Privacy policy

1. What we collect

We hold the following, and nothing beyond it:

• Account — your name, email address, and whether that address has been confirmed. Your password is stored only as an Argon2id hash; we cannot read it.
• Addresses — the delivery and billing addresses you save, and a copy of the address as it was at the moment each order was placed.
• Orders — what you bought, what you paid, the status history, and the batch allocated to each line.
• Security records — sign-ins, password changes, and similar account events, each with the IP address and time it happened.
• Messages — anything you send us by email.

We do not collect card or bank details. Payment happens at our payment provider, and what returns to us is an opaque reference and an amount.

2. Why we collect it

To take and fulfil your order; to confirm your email address and keep your account secure; to run the eligibility checks described in our terms of service; to record which batch you received; to answer you when you contact us; and to meet our legal and record-keeping obligations.

We do not sell your information, and we do not use it for advertising or profiling.

3. Cookies

The site sets two cookies, both strictly necessary and neither used for tracking:

• glp3_session — keeps you signed in. It is HTTP-only, so no script on the page can read it.
• glp3_csrf — proves a request came from our own pages rather than somebody else’s. A copy is also kept in your browser’s local storage so the check keeps working across our domains.

There is no analytics cookie, no advertising cookie, and no third-party script tracking you here. Clearing them signs you out; nothing else is lost.

4. Who else sees it

Only the suppliers who make the site work, and only what each one needs:

• Our payment provider — takes your payment directly. Your card or bank details go to them, not to us.
• Our email provider — sends verification, password-reset, and order emails. It receives your email address and the message.
• Our hosting and storage providers — run the site and its database.
• Shipping carriers — receive the delivery address needed to deliver.

We may also disclose information where the law requires it, or to establish or defend a legal claim. We do not share your information with anyone else.

5. How long we keep it

Order records, including the batch allocated to each line, are kept for as long as our legal and record-keeping obligations require. That is deliberate: the batch record is how a specific vial can be traced back to its certificate of analysis, and it is what we would rely on if a batch ever had to be recalled.

Account details are kept while your account is open. Security records are kept for a limited period and then removed.

6. Security

Traffic is encrypted in transit. Passwords are hashed with Argon2id and never stored in a readable form. Sessions are HTTP-only cookies with cross-site request protection, and staff access to customer records is restricted by role and recorded.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your information we will tell you where the law requires it.

7. Your rights

You can ask us to give you a copy of what we hold about you, correct anything wrong, or delete your account. Email support@lapispeptides.com and we will respond within the time the law allows.

Deletion has one limit worth stating plainly: we cannot delete completed order records we are legally required to keep. Where that applies we will say so and delete everything else.

Depending on where you live you may have further rights, including to object to processing or to complain to a data-protection authority. Nothing here removes them.

8. Children

This site is for research organisations and qualified individuals. It is not intended for anyone under 21, and we do not knowingly collect information from them. If you believe a minor has given us information, email us and we will delete it.

9. International users

We operate from the United States, and our providers process data there. If you order from elsewhere, your information will be transferred to and stored in the United States, which may have different data-protection rules from your own country.

10. Other sites

Where we link to another site, this policy does not cover it. Read theirs.

11. Changes

If we change this policy the new version appears here with a new date at the top. Where a change materially affects how we use information you have already given us, we will tell you.

12. Contact

Questions, requests, or complaints about privacy: support@lapispeptides.com.