Privacy Policy
Your birth date stays in your browser and is not stored or sent. This storefront uses an age-eligibility cookie and local cart storage. Contact and checkout information are handled separately.
Recommended policy draft for attorney and merchant review. Confirm operational details and applicable legal requirements, and obtain approval from qualified counsel before the store accepts orders.
Scope and responsibility
This policy describes the Peptide Lattice storefront and the information flows it initiates. The merchant is responsible for its customer information and for confirming the privacy practices of the hosted WooCommerce store and its service providers. Before launch, the merchant must confirm its legal identity, business address, provider details, and applicable privacy obligations. Separate provider notices may supplement this policy but do not replace the merchant's responsibilities.
Age verification
Your date of birth is used in your browser to determine whether you meet the minimum age of 18. It is not sent to the server, placed in a cookie, or saved in browser storage. After successful verification, the browser stores pl_age_ok=1 for 30 days. This cookie records eligibility only, uses SameSite=Lax, and is marked Secure on HTTPS. Clearing or blocking it may cause the age gate to appear again.
Cart and essential browser storage
The storefront saves product IDs and quantities in browser localStorage so your cart can survive a reload or later visit on the same browser. Cart storage does not contain your name, address, payment details, or birth date and has no automatic expiry. It remains until you clear the stored cart or browser site data. The age cookie and cart storage support essential site functions; disabling browser storage may reduce that functionality.
Contact messages
When you submit the Contact form, it sends your name, email address, optional order number, and message to the storefront's contact endpoint. The endpoint validates the fields and, when enabled, forwards those fields to the configured contact-service provider. If the service is not configured or fails, the form reports that the message could not be delivered. There is no contact-message database in this storefront. Hosting systems and a configured contact provider may still process or retain submission-related information. Do not send card numbers, government identifiers, or sensitive personal information.
Orders and hosted checkout
Continuing to checkout passes the cart's product IDs and quantities in a shareable checkout URL to the hosted WooCommerce store. These values can appear in browser history and service logs. Hosted checkout may collect contact details, billing and shipping addresses, order information, and payment information needed to complete a purchase. Payment providers handle payment credentials; this storefront does not collect card numbers. Review the hosted store's and payment provider's notices before submitting an order.
Technical information and purposes
Hosting and infrastructure providers may process IP addresses, browser or device information, timestamps, requested pages, and diagnostic information to deliver pages, maintain security, and investigate problems. Contact information is used to answer inquiries and support orders; order information is used for fulfillment, customer service, refunds, fraud prevention, and required records. We do not automatically turn a contact inquiry into a marketing subscription.
Legal bases where applicable
Where data-protection law requires a legal basis, processing may be necessary to take requested steps before a purchase or perform an order contract, comply with legal obligations, or pursue legitimate interests such as site security and customer support, subject to applicable rights. Consent is used where required for optional marketing or nonessential tracking. If consent is the basis, it may be withdrawn for future processing without affecting processing that was lawful before withdrawal.
Service providers and disclosures
Information may be handled by hosting providers, the configured contact service, the WooCommerce host, payment providers, fulfillment or shipping services, and professional advisers where needed for the stated purposes. It may also be disclosed when legally required or reasonably necessary to protect legal rights, prevent fraud, or address security concerns. Providers should receive only information needed for their role. Actual provider names, contractual protections, and any additional checkout plugins must be confirmed before this policy is adopted.
Advertising and tracking
The current storefront code does not include advertising pixels or marketing analytics and does not implement the sale of personal information or sharing for cross-context behavioral advertising. This statement is limited to this storefront configuration; the hosted checkout and any future plugins or services require separate review. Before adding nonessential tracking, the merchant must update these disclosures and implement any required consent, opt-out, or recognized privacy-preference controls. This policy does not claim those additional controls are already implemented.
Retention
The age cookie expires after 30 days, and the local cart remains until cleared as described above. Support, order, and service-provider records should be retained only as long as reasonably necessary for the stated purpose, required accounting or legal obligations, fraud prevention, or resolving disputes. Retention can depend on whether an inquiry remains open, an order or refund is still being handled, or a legal hold applies. The merchant must document actual retention periods and verify provider deletion and backup practices before launch; this storefront does not automatically delete records held by external services.
Security and international processing
HTTPS and restricted server-side access are used to protect information in transit and keep WooCommerce credentials out of browser code. No website or transmission method can guarantee absolute security. Hosting, checkout, or contact providers may process information outside your state or country. Provider locations and any legally required international-transfer protections must be confirmed and implemented before the final policy is published.
Your choices and privacy requests
Depending on your location and applicable law, you may have rights to access, correct, delete, or receive a copy of personal information; restrict or object to certain processing; withdraw consent; or opt out of qualifying uses. Contact support@peptidelattice.com or use the Contact page with the nature of your request and information reasonably needed to locate relevant records. Do not send sensitive identity documents unless a secure, necessary verification method has been agreed. We may need proportionate identity verification, and some records may be retained where law permits or requires it. You may also have a right to complain to a relevant privacy authority. Exercising a legal privacy right should not result in unlawful discrimination.
Children and young people
The service is intended for adults aged 18 or older. We do not knowingly seek personal information from children. If you believe a child has submitted personal information, contact us so the merchant can investigate and remove it where appropriate or required. The age-eligibility cookie is not a stored record of anyone's birth date.
Changes to this policy
We will explain material changes to information practices in an updated policy and obtain new consent where required. Changes do not retroactively authorize uses that were inconsistent with the notice or permissions applicable when information was collected. This draft requires the merchant to verify its actual providers, hosted-checkout tracking, retention schedule, transfer arrangements, and request-handling process before adoption.
