LEGAL

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how Research Peptide Hub (“RPH”, “we”, “us”), a VeloPep Labs brand, collects, uses, stores, shares and retains information when you use the Research Peptide Hub website and application at researchpeptidehub.com — including when you browse the catalog, place an order, create an account with an email address and password, or sign in with your Google account or Apple ID.

Research Peptide Hub is an online store that supplies research-grade peptides and laboratory supplies for in-vitro research use only. The application's sole purpose is to let you browse that catalog, place and track orders, and manage your own account, order history and rewards. This policy applies to that application and website in full.

1. Information We Collect

We collect information you provide directly when creating an account, placing an order, or interacting with our Site:

Name, email address, and phone number
Shipping and billing address
Account credentials (password stored securely hashed)
Order history and product preferences
Rewards program activity (points earned, redeemed, expired)
Coupon usage and discount history
Back-in-stock notification preferences
Email subscription preferences
Google or Apple account details (name, email address, profile picture) if you choose to sign in with one of those providers — see “Sign in with Google & Apple” below

We also collect information automatically when you use our Site:

Session identifiers (anonymous, stored in your browser's local storage)
Cart contents and checkout form data (persisted for convenience)
Approximate visitor presence data (anonymous session-based, automatically deleted after 1 hour of inactivity)
Browser type and device information provided by Cloudflare Turnstile for bot protection

2. How We Use Your Information

We use the information we collect to:

Process and fulfill your orders, including shipping label generation
Communicate order confirmations, shipping updates, and delivery notifications
Manage your account and rewards program participation
Validate coupon eligibility and prevent fraud
Send back-in-stock alerts you have subscribed to
Calculate applicable taxes based on your shipping address
Improve our website, products, and customer experience
Comply with legal and regulatory obligations
Detect, prevent, and address fraud and security issues

3. Third-Party Service Providers

We share your information with trusted third-party service providers who assist us in operating our business. These providers are contractually obligated to use your information only for the specific services they provide to us:

Payment Processors: We use third-party payment processors to handle transactions. Your payment information is transmitted directly to these processors and is not stored on our servers. We retain only transaction reference IDs for order tracking.
Shipping (EasyPost): Your name and shipping address are shared with our shipping label provider to generate shipping labels and tracking information.
Address Validation (Radar): When you use address autocomplete during checkout, your partial address input is sent to Radar for validation and suggestions.
Email (Resend): Your email address and name are shared with our email service provider to deliver transactional emails (order confirmations, shipping notifications, account verification).
Bot Protection (Cloudflare Turnstile): We use Cloudflare Turnstile to protect forms from automated abuse. Cloudflare may collect device and browser data as part of this verification.
Database Infrastructure (Convex): Your data is stored and processed using Convex's serverless database platform, hosted in the United States.

4. Sign in with Google & Apple

You can create an account or sign in using your Google account or Apple ID instead of choosing a password. If you do, we receive a limited set of information from that provider. We never receive, and cannot see, your Google or Apple password.

From Google we receive: your name, your email address and whether Google has verified it, your profile picture, and the account identifier Google assigns you. We request only the "openid", "email" and "profile" scopes — the minimum required to create an account. We do not request and cannot access Gmail, Contacts, Calendar, Drive, Photos, or any other Google service or product data.
From Apple we receive: your name (only the first time you authorize us) and an email address. If you choose "Hide My Email", Apple gives us a private relay address instead of your real one, and we use that relay address for all order and account email. We request nothing beyond name and email.
How we use it: solely to create your account, verify it is you when you return, display your name in your account, and send you transactional email about your orders. We do not use information received from Google or Apple for advertising, profiling, or marketing analytics, and we do not sell it.
What we store: the name, email address and profile picture on your account record, plus a linked-account record holding the provider name, the identifier that provider assigned you, the scopes you granted, and the sign-in tokens the provider issued for completing the sign-in itself. Retention follows the Account data rules in the Data Retention section below.
Who we share it with: no one, beyond the service providers already listed above that are needed to run your account and orders (for example our email provider, to deliver an order confirmation). We do not disclose it to advertisers or data brokers.
Withdrawing access: you can disconnect Google or Apple at any time from Account → Security → Connected Accounts, as long as you have another way to sign in (a password or the other provider) so that you are not locked out. You can also revoke our access from your Google Account permissions page or from your Apple ID settings under "Sign in with Apple". Disconnecting or revoking does not delete your account or your order history; to delete those, see the Your Rights section below.

If the email address from Google or Apple matches an account you already have with us, signing in with that provider connects it to your existing account rather than creating a second one, so your order history and rewards stay in one place.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that data only to provide and improve the sign-in and account features you asked for; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for serving advertising; and no human reads it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymized.

5. Cookies & Local Storage

We use minimal browser storage, limited to what is essential for Site functionality:

Session ID: A randomly generated identifier stored in local storage to maintain your cart and associate your browsing session. This is not a tracking cookie and contains no personal information.
Authentication Tokens: Session tokens stored securely to keep you signed in to your account.
UI Preferences: Minor interface state (e.g., sidebar open/closed) stored in cookies with a 7-day expiry.

We do not use third-party advertising cookies or cross-site tracking pixels. We do not sell or share your browsing data with advertisers.

6. Affiliate & Rewards Data

If you use a coupon code associated with an affiliate partner, we track that the coupon was used in connection with your order for the purpose of calculating affiliate commissions. Your personal information is not shared directly with affiliates; only aggregated order and commission data.

Rewards program data (points balance, transaction history, redemption records) is linked to your account and retained for the duration of your account plus any applicable legal retention period.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encrypted connections (HTTPS/TLS), secure password hashing, HMAC-verified webhook communications, and CAPTCHA-protected forms. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your data as follows:

Account data: Retained for as long as your account is active.
Order records: Retained for a minimum of 7 years for tax and legal compliance.
Cart & session data: Automatically deleted after 24 hours of inactivity.
Visitor presence data: Automatically deleted after 1 hour of inactivity. This data is anonymous.
Rewards points: Available points expire 90 days after the associated order ships (or as otherwise configured). Ledger history is retained for auditing.
Email subscriptions: Retained until you unsubscribe or request deletion.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information. You can update most information directly in your account profile.
Deletion: Request deletion of your personal information, subject to legal retention obligations (e.g., tax records).
Portability: Request your data in a commonly used, machine-readable format.
Opt-out: Unsubscribe from marketing emails at any time via the unsubscribe link in any email or by contacting us.

To exercise any of these rights, contact us at privacy@researchpeptidehub.com. We will respond within 30 days.

10. Children's Privacy

Our Site is not intended for individuals under the age of 21. We do not knowingly collect personal information from anyone under 21. If we become aware that we have collected data from someone under 21, we will delete it promptly.

11. International Users

Our Site is operated from the United States. If you access the Site from outside the US, your information will be transferred to and processed in the United States. By using our Site, you consent to this transfer and processing.

12. California Privacy Rights (CCPA)

If you are a California resident, you have the right to request disclosure of the categories and specific pieces of personal information we have collected, the purposes for collection, and any third parties with whom it was shared. You also have the right to request deletion. We do not sell your personal information. To make a request, contact privacy@researchpeptidehub.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Material changes will be communicated via email to registered account holders.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at privacy@researchpeptidehub.com.