Privacy Policy

1. Who we are

Pepelabs Research Ltd ("Pepelabs", "we", "us") operates this website and sells research compounds to accredited laboratory customers. This policy explains what personal data we collect when you use the site, why, and what rights you have over it.

2. Data we collect

• Order data: name, email, billing and shipping address, and order contents, collected when you check out.
• Payment data: for USDC payments, a unique deposit address is generated by our payment processor, NOWPayments; we never see or store your wallet keys. For SEPA bank transfers, we store the reference details needed to match your payment to your order. We do not store card numbers or bank credentials.
• Age verification: a cookie confirming you have passed the 18+ age gate, with no personal identifiers attached.
• Technical data: IP address and basic request metadata, used only for rate-limiting, fraud prevention, and security logging.

We do not use third-party advertising trackers or sell personal data.

3. Why we process it

To fulfil orders, issue invoices, prevent fraud and abuse, comply with applicable record-keeping obligations, and respond to support requests. Order and invoice records are retained for as long as required by applicable tax and accounting law.

4. Sharing

We share order data only with the service providers needed to fulfil it: our payment processor (NOWPayments) for USDC payments, our email delivery provider for order confirmations and invoices, and our hosting/database providers. We do not sell or rent personal data to third parties.

5. Your rights

Subject to applicable law (including the EU GDPR where it applies), you may request access to, correction of, or deletion of your personal data, or object to certain processing. To exercise these rights, contact us using the details on our Contact page.

6. Cookies

We use only strictly necessary cookies: one to remember age-gate confirmation and one to maintain your session while browsing and checking out. No analytics or advertising cookies are set.

7. Data security

All traffic to this site is encrypted (HTTPS/TLS). Every mutating request is protected against cross-site request forgery, sensitive endpoints are rate-limited against abuse, and the admin terminal is separately authenticated with brute-force lockout. Payment data flows through our payment processor rather than our own servers wherever possible, and access to order data is restricted to what fulfilling your order requires.

8. Third-party links

Pages on this site, order confirmations, and support replies may link to third-party services (for example, our payment processor or a shipping carrier's tracking page). We are not responsible for the privacy practices or content of external sites you reach through those links.

9. Changes

We may update this policy from time to time; the "Last updated" date above reflects the most recent revision.