Privacy Policy

1. Data Controller

The controller within the meaning of the GDPR is PeptidLabs (търговско име). For questions related to personal data: info@peptidlabs.eu.

2. Data We Collect

• Order data — name, delivery address, email, phone.
• Payment data — processed entirely by Stripe; we do not store card numbers, CVVs or authentication data.
• Shipping data — we transmit the minimum necessary data to the courier (Econt, Speedy, DHL or another carrier).
• Technical data — IP address, browser type, access time, pages visited, anonymized for analytics purposes.
• Cookies and local storage — see the separate Cookie Policy.

3. Purposes and Legal Basis

• Contract performance — for order processing, delivery and communication (Art. 6(1)(b) GDPR).
• Legal obligation — for retention of accounting records and invoices (Art. 6(1)(c) GDPR).
• Legitimate interest — for fraud prevention and service improvement (Art. 6(1)(f) GDPR).
• Consent — for marketing emails and non-essential cookies (Art. 6(1)(a) GDPR).

4. Retention Periods

• Order data and invoices — 10 years under the Bulgarian Accounting Act.
• Newsletter subscription data — until the Customer unsubscribes.
• Technical logs — up to 90 days.
• Cookies — per their configuration (see Cookie Policy).

5. Third Party Processors

• Supabase Inc. (US, EU-US Data Privacy Framework + SCC) — database hosting (eu-west-1).
• Stripe Payments Europe Ltd. (Ireland) + Stripe Inc. (US, DPF) — card payment processing; we do not store card numbers.
• Resend Inc. (US, DPF) — transactional email and newsletter delivery.
• Econt Express / Speedy / DHL — courier services, only for shipping processing.
• Vercel Inc. (US, DPF) — application hosting and edge CDN.
• Google LLC (US, DPF) — Google Analytics 4 (loaded only after consent via cookie banner).
• Plausible Insights OÜ (Estonia, EU) — privacy-friendly analytics without cookies.
• Ahrefs Pte (Singapore, SCC) — privacy-friendly SEO analytics without cookies.
• Cloudflare Inc. (US, DPF) — CDN, DNS and Turnstile CAPTCHA protection on forms.
• OpenRouter Inc. (US, SCC) — proxy for the AI assistant in the chat widget; conversations are forwarded to Google Gemini API for analysis.

6. International Transfers

Some processors (Supabase, Stripe Inc., Resend, Vercel, Cloudflare, Google, OpenRouter, Ahrefs) process data outside the European Economic Area, primarily in the US and Singapore.

Transfers are based on: (a) EU Commission adequacy decision of 10 July 2023 — EU-US Data Privacy Framework — for DPF-certified recipients; (b) Standard Contractual Clauses 2021/914 (SCC) for the others. A copy of the applicable SCC is available on request at info@peptidlabs.eu.

7. Your GDPR Rights

To exercise your rights, please write to info@peptidlabs.eu. We respond within 30 days.

• Right of access (Art. 15) — to obtain confirmation and a copy of your data.
• Right to rectification (Art. 16) — to request correction of inaccurate data.
• "Right to erasure" (Art. 17) — the "right to be forgotten" in certain cases.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — to receive your data in a structured format.
• Right to object (Art. 21) — including to profiling and marketing.
• Right to lodge a complaint with the Bulgarian Personal Data Protection Commission — www.cpdp.bg.

8. Security

We apply technical and organizational measures, including TLS encryption in transit, database Row-Level Security, strict role-based access and regular security audits.

9. Biometric data — Research assistant

The /asistent (Research assistant) page accepts a personal photo upload. The photo falls under the special category of personal data per GDPR Art. 9 (biometric characteristics).

Processing is based on your explicit consent (Art. 9(2)(a)), which you confirm via a separate checkbox before upload. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

The photo is forwarded for real-time analysis to the following processors: OpenRouter Inc. (US, SCC) — proxy to Google Gemini Vision (US, EU-US DPF) — for safety classification and broad attribute extraction (gender, age band, build, skin tone). No biometric identifiers usable to identify a specific person are extracted.

The photo is NOT stored in our database and is NOT persisted to Supabase Storage. The buffer holding the image is released immediately after the Vision LLM response is received.

The resulting illustrative visualization of a person-like-you is kept in a public bucket for 30 days with automatic deletion. The visualization carries a permanent baked-in watermark stating it is not a medical prediction.

10. Minors

The platform is not intended for persons under 18. We do not knowingly collect data from minors. The Research assistant requires explicit confirmation of adulthood before accepting a photo.

11. Changes to this Policy

We may update this policy. The date of the last update is indicated at the top. Significant changes are communicated by email to registered customers.

12. Contact

Data Protection contact: info@peptidlabs.eu