Privacy Policy

Last updated: 2026-04-29

1. Who We Are

PeptideBase (peptidebase.io) is a US-based educational provider directory and research matching platform. We are not a healthcare provider, telehealth service, or medical platform. All content is educational and informational only.

For privacy-related questions, data access requests, or deletion requests, contact us at [email protected].

2. Information We Collect

2a. Matching questionnaire data

When you use the matching tool, we collect your responses to the 7-step questionnaire. This includes your research goals, age range, lifestyle factors, protocol preferences, and country.

Health-related information (sensitive data): Step 5 of the questionnaire asks whether any health conditions apply to you. This information is special-category data under GDPR Article 9 and sensitive personal information under CCPA/CPRA. We collect it only with your explicit, voluntary consent (the checkbox on that step), and use it solely to filter out peptides with contraindications for your reported conditions. It is never used for advertising, profiling, or shared with third parties.

All questionnaire responses are stored pseudonymously, linked only to a random UUID — not to your name, email address, or any account. No account is required to use the tool.

2b. Email address (optional)

After completing the questionnaire, you may optionally provide your email address to save your results. If you also check the newsletter opt-in box, we will add you to The Peptide Research Digest, our occasional newsletter covering peptide research and sourcing. These are separate actions — providing your email does not automatically subscribe you to the newsletter.

2c. Analytics and usage data

We use Vercel Analytics, a privacy-first, cookieless analytics tool. It collects aggregate page view data (pages visited, referrer, country-level geography) without setting tracking cookies, without cross-site tracking, and without linking data to individuals. We do not currently use Google Analytics, advertising pixels, or any other third-party tracking scripts.

3. Legal Basis for Processing (GDPR Users)

If you are located in the EU, UK, or EEA, the following legal bases apply:

Questionnaire data (excluding health flags): Article 6(1)(b) — processing is necessary to provide the matching service you requested.
Health-related information (health flags): Article 9(2)(a) — explicit consent. You consent by ticking the checkbox on step 5 of the questionnaire. You may withdraw consent at any time by emailing [email protected] — we will delete your session data on request.
Newsletter: Article 6(1)(a) — consent. You consent by ticking the newsletter opt-in checkbox. You may withdraw by unsubscribing at any time.
Vercel Analytics: Article 6(1)(f) — legitimate interest in understanding aggregate site usage. No cookies are set; no personal data is collected by this service.

4. How We Use Your Information

To generate your educational provider match results
To filter out peptides with contraindications you reported (health flags only)
To send you newsletter content, if you opted in
To understand aggregate site usage (Vercel Analytics — no individual profiles)

We do not sell your data. We do not share your data with advertising networks, data brokers, or any third party for commercial purposes. We do not use health-related information for any purpose other than filtering contraindicated peptides from your match results.

5. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights over your personal information.

Sensitive Personal Information (SPI): Health condition data collected in the questionnaire (step 5 health flags) constitutes Sensitive Personal Information under CPRA. We collect this data solely to provide the matching service you requested. We do not use SPI to infer characteristics about you, for advertising, or for any secondary purpose. You have the right to limit our use of your SPI to the purpose for which it was collected.

Your rights: You have the right to know what personal information we collect, to request deletion, to correct inaccurate data, and to opt out of the sale or sharing of personal information. We do not sell or share personal information. To exercise any right, email [email protected].

We will not discriminate against you for exercising your privacy rights.

6. Data Retention

Match session data (including all questionnaire responses and health flags) is automatically deleted 90 days after creation. Deletion is enforced by an automated database job — not a manual process.
Newsletter subscriptions are retained until you unsubscribe or request deletion.
Vercel Analytics data is aggregate and not linked to individuals. Retention is governed by Vercel's own data policy.

You may request deletion of your session data before the automatic 90-day window by emailing [email protected] with your session ID (visible in your results page URL).

7. Cookies and Session Storage

We set one first-party session cookie (pb_session_token) that contains a random identifier — no personal information. It is used to associate your match results with your browser and expires after 90 days.

We do not set advertising cookies, third-party tracking cookies, or any cookies tied to external analytics networks. Vercel Analytics does not use cookies.

8. Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) signal. If your browser transmits a GPC signal, any optional analytics tracking on our site is automatically disabled. No action is required on your part.

9. Third-Party Services

We use the following sub-processors. Each handles data under its own privacy policy and our data processing agreements:

Supabase — database hosting (US region). Stores match sessions, provider data, and newsletter subscriptions.
Vercel — site hosting and analytics. Processes page-level aggregate data; no personal data from Analytics.
Resend — transactional email. Processes email addresses for newsletter delivery.

We do not use advertising networks, social tracking pixels, or data brokers. Data is processed in the United States.

10. International Users

PeptideBase is operated from the United States. If you access this site from the EU, UK, EEA, or another jurisdiction with data protection laws, your information will be transferred to and processed in the US. By using the site and consenting to data collection where prompted, you acknowledge this transfer.

EU/UK/EEA users have all the rights described in Section 3 (GDPR legal basis) and may contact us at [email protected] to exercise them. We aim to respond to all requests within 30 days.

11. Children

PeptideBase is not directed to anyone under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has submitted data through this site, please contact us at [email protected] and we will delete it promptly.

12. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Withdraw consent (for health data and newsletter)
Restrict or object to processing
Data portability
Opt out of the sale or sharing of personal information (we do not sell or share)
Limit use of Sensitive Personal Information (California)

To exercise any right, email [email protected] with “Privacy Request” in the subject line. For session data deletion requests, include your session ID from your results page URL. We will respond within 30 days.

13. Changes to This Policy

We may update this policy when our data practices change. The “Last updated” date at the top of this page reflects the most recent revision. Material changes affecting your rights will be announced on the site.