity — order and account milestones, preferences, and product or cart activity when you allow personalization. We do not record payment card details, passwords or the contents of private messages in this activity history.

How we use it

• Fulfilling and supporting your orders (including transactional email).
• Marking reviews as “verified purchase” when the reviewer’s email matches an order.
• Sending the newsletter you asked for — every send includes one-click unsubscribe.
• Understanding how visitors find the store and measuring advertising, subject to your tracking preferences.
• Reviewing partner applications, attributing qualifying referrals, and administering commissions and recoveries.

What we never do

• Sell, rent, or trade your personal information. Full stop.
• Send marketing email without your explicit opt-in.

Service providers

We share the minimum necessary data with the vendors who make the store work: our payment processor (payment handling), shipping carriers (delivery), and our email provider (transactional and opted-in marketing email).

When enabled, Klaviyo or Omnisend processes customer and ecommerce events for our email service. Creating an account or purchasing does not subscribe you to marketing. Your email subscription preference is separate from your personalization choice.

To suggest a country store, we use approximate country information from your connection. Our hosting platform normally provides this. If it is unavailable, your browser contacts GeoJS for a country-only lookup. GeoJS receives your public IP address as part of that request; we do not send account information, order details or the page address. This feature does not request GPS access or retain your IP address. Your chosen country and display currency are remembered in browser storage.

When advertising integrations are enabled and your tracking preference permits, Meta and Whop may receive campaign and browser identifiers, page and product references, checkout activity, purchase amounts and currencies, and contact identifiers used to match activity. Whop also processes purchases completed through its checkout. These providers process information under their own privacy policies. Advertising tracking and email subscription are separate choices.

Cookies & local storage

Cart and dismissed-banner preferences use browser storage. Account and admin sign-in use session cookies. After you choose to allow referral tracking, the first-party pb_aff cookie records the partner code, campaign labels, placement identifiers and an internal referral ID for up to 60 days so a qualifying purchase can be attributed. The pb_aff_consent cookie remembers your choice for 60 days. An allowed referral renews both cookies for that period; declining removes the referral cookie and remembers your preference for 60 days. We do not set or use this affiliate cookie when the pb_no_track preference or a Global Privacy Control signal requests no tracking. Advertising integrations, where enabled, can also process campaign identifiers according to your tracking preference.

A qualifying affiliate purchase creates an account-level attribution record for up to 12 months of repeat commissions. Accounting records are retained with the related orders. Partners see order references and commission amounts, not customers’ names, emails or delivery addresses.

The pb_ce_tracking cookie remembers your personalization choice for 30 days. When allowed, the signed first-party pb_ce_session cookie connects activity within that visit to an email address you voluntarily enter or an account you sign into. You can change this choice using Personalization settings. Declining prevents further browsing events and suppresses queued browsing events. Existing no-tracking preferences and Global Privacy Control also prevent this collection.

Your rights

Email support@pepbiotics.com to request a copy of the personal data we hold about you, correct it, or delete it (we retain what tax law requires about completed orders). Depending on your state or country — including under the CCPA and GDPR — these rights may be backed by statute; we honor the requests regardless of where you live.

Data retention & security

Order records are kept as long as tax and accounting rules require. Newsletter addresses are kept until you unsubscribe. Data is encrypted in transit, access is restricted to staff who need it, and we notify affected users promptly in the unlikely event of a breach.

Children

The store is intended for qualified researchers 21+. We don’t knowingly collect data from minors; if you believe a minor has submitted personal information, contact us and we’ll delete it.The store is intended for qualified researchers 21+. We don’t knowingly collect data from minors; if you believe a minor has submitted personal information, contact us and we’ll delete it.

Changes & contact

Material changes to this policy will be announced on this page with a new “last updated” date. Questions: support@pepbiotics.com, or PepBiotics Unit A, 82 James Carter Road, Mildenhall, Suffolk IP28 7DE.