Privacy policy

Last updated: September 24, 2026

1. Controller

  • OX RESEARCH LTD — Company number 17464288 (England and Wales)
  • 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
  • E-mail: support@oxpeptides.com
  • Hours: Mon–Fri 9 am – 1 pm PT

This policy applies to oxpeptides.com (the "Site"). It follows the UK GDPR and the Data Protection Act 2018, the EU General Data Protection Regulation (GDPR) for residents of the European Economic Area and Switzerland, and US state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA) for California residents.

2. Data we collect

2.1 Order data

  • Name, shipping address, e-mail address, phone number if provided
  • Products ordered, amounts, order and payment status, tracking number
  • Subscription status and the tokenised cancellation link sent by e-mail

Card numbers are never seen or stored by us: they go directly to the payment processor. We receive only a payment confirmation and, where applicable, the last four digits.

2.2 Stock alerts

When you ask to be notified that a product is back in stock, we store your e-mail address and the product concerned, only to send that notification.

2.3 Age-gate and attestation log

The Site asks every visitor to confirm being at least 21 years old, and every buyer to attest that the purchase is for laboratory research. We log the date and time, the IP address, the browser user agent, the terms accepted and the version of the terms. This log is our proof that the attestation was made.

2.4 Technical data

  • IP address, browser type, pages visited, timestamps (server logs)
  • A signed cookie holding the attestation token, and a session cookie for the checkout
  • A first-party cookie (30 days) recording how you first reached the Site: the campaign parameters already present in the link you clicked and the page you landed on. It is read only when you place an order, so we know which campaign paid for it. When you come back through another campaign link (one of our e-mails or text messages, for example), that link is kept next to the first one and counts for 7 days, without replacing it. It is never shared with anyone.
  • An internal, anonymous visit count, kept in our own database and run by no outside tool: for each step of a visit (page viewed, product page, add to cart, checkout, click on Pay, payment) we record the page, the language, the country, whether the device is a phone or a computer, and the campaign of the attribution cookie above. It sets no cookie. Your IP address is never stored: it is mixed with a random key that changes every day and is deleted after 48 hours, so no one, us included, can trace a visit back to a person or follow a visitor from one day to the next. No name or e-mail address is recorded. These figures only tell us how many visits become orders; they are never used for advertising and never shared.

3. Why we use it (legal bases)

  • Fulfilling your order — performance of the contract.
  • Age-gate and attestation log — legal obligation and legitimate interest in proving the conditions of sale were met.
  • Stock alerts — your consent, withdrawable at any time by replying to the e-mail.
  • Security and fraud prevention — legitimate interest.
  • Anonymous visit count — legitimate interest in knowing how many visits become orders.

4. Processors

Data is shared only with the providers needed to run the Site and deliver orders:

  • Vercel — hosting of the Site (United States).
  • Supabase — database holding orders, stock alerts and the attestation log.
  • Resend — transactional e-mails (order confirmation, shipping, stock alerts, subscription links).
  • Payment processor — card (Visa, Mastercard, American Express) and Apple Pay and Google Pay payments.
  • Fulfillment — our own dispatch from the EU receives name, shipping address and order contents to prepare and ship the parcel; the carrier receives the same for delivery and tracking.

Each provider is bound by a data-processing agreement and processes the data only for the purpose above. We never sell personal data.

5. International transfers

The hosting, database and e-mail providers are in the United States; orders are prepared and shipped from the EU. Transfers rely on the providers' contractual safeguards (standard contractual clauses or equivalent).

6. Retention

  • Order data: 10 years (accounting and legal obligations).
  • Attestation log: as long as the related order records, and at least 5 years.
  • Stock-alert e-mails: until the notification is sent or you withdraw consent, and at most 12 months.
  • Server logs: 90 days.
  • Anonymous visit count: 13 months.

7. Your rights

You can ask for access to your data, its correction, its deletion (subject to legal retention), a copy in a portable format, and object to or restrict a processing. Write to support@oxpeptides.com; we answer within 30 days. You may also lodge a complaint with the supervisory authority of your country of residence. California residents have, under the CCPA/CPRA, the right to know what personal information we hold, to have it deleted, to correct it, and to opt out of its sale or sharing; we do not sell or share personal information, and we never discriminate for exercising these rights.

8. Cookies

The Site uses strictly necessary cookies: the attestation token (2 years), the checkout session, the subscription/tracking links you open, a region cookie (your country, chosen in the footer or inferred from your connection) that sets the display currency and the shipping line, and a first-party attribution cookie (30 days) holding the campaign parameters of the link you first arrived through. These are first-party only and no consent banner is needed for them.

The Site also uses advertising and analytics cookies, only with your consent in the EU, the EEA and the United Kingdom: a banner asks before anything is set, declining is one click, and the Site works exactly the same either way. They let us measure which campaign led to an order and are provided by Google (Analytics, Ads) and Meta. Your choice is stored in your browser and can be changed by clearing this site’s data.

9. Changes

This policy may be updated; the date at the top identifies the version in force. See also the terms of service and the legal notice.