Privacy policy

Overview

This policy describes how Bio Peptides Labs collects, uses, and stores information when you browse the site, create an account, request documentation, or place an order.

Information we collect

• Account details such as name, email, and password (handled by our authentication provider).
• Shipping name, address, phone number, and order history for carrier fulfillment.
• Documentation request details (product, name, email, optional organization/lot notes).
• Email address, product choice, and consent timestamp when you request a one-time availability alert.
• Privacy-limited analytics: an anonymous browser identifier, a 30-minute session identifier, a coarse traffic-source category, the first public page in the session, and aggregate browsing or checkout steps.
• Affiliate applications, payout contact details, program settings, referral activity, attributed-order references, commission entries, payout records, and limited tax-clearance metadata such as form category, status, verification time, verifier, and expiration.
• Current checkout uses Ulasend. We send your account email, order reference, and order total to create a payment request, and retain invoice identifiers, payment status, and verification records. We do not store full payment card numbers.

Payment providers

Ulasend handles payment on its hosted checkout. Payments use USDC, a digital currency. When available, an eligible credit or debit card payment uses Stripe within Ulasend checkout to purchase USDC for your order. Stripe may require identity verification. Payment details and any verification documents you submit in the Stripe flow are handled by Stripe under its privacy policy. Ulasend handles hosted-checkout data under its privacy policy. We do not store full payment card numbers. Historical PayPal transactions remain associated with PayPal.

Abuse prevention

We use temporary request counters keyed by a one-way hash of a network address or account identifier to limit automated requests and protect account access and email delivery. These records are separate from traffic analytics. Their budgets expire after a short window and expired counters are removed during subsequent requests; raw network addresses are not stored in this rate-limit table.

Affiliate referral tracking

When you open an approved affiliate link, the site exchanges the public referral code for a random, first-party, HTTP-only referral cookie. Only a one-way hash of the random cookie token is stored with the affiliate account, landing-page path, optional referring hostname, creation time, and expiration time. We do not store the raw cookie token, an IP address, a full referring URL, or referred-customer identity in the affiliate-facing report.

The standard referral cookie expires after 30 days, although an approved affiliate may have a shorter or longer window shown in the program settings. When an authenticated customer creates an order, a valid referral or linked affiliate discount code may be recorded on that private order. This lets us calculate commission, prevent self-referrals, handle refunds, and provide an auditable payout history. Expired referral-click rows are removed after a limited reconciliation period.

Affiliate tax clearance

The affiliate backend records W-9 verification status or the W-8 category and manual-review status so payouts can be blocked until the applicable compliance review is complete. W-8 cases remain in manual review until an approved withholding workflow is available. It does not store SSNs, EINs, ITINs, other tax-identification numbers, tax-form images, or tax-document contents. Affiliates should use only the secure submission method provided by support and should never email tax IDs or tax forms.

Site analytics

We also use Opinly for limited public-page and purchase reporting. Our restricted integration sends public page paths, random browser/session analytics identifiers, and confirmed purchase totals in USD with a one-way order reference. It does not send email addresses, customer account IDs, form contents, product line items, URL queries, full referrers, or visitor IP addresses to Opinly. Account, login, checkout, and staff pages are excluded from page tracking. Supported Do Not Track, Global Privacy Control, and the site analytics opt-out disable this integration. Opinly reporting is separate from the first-party database retention period below; clearing browser storage removes its local identifiers but not previously submitted reporting data.

The storefront uses first-party browser storage, rather than analytics cookies, to estimate unique browsers and sessions. Random identifiers are converted to one-way hashes before they are stored in our analytics database. We retain these analytics rows for no more than 35 days.

We classify referrals into broad categories such as direct, Google, Bing, social, email, or referral traffic. We do not retain search text, URL query strings, full referring URLs, or IP addresses in the analytics database. Staff sessions, known automation, browsers with automation enabled, and supported Do Not Track or Global Privacy Control signals are excluded from this first-party measurement.

How we use information

We use information to authenticate accounts, fulfill orders, respond to COA and documentation requests, verify and deliver requested availability alerts, operate and audit the affiliate program, prevent abuse, improve the storefront, and meet legal obligations.

Sharing

We share data with service providers needed to run the business (hosting, authentication, payment, email delivery, and shipping carriers such as USPS) under contractual confidentiality. Carriers receive only the contact and shipment details needed to deliver an order. We do not sell personal information.

Retention and security

We retain account and order records as long as needed for fulfillment, support, and compliance. Anonymous traffic analytics are removed within 35 days. Affiliate referral clicks are retained only through their attribution and reconciliation period; application, commission, refund-adjustment, and payout records are retained as business and audit records. Unconfirmed availability requests may be removed after seven days; confirmed alert records are retained until delivery or cancellation and as needed to prevent duplicate messages. Access to staff tools is limited to authorized emails. No method of transmission is perfectly secure; use a strong unique password.

Your choices

You may update your shipping address and carrier phone number in your account, cancel an availability alert through the link in either alert email, request account- or affiliate-related changes by contacting us, and stop browsing the site at any time. Clearing site data removes the anonymous analytics identifiers and the affiliate referral cookie from your device, along with the research-use acknowledgment stored locally. Supported Do Not Track and Global Privacy Control signals also disable first-party analytics collection.

Contact

Privacy questions can be sent through our contact form, your account email, or by calling (725) 353-9598. Written correspondence may be mailed to Bio Peptides Labs, 732 S 6th St #8304, Las Vegas, NV 89101, USA.