This notice is provided for transparency; it is not legal advice. It describes what this website’s code actually does with personal data — not a generic template.
The short version: we run our own, first-party analytics to see how the site is used and how much attention each vendor listing gets. It sets two cookies of ours — a random visitor id and a random session id — unless you opt out. There are no third-party scripts, no ad trackers, and nothing is ever sold. Your IP address is never stored: we keep only a one-way hash made with a salt that changes every day. Analytics data is deleted after 13 months. You can turn it off at any time with Reject in the cookie banner, the Cookie settings link at the bottom of every page, or your browser’s Global Privacy Control / Do Not Track setting. The only other personal data we store is what you choose to type into a vendor correction or profile-claim form. Details below, matching GDPR Article 13 and the CCPA/CPRA notice-at-collection requirements.
Every /vendor/{domain}/ trust profile carries a “Request an update / Submit a
correction” form, and a separate profile claim form lets a vendor tell us the
operating entity behind an otherwise-anonymous listing. Submitting either form stores the following in
our database, for human review:
submitter_name) — so a reviewer knows who is asking.submitter_email) — so a reviewer can follow up
with you about the outcome.relationship: owner,
representative, employee, legal, or other) — so a reviewer can weigh the submission’s
standing.message) — the correction or claim itself, and
any evidence links, entity name, or notes you provide.source_ip) — stored
server-side only, never shown on any page. It exists solely to support abuse prevention (rate-limiting
and spam triage), alongside a honeypot field and hard per-field length caps.Nothing you submit is ever published automatically. A person reviews every submission against public records before anything changes on the site — see the disclaimer for the full review process. A best-effort internal email notification (via Azure Communication Services) tells a reviewer a new submission is waiting; it carries the same fields listed above and nothing else, and a failure to send it never blocks or loses your submission — the database write is the record of truth.
Lawful basis (GDPR Art. 6(1)(f)): our legitimate interest in operating a working right-of-reply and correction mechanism for the businesses we write about, and in preventing abuse of that mechanism. We do not use this data for marketing, and we do not need your consent to accept a correction you chose to send us — but you can always decline to submit the form; nothing about using the rest of the site depends on it.
Our own small script (served from this site, like every other file here) records how pages are used and sends it to our own server. No analytics company, ad network or other third party receives it.
Cookies we set — all first-party, set by peptidepricehistory.com, readable by no other site:
pi_vid — a random visitor id, so we can count returning visitors. Expires
13 months after it is first set.pi_sid — a random session id, so we can tell one visit from the next. Expires after
30 minutes without activity.pi_consent — remembers your choice in the cookie banner (accept or reject). Set only
once you choose; expires after 13 months.Neither id contains anything about you: each is a random number generated in your browser.
What we collect while analytics is on:
?), the website you came
from (its domain only), and any campaign tags (utm_) in the link you followed;IP addresses are never stored. For each event we keep only a one-way hash of your IP address, made with a secret salt that changes every day: the same address produces unrelated values on two different days, so it cannot be used to follow anyone from one day to the next. The secret is kept in our key vault, separate from the data. We use the hash only to spot automated traffic and double counting within a day.
Outbound vendor clicks. When you click through to a vendor’s own storefront we count the click (which of our page types it came from, a coarse device class, the time) so we can report referral volume to vendors. The click log stores no IP address and no cookie. While analytics is on it also stores the random id of the page view the click came from, so we can see which page and listings led to it. If your browser sends Do Not Track or Global Privacy Control, no click is recorded at all.
How long we keep it: analytics events are deleted automatically after 13 months. Daily totals calculated from them contain no identifiers.
Who sees it: us. Vendors who use our PeptideIQ portal see aggregate numbers about their own listings — how often they were shown, at what position, how many clicks they received — never data about an individual visitor. We never sell analytics data, never share it for advertising, and run no ad trackers of any kind.
How to opt out — any one of these works, immediately:
When you opt out, pi_vid and pi_sid are deleted at once and never set again,
and we stop recording everything listed above except two anonymous counts: that a page was viewed, and which
vendor listings appeared on it. Those carry no identifier of any kind — no cookie, no
visitor or session id, no IP hash — so they cannot be linked to each other or to you; they only keep
our page totals and each vendor’s view counts honest. If you clear your cookies, the banner will ask
again (unless your browser sends Global Privacy Control, which we always honour).
Lawful basis (GDPR Art. 6(1)(f)): our legitimate interest in understanding how the site is used and in reporting honest, first-hand reach numbers to the vendors we list. You can object at any time with any of the opt-outs above.
Protecting our data from bulk scraping. Requests to our data API (the JSON behind some pages, not the pages themselves) are logged for 14 days with the same daily-changing hash of your IP address, the request path and result, a short label for the kind of client (for example “chrome” or the name a bot gives itself — never your full user-agent string) and whether the address belongs to a data centre. If a client scrapes in bulk or follows a hidden link that only a robot ignoring robots.txt would follow, its hash for that day goes on a block list for 7 days, and each data request is checked against the request’s own hashes for the past 7 days. A block only refuses the data API; every page stays open. Lawful basis: our legitimate interest in protecting the site and its data from abuse.
Besides the cookies above, this site writes two localStorage keys to your browser, both
strictly functional, and neither ever leaves your browser:
pi-theme — remembers whether you chose light or dark mode.pi-disclaimer-ack — remembers that you dismissed the first-visit research-use
disclaimer, so it doesn’t reappear on every page. This dismissal expires after 2 days, by design, so
the notice resurfaces periodically rather than being silenced forever after one click.Vendors who sign in to the PeptideIQ portal also get sign-in cookies from our authentication provider, Clerk, which keep them signed in. They are set only when you sign in and are not used for analytics.
Analytics events: 13 months, then deleted automatically, every night, a whole month at a time.
Correction and profile-claim submissions: up to 24 months from the date of submission, after which we delete them — unless a longer period is needed to resolve an active dispute over a listing, or is required by law. This is a policy commitment rather than an automated process today: we do not yet run an automated purge job for submissions, so in practice deletion (including deletion before the 24-month mark, on request — see below) is carried out manually by a reviewer. If you would like your submission deleted sooner, contact us and we will action it.
PeptideIQ Assistant (vendors only): the questions a signed-in vendor asks the assistant in the PeptideIQ portal, and its answers, are kept for 90 days and then erased automatically; the usage records behind the assistant’s monthly allowance (who asked, when, and what it cost) are kept for 24 months. We may read questions and answers to support you or to investigate abuse. To answer, the assistant sends your question and your store’s own portal data to Anthropic, which provides the AI model and processes it as our service provider.
We do not sell or share personal data with third parties for advertising or any other commercial purpose. The database backing this site (including analytics) is hosted on Microsoft Azure infrastructure, and the reviewer notification email described above is sent through Azure Communication Services — both process data only as our infrastructure providers, under our instructions, never on their own behalf. We may disclose data if required to do so by law or a valid legal process.
Whether or not GDPR or CCPA/CPRA formally applies to you, we offer the same rights to everyone who contacts us: you can ask us what personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we’re using it. California residents specifically have the right to know, delete, and correct personal information, and the right to non-discrimination for exercising any of these rights — and, since we do not sell or share personal information, there is nothing to opt out of on that score. You can switch off our own analytics at any time (see section 2). EU/UK residents additionally have the right to data portability and the right to lodge a complaint with your local data protection authority.
To exercise any of these rights, email
contact@peptidepricehistory.com from the address you
submitted with, or explain your relationship to the submission if you can’t. To have the analytics
events tied to your browser deleted, include the value of your pi_vid cookie (your browser’s
site settings show it) — it is the only thing that links those events to you. We will respond within
a reasonable time, consistent with the corrections process described on our disclaimer
page (typically within a few business days).
This site is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has submitted personal data to us, contact us and we will delete it.
If we materially change what we collect or why, we will update this page and change the date below. Continued use of the site after a change means you accept the updated notice for anything you submit after that date.
The Peptide Index is operated by Voltairera Voltpool, LLC, a South Carolina limited liability company. Voltairera Voltpool, LLC does not publish a postal address for this site. That is a deliberate choice, not an oversight — contact for access, correction, and deletion requests is handled by email at the address below.
Questions about this policy, or a request to access, correct, or delete your data: contact@peptidepricehistory.com