Valyria Peptides / policies
Privacy policy
How the storefront processes information, and how to exercise your rights.
Version 2026-09-14.1 · Effective
Published policy. Company and operating details marked “TO BE CONFIRMED” must be completed before commercial launch.
Controller and privacy contact
Controller: [LEGAL COMPANY NAME — TO BE CONFIRMED]. Address: [PRIVACY CONTACT ADDRESS — TO BE CONFIRMED]. Privacy email: [MONITORED PRIVACY EMAIL — TO BE CONFIRMED]. Data protection officer, if appointment is legally required: [DPO NAME AND CONTACT — TO BE CONFIRMED]. UK/EU representative, where required: [REPRESENTATIVE DETAILS — TO BE CONFIRMED]. Until those details are completed, use the Contact page to raise a privacy enquiry; do not send identity documents or sensitive research data unrequested.
Information and purposes
We process account email and authentication records; purchaser and recipient names, contact and delivery details; cart contents, orders, payment references and status; research/age attestations and legal acceptance records; support messages, newsletter preferences and submitted reviews; and technical information such as IP, device/browser signals and security events. Sources are you, your browser, our fulfillment/payment services and verified order events. We do not ask for medical information. Full payment-card details are handled by an enabled payment provider, not this checkout form. Admin authentication includes encrypted authenticator information and hashed recovery codes.
UK GDPR and EU GDPR lawful bases
Contractual necessity supports requested accounts, order handling and support before or during a contract. Legal obligations support records and checks required by tax, accounting, sanctions or other applicable laws. Legitimate interests support proportionate fraud prevention, security, service reliability and dispute handling, subject to an interests and rights assessment. Consent supports optional marketing subscriptions and any future non-essential device storage; consent is separate from purchase and may be withdrawn without affecting earlier lawful processing. Each purpose and basis must be confirmed in the controller’s processing register before launch. We do not treat acceptance of this notice as blanket consent.
Recipients and international transfers
Hostinger hosts the application and database; Cloudflare provides DNS, TLS, security and delivery services. Depending on activated services and an accepted order, processors for email, payment and fulfillment receive only the information needed for their function. Professional advisers and authorities may receive records where necessary or legally required. Locations, subprocessors and contracts require a recorded review. Where UK or EEA information is sent to a location without applicable adequacy coverage, the controller must establish an appropriate mechanism, such as applicable EU standard contractual clauses or a UK IDTA/Addendum, and assess supplementary safeguards and transfer risks before the transfer. We do not assert that an unverified contract or adequacy scheme is already in place.
Retention and security
The application’s admin session lasts up to 12 hours with a 30-minute idle timeout; a customer session lasts up to 30 days with a seven-day idle timeout. Open carts expire after 30 days. Research access is recorded for the browser tab session. These expiry periods do not imply immediate deletion of every database, audit or backup copy. Orders, tax records and legal acceptance evidence are retained for applicable recordkeeping obligations and the period needed to resolve claims. Security records are retained according to the incident and investigation need; support correspondence for the inquiry and any related claim; reviews while published and as needed for moderation disputes; and minimal newsletter suppression data to respect opt-outs. Backup copies follow the backup lifecycle and are restricted from routine use. Contact us to request a retention explanation or deletion; legal obligations and documented holds may limit deletion. Shipping and acceptance evidence are encrypted; passwords and session tokens are hashed. Restricted access, mandatory admin 2FA and incident procedures limit access; no system is guaranteed risk-free.
Your rights and complaints
Depending on the applicable law, you may request access, correction, erasure, restriction, portability, objection to legitimate-interest processing, and withdrawal of consent. We may need proportionate identity verification and may retain information where a lawful exception applies. UK/EU requests are generally answered within one month, with any lawful extension explained. You may complain to the UK Information Commissioner at ico.org.uk or your relevant EU supervisory authority and seek a judicial remedy. We do not make solely automated decisions with legal or similarly significant effects without the safeguards required by applicable law; automated anti-abuse checks can be raised with support for review.
California CCPA / CPRA
Where the business is subject to California privacy law, California residents may request to know/access categories and specific personal information, deletion, correction, portability, and information about collection, disclosure, sale or sharing. They may opt out of sale/sharing and limit qualifying uses of sensitive personal information, without unlawful discrimination. An authorized agent may submit a request subject to verification. The current storefront does not sell personal information, share it for cross-context behavioral advertising, or run advertising trackers; it does not use sensitive data to infer personal characteristics. Global Privacy Control does not enable any tracking and will be honored for any applicable future sale/share activity. This does not imply that a statutory business threshold has been assessed. Generally a covered business responds within 45 days, with permitted extensions explained. Before any material practice change, update this notice, the required notice at collection and choice mechanisms.
Children, updates and inquiries
The storefront is restricted to purchasers aged 18 or older and does not knowingly solicit children’s information. Contact us if you believe a child has supplied data so we can investigate and remove it where required. Material changes receive an updated date/version and additional notice where required. The current notice describes implemented functions; any proposed service must undergo privacy review before activation.