Privacy Policy
Version 2026.08.26. This is the formal privacy notice required by processors, app stores, and most privacy laws. It works alongside the more detailed Data Use Policy and the Global Compliance Addendum.
Who we are
X Factor Research LLC (DBA X Factor Peptides) ("we", "us") is a US-based research-material e-commerce business operating from Maryland. We are the data controller for the personal information described here. Contact: [email protected]. Data Protection Officer alias: [email protected].
What we collect and why
- Account data (name, email, optional institution) — to create your account and show order history. Basis: contract.
- Order data (ship-to address, items, totals, attestation timestamp, UA, timezone) — to fulfill the order and meet recordkeeping obligations. Basis: contract + legal obligation.
- Payment data — entered directly with our processor. We never receive or store full card numbers. Basis: contract.
- Communications (support tickets, form submissions) — to respond. Basis: legitimate interest.
- Marketing opt-ins (newsletter, waitlist, exit-intent email) — only with consent. Basis: consent.
- Technical/security logs (IP, request metadata) — fraud prevention and security. Basis: legitimate interest.
- Optional analytics — aggregated, no PII. Basis: legitimate interest / consent where required.
What we do NOT do
- We do not sell personal information.
- We do not use third-party advertising or cross-site tracking.
- We do not make solely automated decisions that produce legal or similarly significant effects about you. Orders receive an internal fraud-risk score, but it only flags an order for a human to look at; a person makes every decision to hold, cancel, or refuse an order, and you can ask us to explain any such decision.
- We do not knowingly collect sensitive personal information or data from anyone under 21.
Who we share with
Only operational processors, and only the minimum each one needs. These are the actual companies, named, rather than a list of categories:
| Processor | What it receives | Why |
|---|---|---|
| Supabase (US) | All order, account and attestation data | Database and application hosting. This is where the store lives. |
| Cloudflare (US) | Request metadata, IP | Site delivery, TLS, and bot/abuse protection. |
| Resend (US) | Your email address and message content | Sending order confirmations, payment instructions and support replies. |
| Shippo (US) | Recipient name, shipping address, phone, email | Generating the shipping label and carrier tracking. Passed on to the carrier you are shipped by. |
| Google Analytics 4 (US) | Aggregated usage events, no order or account data | Only if you accept analytics cookies. Nothing loads before you do. |
We do not share personal information with anyone else, and no processor above is permitted to use your data for its own purposes.
If a processor changes we will update this table. If you want to know what any one of them holds about you, ask and we will tell you.
How long we keep it
Order/attestation/audit data: 7 years (recordkeeping). Account profile: until deletion + 30-day grace. Support tickets: 3 years. Marketing list: until you unsubscribe. Server logs: 90 days.
Your rights
Access, correct, delete, port, opt out, and object — exercise any at [email protected].
Response windows by jurisdiction:
- California (CCPA/CPRA): We confirm receipt within 10 business days and substantively respond within 45 calendar days, extendable once by an additional 45 days with notice to you.
- EU/UK (GDPR/UK-GDPR): Within 30 days, extendable to 90 with notice.
- Other US state privacy laws (CO, CT, VA, UT, TX, OR, MT, IA, IN, TN, MN, NJ, DE, NH, MD MODPA): Per each statute's stated window; defaults to 45 days where ambiguous.
Full jurisdiction-by-jurisdiction detail is in the Global Compliance Addendum.
Artificial intelligence
We use AI in two clearly bounded places, and nowhere else.
The on-site chat assistant. The assistant on this website is software, not a person, and it says so before you type. When you send it a message, that message (and the conversation so far) is transmitted to Groq, Inc. (United States) to generate a reply. We do not send Groq your name, address, order history, or payment details, and Groq is contractually barred from using your messages to train models. Please do not type health information, payment details, or anything else you want kept private into the chat. Chat transcripts are retained for up to 90 days for abuse prevention and quality review, then deleted.
What the assistant will not do. It is instructed to refuse dosing, treatment, diagnostic, veterinary, and human-use guidance, and to state that every product is sold for laboratory research use only. Its answers can still be wrong or out of date. Nothing it says is medical, veterinary, legal, or regulatory advice, and nothing it says overrides the product label, the Certificate of Analysis, or these policies.
Internal drafting tools. We use AI assistance internally to draft product copy and documentation. Everything published is reviewed by a person before it goes live. AI is never used to decide whether to accept, hold, cancel, or refuse your order, to set your price, or to evaluate you as a customer.
You may ask us at [email protected] to delete your chat transcripts, or to answer any question without AI involvement.
Subprocessors
We share necessary data with the following service providers, all bound by data-processing agreements: Supabase (database + auth, US), Cloudflare (CDN + DNS, US), a trusted payment processor (card payments, US), Resend (transactional email, US), Namecheap (domain + forwarders, US), Groq (AI agent inference, US). When card payments go live, we will publish the merchant-acquirer details here. KYC/identity verification, when triggered, is performed by a verified vendor (currently Persona or equivalent). USPS and UPS are used as shipping carriers; carrier-required minimum address data is the only data shared with them.
CAN-SPAM physical address
X Factor Research LLC (DBA X Factor Peptides) — Maryland, USA. The full street address required by 15 U.S.C. §7704 is listed on every commercial email footer and at /legal once SDAT filings clear.
Security
Passwords are hashed. Sessions are HTTPS. Every admin action is audit-logged. Vulnerability reports: [email protected]. Full posture in SECURITY.md.
Cookies
First-party only. See the Cookie Policy.
International
We ship to US addresses only and do not transfer personal data outside the United States.
Changes
Material changes appear here with a new version and a 30-day banner + email notice.