Privacy, clearly.

About this policy

This Privacy Policy explains how VitaPep handles information when you browse our website, use an account, or contact us. Our products are for research use only. Contact us about privacy at [email protected]. This wording is a draft for owner review, prepared on October 21, 2026; it must be reviewed and approved before publication.

The website during merchant review

Ordering and payments are temporarily unavailable during merchant review. You can browse the catalog and public information. Account registration, account management and newsletter subscription remain available. The website does not currently send payment requests to Kashier or another payment gateway. Kashier is selected for a future integration, subject to merchant approval and testing. PayPal and Paymob integrations have been retired; Stripe is not selected. The order-related processing described below applies to existing records and to ordering if it is enabled later.

Accounts and sign-in

We collect the name, email address and password you provide when creating an account. Passwords are stored as hashes, not readable passwords. We process email-verification, password-reset and email-change requests, including verification records and expiry information. If Google sign-in is configured and you choose it, we exchange information with Google to verify your identity and receive your Google identifier, email address, verification status and available profile name. We store the linked identifier and email, but do not persist Google access or refresh tokens.

Addresses, carts and orders

An account can hold saved shipping addresses, including a recipient name, address label, street, city, state, postal code and country. When ordering is available, checkout collects contact email, shipping details, primary telephone number and an optional alternative number. Order records contain purchased products, configurations, SKUs, quantities, prices, discounts, shipping charges, totals and research-use confirmation. Guest carts use a session-linked cart token; signing in can merge a guest cart into an account when ordering is enabled. Merchant-review mode prevents cart changes, checkout orders and new payment attempts. There is no separate billing-address collection form in the current application.

Payment and delivery records

Where an order has payment history, VitaPep stores payment status, amounts, currency, provider references, event identifiers or hashes, and associated refund or dispute records. The application does not collect card numbers or card security codes through its checkout. No payment processor currently receives new checkout transactions from this website. Delivery records can include carrier, tracking number, tracking link, shipment status, delivery dates and exceptions. Authorized staff use order contact and shipping information to handle fulfillment, and a selected carrier needs delivery information when a shipment is arranged. The application has no automatic carrier-label API integration.

Returns, cancellations and support

We retain cancellation and return requests, reasons, decisions, related order information and refund references. Return evidence may include photos or videos and their original filenames, file types and sizes. Evidence is stored privately and accessed through authorization-checked routes. Avoid including unrelated personal or sensitive information in evidence. Our contact links open your email application; there is no general on-site support-message form. If you email us, we receive the information you choose to include, and your email provider also handles that communication.

Product reviews

Eligible customers can submit a rating, title and review text associated with their account, product and purchase. Reviews are moderated before public display. Approved review content and the displayed customer name can be visible to other visitors. Do not include private contact details in a public review. Customers can view and delete their own reviews through their account; there is no self-service review editing feature.

Email and marketing preferences

We process account and order-related email notifications and retain delivery records such as recipient, notification type, status and related resource references. Newsletter subscription requires an explicit marketing-consent choice. We store the subscription email, consent wording, source and timestamp, unsubscribe status and consent-event history. A signed unsubscribe link lets you withdraw newsletter consent; it does not erase prior consent records or stop necessary account messages. Marketing campaign delivery has a separate enablement control and is not automatically activated by subscription. When outbound email is configured, its delivery provider receives the recipient and message information necessary to send it. Resend support is implemented; the actual production email configuration must be confirmed before deployment.

Cookies and browser storage

The website uses session and CSRF-protection cookies to support sign-in, request security and session-linked features. A remember-me choice can keep a sign-in token on your browser. Browser storage is also used for site interface preferences, the research-use age acknowledgement and cart interface coordination. These acknowledgements are not identity or age verification. Blocking cookies or clearing browser storage can sign you out, clear preferences or interrupt session-based features. Current application analytics are internal server-side records; this policy does not describe Google Analytics, advertising pixels or consent-based tracking services as active integrations.

Operational and security information

Application sessions can contain an IP address, user agent, session identifier and activity information. Operational logs, failed jobs, security events and audit history can contain technical details and resource references needed to investigate faults, abuse and authorized changes. Internal analytics record events such as registration, login, cart actions, orders and reviews with customer or resource identifiers and relevant commerce metadata. These internal records are not sent by the analytics service to an external analytics vendor. Authorized Admin and Warehouse roles have access appropriate to their duties. Staff account records also include role assignments, security events and, where supplied, a profile image.

Service providers and external links

Hosting, database, storage, backup, email and delivery providers may process information needed to operate the service when they are configured. OVHcloud hosting in an intended US data center and Cloudflare DNS, HTTPS/CDN protection and potentially encrypted backup storage are selected deployment arrangements, not services already provisioned for this local application. Current catalog image URLs use Cloudinary, so your browser requests those images from Cloudinary. Product and staff-image upload support includes local storage and optional Cloudinary uploading. The website serves fonts from its own origin rather than requesting them from Google Fonts. External image hosts receive network information such as your IP address when those images are requested. Following a social-media or tracking link takes you to that service, whose own privacy practices apply. We do not describe inactive payment or analytics integrations as current recipients.

Protection and retention

We use access controls, password hashing, request validation and private-file authorization to reduce risk. No online service can guarantee absolute security. Data and backups require production access controls, encryption and operational verification when hosting is provisioned. The current application does not define one fixed retention period for all personal information or automatically delete accounts and all related history after a set period. Authentication tokens and sessions have configured expiry rules, but expiry of access does not necessarily erase associated records. Order, security, consent and audit history may remain stored. A category-specific retention and backup-deletion schedule remains for owner review; we do not promise an unimplemented automatic erasure timetable.

Your choices and requests

You can update supported profile details, manage saved addresses, change your password, manage a linked Google identity, view order history and delete your own reviews through your account. Newsletter recipients can use the signed unsubscribe link. The current website has no self-service account-deletion or personal-data export button. For access, correction, deletion or other privacy requests, email [email protected]. We may need to verify your relationship to the account before responding, and applicable requirements or the need to preserve transaction and security records may affect the response. This draft does not claim a particular statutory deadline, legal jurisdiction or certification; applicable legal obligations require review before publication.

International processing and changes

Your information may be processed in a different country from where you live when configured hosting or service providers operate there. Actual production hosting locations, processors and any required transfer disclosures must be reviewed before this draft is published. We will update the published policy when relevant processing changes. Future payment integration or new tracking services require an updated disclosure before they are represented as active.