Skip to main content
Research use only · Laboratory handling only
JUNI peptides
Research use onlySold for laboratory research use only. Not for administration, ingestion, inhalation, or topical application. Not a drug, food, or cosmetic.

Privacy

We collect the minimum personal data needed to ship an order and to comply with our legal obligations.

Controller

The data controller under GDPR Article 4(7) is the entity responsible for operating this storefront. Its identifying details are being finalized with counsel and will be published on the imprint page once confirmed.

Data we collect

  • Name, email, billing and shipping address — required to fulfil orders.
  • Order history — retained for accounting and customer support.
  • Payment metadata — including provider, amount, currency, transaction and order references, status, and reconciliation evidence. Payment providers handle payment-account credentials and transfer execution; we do not receive or store customer payment-account passwords.
  • For PeerPay checkouts, internal cart, order, payment, and payment-session identifiers; the selected payment-method group; configured settlement asset, network, and destination identifiers; PeerPay order and payment status snapshots; signed internal references; and verified webhook event identifiers, timestamps, payload digests, processing outcomes, and payloads. Hosted-checkout tokens are encrypted at rest while they are needed.
  • Storefront analytics — page views, advertising campaign attribution, product views, cart additions, checkout steps, payment-provider selection, and completed order totals and product details. Direct customer identifiers, payment credentials, addresses, and order references are not intentionally included in these analytics events.
  • Session replay and heatmap measurements on public shopping pages. Account, cart, checkout, and order-detail pages are excluded; URLs with query strings are paused to avoid sending URL parameters to the replay provider.
  • HubSpot page visits on public storefront and wholesale pages, limited to page paths without query strings. We exclude account, cart, checkout, order, and admin routes. HubSpot is not loaded when location is unavailable, in the EEA, UK, or Switzerland, or when Global Privacy Control is set.
  • For Allscale checkouts, an opaque checkout reference, payment amount and currency, and verified payment notifications. These notifications may include the payer wallet address, network, transaction hash, payment method, and amounts, which we retain with restricted access for payment reconciliation and the applicable accounting period.

How we use it

  • To process and ship your order.
  • To communicate about your order (confirmation, dispatch, problems).
  • To meet tax and customs reporting obligations.
  • To improve the site and detect abuse.

What we do not do

  • Sell or rent your data.
  • Send marketing emails without explicit opt-in.
  • Send customer names, email addresses, postal addresses, or payment credentials in analytics events.

Retention

Order records are retained for the period required by accounting and tax law in the operating jurisdiction (typically 7 to 10 years), then deleted or anonymized.

For PeerPay, full webhook payloads with a resolved status of processed or ignored are replaced with a pruned marker after 90 days. The event identifier, payload digest, processing outcome, and related order and payment evidence remain in the transaction and reconciliation record for the applicable accounting or legal-retention period.

Unresolved PeerPay webhook payloads and audit or reconciliation records, including records marked failed, dead_lettered, or reconciliation_required, are not included in the automatic 90-day pruning process. They are retained while the issue is unresolved so an authorized replay or investigation remains possible. Once resolved, the resolved-payload rule above applies; earlier removal requires an authorized manual retention or deletion process and is subject to legal-retention obligations. Encrypted hosted-checkout tokens are removed when the related attempt is fulfilled or cancelled.

Your rights

EU and UK residents are entitled to the following rights under the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR:

  • Article 15 — Right of access. Confirmation of whether we process your personal data and a copy of it.
  • Article 16 — Right to rectification. Correction of inaccurate or incomplete data.
  • Article 17 — Right to erasure (“right to be forgotten”). Deletion where one of the grounds in Art. 17(1) applies and no overriding legal-retention obligation intervenes.
  • Article 18 — Right to restriction of processing.
  • Article 20 — Right to data portability. Receipt of data in a structured, commonly used, machine-readable format.
  • Article 21 — Right to object to processing based on legitimate interest or carried out for direct marketing.
  • Article 77 — Right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of these rights write to research@junipeptides.com. We respond within 30 days (extendable by a further two months where necessary under Art. 12(3)).

EU residents may also lodge a complaint with their national data-protection authority. The directory is published by the European Data Protection Board at edpb.europa.eu/about-edpb/about-edpb/members_en.

Subprocessors

We operate the storefront, e-commerce backend, and primary database in our controlled application environment. We also use approved external providers for some delivery functions. Those providers may process personal data on our behalf, including:

  • Resend (Delaware, USA) — transactional email delivery (order confirmations, shipping updates). EU SCCs in place.
  • Cloudflare (San Francisco, USA) — DNS, CDN, DDoS protection, and edge tunnel terminating to our origin. EU SCCs in place.
  • Cloud object storage and media delivery provider — storage and delivery of product and other site media. The production provider, processing regions, transfer terms, and data-processing agreement must be approved and identified in this notice before the service is launched.
  • Google Analytics 4 and Google Ads — measure storefront traffic, campaign attribution, and purchase-funnel events. Google Signals and ads personalization signals are enabled for the retail property. Event parameters are limited to page, campaign, product, checkout-step, and order-value details; customer identifiers are not intentionally sent in event payloads. Google's own services may use browser storage and other signals under the applicable Google settings and terms.
  • Microsoft Clarity — session replay and heatmaps for public shopping pages. Sensitive account, cart, checkout, and order-detail paths and any URL containing query parameters are not recorded. For visitors in the EEA, UK, and Switzerland, and when location is unavailable, Clarity receives a denied consent signal and operates in its limited cookie-free mode; no consent popup is shown.
  • HubSpot — measures eligible public page visits using a visitor identifier and technical browser information. We do not send private page paths or arbitrary URL parameters to its tracking code.
  • BTCPay Server — self-hosted on our infrastructure for Bitcoin / Lightning settlement.
  • PeerPay — hosted payment checkout for supported payment apps and crypto wallets. We provide the order amount and currency, callback URLs, the selected payment-method group, and an opaque signed attempt reference needed to reconcile the payment. We receive and retain PeerPay order, payment, and verified-webhook status snapshots as described under “Data we collect” and “Retention” above. PeerPay and the payment platform you choose process the payment-account and transaction evidence under their own notices and retention obligations. We do not receive or store your payment-platform password or login credentials. This processing is necessary to perform the purchase contract.
  • Allscale — hosted card checkout when available. We send the order amount and currency, an opaque payment reference, and a return URL containing a signed reference. We do not send your name, email, or shipping address to Allscale. Allscale and its payment partners collect the details required to process your chosen payment under their own notices; we receive payment notifications and reconciliation evidence as described above. We do not receive your full card number, card security code, wallet private keys, or payment-account login credentials.

Media storage and delivery are not self-hosted in the supported production topology. Google and Microsoft process analytics data under their applicable service terms; the responsible owner must confirm the current processing agreements and regional transfer disclosures before release.

Contact

Data-protection enquiries: research@junipeptides.com.