Privacy Policy

1. Introduction

PeptideSchool ("we", "us", "our") is committed to handling personal information responsibly. This Privacy Policy explains what we collect, why we use it, which service providers receive it, and the choices available when you use peptideschool.org.

2. Data We Collect

We collect the following categories of personal information:

• Account Information: name, email address, and encrypted password (for email registration) or profile data provided by Google (for OAuth registration).
• Payment Information: processed securely by Stripe. We do not store credit card numbers, CVVs, or full payment details on our servers. We receive only a reference ID, plan type, and payment status.
• Usage Data: pages visited, core conversion milestones, features used, content categories viewed, protocols created, and interaction patterns within the platform. Feature-level analytics are reduced when you choose basic measurement.
• Technical Data: IP address, browser type and version, device type, operating system, referral URLs, and approximate geographic location derived from IP.
• Communication Data: messages sent through our contact form, including email address, subject, and message content.

3. Purpose of Data Processing

We process your personal data for the following purposes:

• To create and manage your account and authenticate your identity.
• To process payments and manage your subscription status.
• To provide, maintain, and improve the platform and its features.
• To personalize your experience and remember your preferences (e.g., accent theme, saved peptides).
• To measure core traffic and conversion performance and, when enhanced analytics are enabled, improve feature-level product experience.
• To communicate with you regarding your account, service updates, or responses to inquiries.
• To detect and prevent fraud, abuse, or unauthorized access.
• To comply with legal obligations.

4. Data Sharing

We do not sell personal information for money. We disclose limited data to service providers that help us operate, secure, measure, and improve the platform:

• Stripe processes payments. Stripe receives your payment details directly and processes transactions under its own privacy policy (stripe.com/privacy).
• Supabase provides backend infrastructure, authentication, and database hosting. Your account and application data are stored on Supabase's secure servers.
• Vercel provides web hosting and content delivery. Vercel processes technical data, including IP addresses and request headers, to serve the platform.
• Google Analytics provides anonymized usage analytics. We use Google Analytics 4 to understand traffic patterns and feature usage. IP anonymization is enabled.
• Meta Pixel and Conversions API receive limited page and conversion signals used to measure advertising performance. We minimize content details and strip sensitive URL parameters before sending server-side events.
• Microsoft Clarity provides session interaction and performance diagnostics, including navigation patterns, clicks, and device characteristics, to help us identify usability and reliability issues.

Each provider processes data under its own privacy terms. We limit the fields sent from our application and do not send payment card details to analytics or advertising providers.

5. Data Security

We implement industry-standard security measures to protect your personal information, including: TLS/SSL encryption for all data in transit, encrypted password storage using secure hashing algorithms, Row-Level Security (RLS) policies on our database to ensure users can only access their own data, PCI-DSS compliant payment processing through Stripe, and regular security reviews of our infrastructure. While we take reasonable precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: request a copy of the personal data we hold about you.
• Right to Rectification: request correction of inaccurate or incomplete data.
• Right to Erasure: request deletion of your personal data ("right to be forgotten").
• Right to Restriction: request that we limit the processing of your data.
• Right to Data Portability: request your data in a structured, machine-readable format.
• Right to Object: object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: withdraw consent at any time where processing is based on consent.

To submit a privacy request, contact us at contact@peptideschool.org. We will verify and respond to valid requests as required by applicable law. We do not discriminate against users for exercising applicable privacy rights.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law (e.g., financial transaction records, which may be retained for up to 7 years for tax and accounting purposes). Anonymized and aggregated data that cannot identify you may be retained indefinitely for analytical purposes.

8. Cookies

We use cookies and similar technologies for the following purposes:

• Essential Cookies: required for authentication and session management. These cookies are necessary for the platform to function and cannot be disabled.
• Basic Measurement: a limited baseline for page visits, core signup and purchase-funnel milestones, reliability, security, and fraud prevention remains active even when the preference banner is dismissed or basic measurement is selected.
• Enhanced Analytics: when enabled, Google Analytics, Meta CAPI enrichment, and Clarity user tags can provide additional feature-level and session context to help us improve the platform.

PeptideSchool uses Google Analytics 4, Meta Pixel and Conversions API, and Microsoft Clarity. Selecting or closing the preference banner stores your choice on that browser. You can clear site storage to reset it. Disabling essential browser storage may prevent authentication or saved preferences from working.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will notify you by email or through a prominent notice on the platform at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

10. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at: