Privacy

Patriot Peptides is a UK storefront for laboratory research materials. Guest checkout does not create an account. You are not required to register to buy.

Guest checkout

When you place an order we need a name, a UK delivery address, an email, and payment details sufficient to take the sale. The order ID is a PP- reference. Delivery address is kept on your device for tracking and receipts, as the checkout already states. We use it to fulfil the parcel — not to build a marketing list.

Encryption at rest

Names, emails and delivery addresses written to the house books are sealed with AES-256-GCM before they hit the database. Stripe secret keys are sealed the same way. Card numbers never sit on this server — Stripe takes the card. The office is locked to a single operator; only that sign-in can open an address to pack a parcel. Sign-in, checkout and discount-code checks are rate-limited. That is not a promise that no one with the vault key and the database can ever read an order; it is the practical bar: no plaintext customer file, no shared staff logins, no card data in the house.

Payments

Card payments, when the office has connected Stripe, are processed by Stripe. We do not store full card numbers on this site. If Stripe is not connected, the till uses the house card form for a recorded order — still not an account.

Visit counts

First-party visit counts stay in the house office so we can see which pages are read. That is our own log, not a sold-on dossier. It does not store IP addresses, time zones, or raw browser IDs — those are hashed before they hit the books. Referrers keep only the site they came from, not the query string. Rows older than 30 days are burned. The office, sign-in, and API paths are not counted at all. Operator sign-in (Better Auth) is for that one locked door — shoppers never create an account. The desk signs itself out after ten idle minutes.

House confidentiality bar

Guest checkout. Names, emails and delivery addresses sealed with AES-256-GCM at rest. Cards never on this server. Single operator. Rate-limits keyed on a hash, not a stored IP. Pages do not leak a referrer to other sites. Advertising pixels stay off unless you switch them on. That is the highest bar this till can actually keep.

What a shop cannot hide

This storefront is not a VPN, and it cannot make you invisible to a bank, a card network, a parcel carrier, or a host with a lawful demand. Card payments go through Stripe. Parcels go through Royal Mail. The site is served from Vercel. Those firms keep their own records. Sealing names here is the house bar — not a cloak.

Advertising pixels

Advertising pixels fire only when the office has switched them on. They are off by default. See Cookies.

Hosting and fonts

The site is served from Vercel. Display type is loaded from fonts.googleapis.com / fonts.gstatic.com. Those requests are how the page renders, not a separate advertising product we added.

Your rights

UK GDPR and PECR apply. You can ask what we hold about an order, ask us to correct it, or ask us to stop optional pixels and marketing email. Write via Contact. We do not sell personal data. We do not give dosing, protocols or medical advice in reply.