Privacy Policy

PeptideStat ("PeptideStat", "we", "us" or "our") publishes evidence-based peptide guides at peptidestat.com (the "Site"). This Privacy Policy explains what information we collect, how we use it and the rights you have over it. Enhanced analytics starts automatically unless you have disabled it through the "Analytics settings" control in the footer.

1. Who we are

PeptideStat operates the Site as an independent publisher of educational content. For privacy enquiries, contact us at admin@peptidestat.com.

For visitors located in the European Economic Area ("EEA"), United Kingdom or Switzerland, PeptideStatis the "controller" of personal data collected through the Site within the meaning of the EU and UK General Data Protection Regulation ("GDPR").

2. Information we collect

We are deliberately conservative about the data we collect. As of the effective date:

• Account or contact data: None. The Site does not offer user accounts, comments or newsletter sign-ups.
• Server logs: Our hosting provider records standard technical information about each request (IP address, user agent, referrer, timestamp, requested URL, response status) for the purposes of security, abuse prevention and aggregate traffic reporting. These logs are retained for a short period determined by the hosting provider.
• Aggregate analytics: We use Vercel Web Analytics to measure aggregate page views and outbound affiliate-link events. An affiliate event can include the page path, CTA placement, partner, campaign and product label. We do not send names, email addresses, account identifiers or health information in these events.
• Enhanced analytics: We load TraceDart automatically to understand sessions, returning visits, active time, scroll depth, referral and UTM context, client-side route changes and affiliate clicks. TraceDart uses a first-party visitor token and hashed browser fingerprint components. Its technical signals can include browser/device characteristics, display and rendering information, locale, storage and media capabilities, browser permission states, network context, IP-derived location, ASN/ISP and VPN, proxy, Tor or datacenter indicators. A visited URL can reveal which peptide content interested a visitor, but we do not intentionally send calculator inputs, email addresses, account identifiers or self-reported health information as event properties.
• Cookies and local storage: The Site does not set advertising or social-media tracking cookies. Vercel Web Analytics is designed to operate without third-party cookies. Unless you disable it, TraceDart sets a first-party visitor token (including the _td_vid cookie) and uses browser storage to recognize a visitor and session. We store your analytics preference locally in your browser. Essential storage required for the underlying web framework (Next.js) to function may also be present.
• Affiliate clickthroughs: When you click an outbound affiliate link, Vercel records the aggregate event described above; TraceDart also records it unless you disabled enhanced analytics. The destination site (e.g. Ascension Peptides) may receive an identifier indicating that the visit originated from PeptideStat and may set its own cookies under its own privacy policy.

If we add accounts, comments, newsletter sign-ups or materially different data-collecting features in the future, we will update this policy and, where required by law, ask for your consent before activating them.

3. How we use information and lawful basis (GDPR)

Where the GDPR applies, our lawful basis for processing under Article 6 is as follows:

• Operating and securing the Site (server logs): Legitimate interests (Art. 6(1)(f)) in providing a working, secure website and preventing abuse.
• Responding to your enquiries (e.g. email you send us): Legitimate interests (Art. 6(1)(f)) in answering your message, or performance of a request you made (Art. 6(1)(b)).
• Measuring aggregate site and referral performance with Vercel: Legitimate interests (Art. 6(1)(f)) in understanding which pages and clearly disclosed partner placements are useful, while limiting the event data to non-identifying labels.
• TraceDart enhanced analytics: Legitimate interests (Art. 6(1)(f)) in understanding how visitors navigate the Site and which disclosed referral placements are useful. TraceDart loads automatically unless you have opted out. You can object and disable it at any time through the "Analytics settings" control in the footer.
• Complying with legal obligations: Legal obligation (Art. 6(1)(c)) where applicable.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

4. How we share information

We do not sell, rent or trade your personal information. We share data only with:

• Service providers including Vercel, which hosts the Site and provides aggregate analytics, and TraceDart, which provides enhanced analytics. These providers process data to operate their services under appropriate contractual terms;
• Authorities where required by applicable law, court order or to protect our rights; and
• Affiliate partners to the extent you choose to click an outbound affiliate link, after which the partner's own privacy policy governs.

5. Data retention

We retain server logs and analytics according to our service providers' configured retention periods, and any correspondence you send us for as long as needed to respond and to maintain a reasonable record of the exchange. TraceDart supports visitor-level export and deletion; contact us if you want us to locate and act on a record. We delete personal data when it is no longer needed for the purpose for which it was collected, unless retention is required by law.

6. International transfers

The Site is operated using infrastructure that may be located outside your country of residence, including in the United States. Where personal data is transferred from the EEA, UK or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) where they apply to our service providers.

7. Security

We use commercially reasonable technical and organisational measures to protect the limited personal data we process. No method of transmission or storage over the internet is completely secure, however, and we cannot guarantee absolute security.

8. Your rights under the GDPR (EEA, UK and Switzerland)

If you are in the EEA, UK or Switzerland, you have the following rights with respect to your personal data:

• Right of access to confirm whether we process your data and obtain a copy;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure ("right to be forgotten") in the circumstances set out in the GDPR;
• Right to restriction of processing in certain cases;
• Right to data portability for data you provided and that we process by automated means on the basis of consent or contract;
• Right to object to processing based on legitimate interests; and
• Right to withdraw consent at any time, where processing is based on consent (without affecting the lawfulness of prior processing).

You also have the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, email admin@peptidestat.com. You can also object to and disable enhanced analytics at any time using "Analytics settings" in the footer. Disabling analytics clears TraceDart's local visitor and session identifiers from that browser and prevents the script from loading on later visits from that browser. We will respond within the timeframes required by the GDPR.

9. Your rights under the CCPA / CPRA (California residents)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you the following rights:

• Right to know what personal information we collect, use, disclose and (if applicable) sell or share;
• Right to delete personal information we have collected from you, subject to legal exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information; and
• Right to non-discrimination for exercising any of the above rights.

We do not sell or share (as those terms are defined under the CCPA/CPRA) personal information, and we do not use or disclose sensitive personal information for purposes that require a right to limit. To exercise any of these rights, email admin@peptidestat.com.

10. Children's privacy

The Site is intended for adults and is not directed at children under 16 (or under 13 where local law sets that threshold). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact admin@peptidestat.com and we will delete it.

11. Third-party links

The Site contains links to third-party websites, including affiliate partners and study databases. We are not responsible for the privacy practices of those websites; please review their policies before sharing personal information. For more on how affiliate links and regulated content are handled, see our Disclaimer.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date at the top of this page. Where required by law, we will provide additional notice.

13. Contact

Questions, requests or complaints about this Privacy Policy or our handling of personal data can be sent to admin@peptidestat.com.