Privacy Policy

Who this covers

This policy describes how Long Island Peptides (LIPEPS, lipeps.com) handles information from visitors, customers, and affiliate applicants. You can browse without creating an account and use guest checkout. Send privacy questions or requests through Contact.

Information you provide

The age gate checks the birth date you enter in your browser. It does not send that date to our server; it stores a cookie recording that the age check was passed and when. Checkout separately records your age and research-use confirmations. We do not request an identity document at checkout.

Email offers and text alerts

Email offers use double opt-in: signing up sends one email with a confirmation link, and nothing else is sent to that address unless you confirm. The link works once and expires after 7 days. Confirming creates a single-use code for your first order, tied to that email. Every marketing email includes an unsubscribe link and supports one-click unsubscribe in email apps that offer it; unsubscribing takes effect immediately and does not affect order, pickup, or sign-in emails. We keep a record that you unsubscribed so we do not email you offers again. The signup form is protected by Cloudflare Turnstile, and repeated attempts are limited using a hash of your IP address; we do not store your IP address with your signup.

Text alerts are optional. After confirming your email you may give a US mobile number and consent to marketing texts. Consent is not a condition of purchase. We record the number, the consent wording and version, and the date. We do not send text messages yet. When we do, you can reply STOP to any message to opt out, or ask us to remove your number at any time. We do not sell, rent, or share mobile numbers or text-message opt-in data with third parties or affiliates for their marketing purposes. A messaging provider will process numbers only to deliver our messages.

Email is delivered by our email service provider, Resend, which receives your address and the message content.

Payment information

Card details are entered in fields provided by the card processor. We do not receive or store full card numbers. We keep the transaction reference, payment status, amount, and confirmation information needed to reconcile the order.

For bank-transfer purchases, we generate an order reference and record the payment status. We do not receive your bank login. For cryptocurrency, we keep the invoice reference and status returned by the payment service. We do not receive private wallet keys. Public blockchain transactions may be visible to others on the network.

Available methods are shown on Payments and at checkout. Payment providers handle information under their own privacy policies.

Information from visits and referrals

Requests to the site include an IP address and browser information. We use request information for security, troubleshooting, and limits on repeated requests. Our hosting provider also processes requests and may retain operational logs under its own policies.

A random cart identifier connects your browser to the items and any discount code saved in your cart. Cookies also remember age confirmation, account sessions, and access to recent orders. Your browser's own storage remembers whether you closed or used the email-signup card, so it is not shown again for 90 days (or at all after you sign up); this stays in your browser and is not sent to us. See Cookies for names and lifetimes.

If you follow an approved affiliate link, we record the referral code, a coarse landing-page section, time, and a keyed hash derived from the IP address, affiliate, and a seven-day time bucket. New click records do not retain the browser user agent, full landing URL, query string, or raw IP address. The hash is pseudonymous information, not anonymous data. Older records may contain earlier landing-page or browser details until reviewed and cleared. A referral cookie can associate a later order with that affiliate, and our records track the commission. Affiliate dashboards show aggregate clicks, conversions, and commission information.

We do not run third-party advertising pixels or sell personal information. We do use our own order and referral records for reporting and referral-fraud checks; this is separate from advertising-network tracking.

Who receives information

We provide information needed by services that operate the shop: hosting and database services, email delivery, payment services, and shipping carriers. For example, a carrier receives the recipient's name and address, and the email service receives the address and content of an order email. Our configured hosting and database provider is Cloudflare. Provider logs and retention are managed separately from the application database.

Support and authorized staff can access information needed to manage orders and requests. We may also disclose information when required by law. We do not share customer information with advertising networks.

How long information remains

Sign-in links expire after 15 minutes or when used. Opening the sign-in email link leads to a confirmation step before it is redeemed. Review invitations expire after 45 days and are completed when an eligible review is submitted; opening one creates a review-page cookie lasting up to one hour. Signing in with the order email can restore review access. Guest order links normally expire 30 days after creation, and guest order sessions last up to 7 days. Links and sessions may be revoked earlier. Signing in with the order email can restore access to guest purchases. Customer and affiliate sessions expire after 30 days and can be ended by signing out. Expiration prevents further access; it is not the same as immediate deletion of every associated database record or backup. The Cookie Policy lists browser-cookie lifetimes. Restoring order access does not require a marketing subscription.

Orders, payment records, account history, reviews, support conversations, and affiliate records are retained to operate the service and meet applicable recordkeeping requirements. There is no single automatic deletion deadline for all of these records. Our retention controls support reviewing obsolete click detail, expired access records, and completed email payloads for deletion or minimization. The routine uses configurable periods and excludes protected records and active holds. Availability of that routine does not mean all old records are immediately or automatically deleted. Cart-cookie expiration also does not automatically erase the server-side cart record.

A restock subscription is removed when its alert is queued for delivery; the outgoing email record may remain. Email us to cancel an alert that has not yet been sent.

An email-signup record, including any text-alert number and consent, is kept while you are subscribed and afterwards as a record of your consent and opt-out, until you ask us to delete it.

Access, corrections, and deletion

Contact us from the email address used for the account or order to request a copy, correction, or deletion of your information. We verify that a request is yours before sharing private records or making changes, using access to the order email or other proportionate order information. Do not send an identity document unless support explains why it is necessary and how to provide it securely.

Some sales or payment information may need to remain for fulfillment, accounting, refunds, disputes, fraud prevention, legal obligations, or an active preservation hold. Deletion in our active systems does not immediately erase separate backups or vendor records, which follow their own retention and restoration processes. We will explain any limitation that applies to a request. You may also ask us to remove a published review or its displayed name. Loyalty tier emails go to account holders and stop when the account is deleted.

Depending on where you live and which laws apply, you may have additional privacy rights. Contact us to exercise them. Our site does not currently change its cookie behavior in response to Global Privacy Control or Do Not Track browser signals.

Keeping access private

Account sign-in tokens and customer, affiliate, and guest-order session tokens are stored as hashes. Session and order-access cookies use HttpOnly protection; the age-confirmation cookie is set by your browser and is not HttpOnly. Live-site cookies use Secure transmission and SameSite settings as described on Cookies.

Anyone with a still-valid private order link can open access to that order after confirmation. Forwarding it can therefore share access. The link is exchanged for a browser session and removed from subsequent order URLs. Use the account controls to revoke guest access to an order if needed. Keep order links, sessions, and sign-in emails private. No online service can promise perfect security.

Age and policy changes

This shop is for adults aged 21 or older. If you believe someone under that age has submitted information, contact us so we can investigate and address it.

We may update this policy as the service changes. The date above identifies the current version. Earlier versions are available in the policy archive. Material changes receive additional notice where required. Privacy questions and requests go through Contact.