Privacy Policy

PeppyCheck ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, how we store it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR). PeppyCheck is operated by PeppyCheck, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for personal data collected through peppycheck.com. For any privacy-related queries contact us at hello@peppycheck.com.

2.1 Account data: full name, email address, password (stored as a secure hash), date of account creation, Terms acceptance record including version and timestamp, optional marketing consent and timestamp.

2.2 Supplier account data: full name and email address of the account holder, business name and contact details, team member names and email addresses, documentation submitted for verification, submission history and edit request history.

2.3 User-generated content: review text, ratings, and the supplier, peptide, or batch the review relates to; community report submissions including uploaded documents; supplier and peptide request submissions.

2.4 My Stack data: saved suppliers, peptides, and batches; status settings and private notes.

2.5 Consent records: Terms of Service acceptance including version, timestamp, and IP address; marketing consent decisions and timestamps; cookie consent decisions including accepted or rejected, timestamp, visitor ID, and user agent.

2.6 Listing claim requests: full name, business name, email address, website, any message provided, and timestamp of submission.

2.7 Usage and analytics data: if you have accepted analytics cookies we collect anonymised usage data via Google Analytics and Hotjar, including pages visited, time on page, and general interaction patterns. This data is collected only with your explicit consent.

2.8 Technical data: IP address, browser user agent, and session data for security and consent record purposes.

We use your personal data to: provide the platform including creating and managing your account; verify supplier documentation as part of our verification process; maintain consent records in compliance with GDPR; communicate with you regarding submissions, claim requests, and support queries; improve the platform using anonymised analytics data with consent; protect the platform against fraud, abuse, and unauthorised access.

Contract: processing necessary to provide the platform services you have signed up for. Legitimate interests: platform security, fraud prevention, and maintaining the integrity of verification and review data. Consent: analytics cookies and marketing communications where you have explicitly opted in — you may withdraw consent at any time. Legal obligation: maintaining consent and Terms acceptance records as required by applicable data protection law.

Your data is stored securely using Supabase, a cloud database infrastructure provider. Data is stored in the [INSERT SUPABASE REGION] region. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. Passwords are stored as secure hashes and are never accessible in plain text. All data transmission uses HTTPS encryption.

Account data: retained for the duration of your account and deleted within 30 days of account deletion upon request. Review and submission data: retained indefinitely as part of the platform record unless you request deletion. Consent records: retained for 7 years for legal compliance purposes. Analytics data: retained in accordance with Google Analytics and Hotjar retention settings, typically 26 months. Listing claim requests: retained for 2 years from submission date.

We do not sell your personal data to any third party. We may share data with the following providers solely to operate the platform: Supabase (cloud database and infrastructure); Google Analytics (anonymised usage analytics, only with your cookie consent); Hotjar (anonymised session analytics, only with your cookie consent); Google Tag Manager (tag management and analytics deployment); Resend (email delivery, planned integration). All third party providers are bound by data processing agreements.

Under UK GDPR and EU GDPR you have the following rights: right of access; right to rectification; right to erasure; right to restriction; right to data portability; right to object; right to withdraw consent. To exercise any of these rights please contact us at hello@peppycheck.com. We will respond within 30 days.

We use essential cookies to operate the platform and, with your consent, analytics cookies to understand platform usage. For full details see our Cookie Policy at peppycheck.com/cookie-policy.

Where your data is processed or stored outside the UK or European Economic Area, we ensure appropriate safeguards are in place in accordance with UK GDPR and EU GDPR requirements including standard contractual clauses or adequacy decisions where applicable.

PeppyCheck is not directed at and does not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data please contact us at hello@peppycheck.com.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by updating the effective date at the top of this page.

If you have concerns about how we handle your personal data you have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU you may contact your local data protection authority.

For any privacy-related queries please contact us at hello@peppycheck.com or by post at: PeppyCheck, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.