Cookie Policy

Version 1.1 · September 14, 2026

At a glance

We don’t use advertising, cross-site tracking, or profiling cookies, and we don’t load third-party scripts (no Google Analytics, no Meta Pixel). We measure traffic with our own self-hosted system, described below. That is why you won’t see a consent banner: everything we store in your browser is either strictly necessary for the store to work or deleted when you close the tab.

What we store

Name	Type	Purpose	Duration
`pv.cart.v1`	localStorage	Your cart contents	until the cart is emptied
`pv.gate.v1`	localStorage	Your confirmation of age and research purpose, with a timestamp	permanent, until you clear your browser data
`pv.sid`	sessionStorage	A random ID (UUID) for your current visit, used only by our traffic measurement and cash-on-delivery fraud prevention system. It contains no personal data, is never shared, and does not link separate visits together	until you close the tab
`pv.landing`	sessionStorage	The first page you visited in this session, the referring site (referrer), and campaign parameters (utm_*), so we know where an order came from	until you close the tab
`pv.idem`	sessionStorage	A technical key that stops the same order from being submitted twice if your connection drops during checkout	until you close the tab or the order is recorded
`pv.last_order`	sessionStorage	The number of your most recent order, so the confirmation page knows whether you left an email address	until you close the tab

All of these are stored locally in your browser. They are not cookies: they aren’t sent automatically with every request, and other websites can’t read them. Your cart and eligibility confirmation reach us only when you place an order. The pv.sid ID is sent to our server with every page you view, together with the data described under “Traffic measurement.”

How to delete them

Clear the site data in your browser settings, or clear your browsing history. If you do, your cart will be emptied and we will ask you to confirm again on your next visit. Anything in sessionStorage is deleted automatically when you close the tab.

Traffic measurement

Every page you view sends a short message (a “beacon”) to our order server (api.peptovitalis.com, hosted in the European Union) containing: your IP address, browser type and operating system (user agent), the page viewed, the page you came from (referrer, without parameters), any campaign parameters in the URL (utm_*), the pv.sid ID, and store events (add to cart, checkout started, order placed). From your IP address we derive only your country, offline — never your precise location.

We don’t use a third-party service, don’t track you on other websites, and don’t build advertising profiles. We use this data for website security, to prevent fraudulent cash-on-delivery orders (repeatedly refused packages), and for internal statistics (where our orders come from). The legal basis is our legitimate interests (art. 6(1)(f) GDPR); you can object by emailing gdpr@peptovitalis.com. Traffic data is deleted automatically after 180 days; data linked to an order is kept for as long as the order itself.

We don’t act on your browser’s “Do Not Track” signal, because this measurement has no advertising purpose. You can block these requests with any extension that blocks requests to api.peptovitalis.com; the website, including checkout, will keep working.

External fonts

The website loads fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). This request sends your IP address to Google. It is the only third-party request the website makes.

If we add third-party tools

If we ever add a third-party analytics or advertising service, we will update the table above and ask for your consent before it loads, with “reject” as the default. The version number of this page changes with every update.