Privacy Policy

Categories of Data We Collect

• Application data: full name, email address, organization or affiliation, researcher type, and a description of your intended research use, submitted when you apply for access.
• Account credentials: a salted, hashed password. We never store your password in plain text and cannot recover it for you.
• Verification metadata: a cryptographic hash of your IP address, your browser's user-agent string, and the exact version of the attestation text you were shown, recorded at application and again at checkout.
• Order data: shipping address, order contents, and email address, when you place an order.
• Usage data: standard web server logs (request timestamps, page paths, response codes) collected automatically by our hosting infrastructure.

How We Use Your Data

We use this data to review and decide researcher applications, operate your account, process and ship orders, respond to support requests, maintain the security and integrity of the site, and meet our legal and financial recordkeeping obligations, including those of our payment processors.

The Verification Log

Every application decision, and every checkout, creates a permanent log entry: the applicant or buyer's identity, the exact attestation text version shown, a timestamp, a cryptographic hash of the IP address (never the raw address), the user-agent string, and, for application decisions, the reviewing administrator's identity and stated reason. This log exists to show that access was granted only after human review. It is retained for 24 months, after which entries are deleted unless a longer period is required to resolve an open dispute, chargeback, or legal request.

Data Retention

Outside the verification log described above, we retain account and order data for as long as your account remains active and for 24 months afterward, then delete or anonymize it, except where a longer period is required for tax, accounting, or legal recordkeeping.

Sub-Processors

• Hosting and infrastructure: Cloudflare, Inc. — Workers (application hosting), D1 (database), R2 (document storage), and KV (session storage).
• Payment processing: the payment processor(s) enabled for this store, as recorded in our internal payment rail governance records. We do not store your full payment card number.
• Email delivery: our transactional email provider, used to send account, order, and application-status notifications.

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act and the California Privacy Rights Act give you the right to know what personal information we have collected about you, the right to delete it, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. To exercise any of these rights, contact us using the route below.

Deleting Your Data

To request deletion of, or a copy of, your data, email ross@gratefulpeptides.com from the address associated with your account, or write to Grateful Peptides at 26 Fry St, Wichita Falls, TX 76308-5507. We will verify your identity before acting on the request and respond within the time required by applicable law. Deletion requests are subject to the retention exceptions described above.

Contact

Grateful Peptides
26 Fry St, Wichita Falls, TX 76308-5507
940-247-7949
ross@gratefulpeptides.com