Privacy Policy

This Privacy Policy explains how Slate Peptides (“we,” “us,” or “our”) collects, uses, and shares personal information when you use our website, create an account, submit an order, or contact us.

This policy describes our current application practices. It is not a claim of compliance with any particular privacy statute unless we expressly state otherwise in writing after legal review.

Depending on how you use the Services, we may collect:

• Identity and contact information — name, email address, and phone number when you provide them
• Account information — authentication credentials (handled by our auth provider), account type, and profile details
• Billing and shipping information — address and related order details needed to invoice and fulfill orders
• Order history — products, quantities, pricing tier, discounts, totals, and order/payment/fulfillment status
• Wholesale application information — wholesaler selection and approval status
• Required acknowledgments — age and research-use confirmations associated with your account or order
• Support communications — messages you send through our contact form or email
• Device and technical information — browser type, approximate request metadata, and similar log information that our hosting and security infrastructure may process
• Cookies and local storage — data stored on your device for session/auth, cart persistence, first-party traffic measurement, and advertising technologies (see Cookies and Advertising technologies below)

First-party traffic and attribution. On the production storefront, Slate operates its own traffic analytics. This system is separate from Vercel Web Analytics and from Meta, OpenAI, Google Ads, and Rumble advertising measurement. It is not the Meta Pixel. It runs only when your privacy state permits analytics (see Your privacy choices). Depending on the visit, it may collect:

• Random visitor and session identifiers. These are pseudonymous. They are not customer account IDs, and we do not describe this collection as anonymous.
• Page paths only. We do not store the query string or the full page URL in these records.
• The referring site’s hostname, not the full referring URL.
• Allowlisted campaign labels — source, medium, campaign, and content — when a visit includes them. A campaign term in a link is ignored and is not stored in new analytics records. Older traffic rows may still contain a campaign term until the existing 180-day retention deletes them.
• Short opaque campaign codes (campaign, ad set or ad group, ad, creative, and placement identifiers) when a link includes them. They are letters, numbers, dashes, and underscores only, not product, health, or audience descriptions. They are first-party analytics: they continue after an advertising opt-out, are never sent to an advertising platform, and are not treated as proof of an ad click.
• Product slugs used internally for storefront reporting. Those slugs are not included in Slate’s minimized Meta browser event payloads.
• Event types for a page view, a product view, an add-to-cart action, and checkout started.
• Parsed browser, device category, and operating-system labels, plus country and region when our hosting provider supplies a trusted production value in an accepted format.
• Only when your privacy state permits advertising, Meta browser and click identifiers already present in the browser (_fbp, _fbc, and a valid fbclid) when those values pass format checks. When a visit has a valid fbclid but no _fbc cookie, Slate may store an _fbc-format value built from that fbclid and the time of the visit. These identifiers are stored with the visitor record as received, not hashed, and are deleted with it.

Separately from those first-party traffic events, when your privacy state permits advertising, OpenAI attribution identifiers from a ChatGPT ad click may be stored in first-party cookies (__oppref, __obref, and slate_oppref). When Rumble tracking is also enabled, a valid Rumble click identifier (_raclid) may be stored in a first-party slate_raclid cookie and a visitor-level Rumble click record for up to 30 days. Those Rumble records are not part of the first-party visitor identifier fields listed above.

Before the visitor cookie is stored, the browser keeps a randomly generated bootstrap identifier in that tab’s session storage. It is not a cookie and not a customer account identifier. It lets the first events on a visit share one visitor and session.

These traffic records are not written from preview, development, localhost, or other non-production hosts. They are also not collected for admin, sales-rep, account, API, authentication, invitation, sign-in, sign-up, password-reset, or health paths, or as page views on the checkout success page. We do not store complete URLs, arbitrary query parameters, search terms, customer-entered free text, card or payment credentials, raw email addresses, raw phone numbers, or medical or research free text in these traffic events.

When an order is created during checkout on the production storefront, Slate records the privacy state that applied to that request with the order: a category such as analytics permitted or advertising opted out, whether a Global Privacy Control signal was present, the regional rule applied, and the policy and notice versions. It does not include an IP address. If your privacy state permits analytics, Slate’s server may also associate that order with the first-party visitor and session cookies already present on that request. This happens before payment and does not change the order, its price, or its payment. If no association was made at checkout, the checkout success page may associate the visitor with that order when the signed-in account, or the existing guest access check, matches that exact order, and only when both the privacy state recorded at checkout and the current one permit analytics. When analytics is not permitted, the order is reported as privacy-limited and no visitor evidence is read for it.

After an order is verified paid, Slate may record a per-order attribution summary from evidence recorded at or before checkout: the kind of association used, a classification and reason, the campaign source, medium, campaign, and referring hostname that the classification relied on, any campaign codes from that visit, and whether a Meta or OpenAI click identifier was present. Click identifiers are considered only when the order’s privacy state permitted advertising. The summary records only whether a click identifier was present, not the identifier itself, and does not include the visitor or session identifier. A separate checkout-time Rumble snapshot, when written, is stored with the order and is not part of that first-party summary. Staff may separately mark an order as internal or test, which excludes it from reporting by default, or record a manual assessment. Manual assessments are labeled as unconfirmed, kept separate from observed evidence, and never change the recorded classification.

Some orders cannot be associated with a visit, for example when cookies are blocked or cleared, checkout happens on another device, or the order predates this system. Slate does not guess a source for those orders from order amount, customer, products, timing, device, or location. This association does not provide a complete purchase-attribution report, and any conversion rate based on it is an estimate limited to tracked visits.

After a verified payment, the checkout success page may ask the optional question “How did you hear about Slate?” with fixed answers. Answering is voluntary and does not affect your order. The answer is stored once with that order, labeled as customer-reported, kept separate from observed attribution, never treated as advertising consent, and never sent to an advertising platform.

A separate, short-lived operational signal may hold a raw IP address and raw user agent, only when your privacy state permits advertising. On the production storefront, they are taken from trusted hosting-platform request metadata when your browser sends a first-party traffic analytics request, and a later request from the same visitor replaces them. The page cannot supply or replace those values. The signal is isolated from the admin traffic dashboard. Its only use is as optional matching data in the server-side Meta Purchase event described below, for the visitor exactly linked to that order.

We do not intentionally collect health diagnoses, medical records, or other clinical health data through the Services. Products are for research and laboratory use only. Research-use positioning does not change how we treat personal information: some state laws may treat information about purchases or browsing of certain products as consumer health data. See our Consumer Health Data Privacy notice.

Slate may also use Vercel Web Analytics as a separately configured website-traffic provider, only when your privacy state permits analytics. That provider measures aggregated storefront page views and visitors. It is not Slate’s first-party traffic analytics, it is not the Meta Pixel, and it is not intended to include medical information or operator/admin activity.

Use Your Privacy Choices in the site footer at any time to review or change optional analytics and advertising. Strictly necessary cookies for sign-in, cart, checkout, security, and remembering your choice always stay on. Your choice is stored in a slate_privacy cookie for up to 12 months, then you may be asked again. Closing the notice without choosing does not save a choice and does not turn anything on. That dismissal lasts only for the current browser tab.

We use the country and state supplied by our hosting provider, not precise location, to decide which rule applies. When that information is missing or incomplete, the more restrictive rule applies:

• Most U.S. states — first-party analytics and advertising technologies run by default, and you can opt out of either at any time.
• Washington, Nevada, Connecticut, and Virginia — only strictly necessary cookies run until you choose. You may allow first-party analytics. Meta, OpenAI, Google Ads, and Rumble advertising technologies are not used for visitors from these states.
• Maryland, or a U.S. visit where the state is unknown — only strictly necessary cookies run, and optional categories are not offered.
• Outside the United States, or when the country is unknown — nothing optional runs until you choose. Rejecting is as easy as accepting, and no category is pre-selected. No campaign or landing information is stored before you allow analytics.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of advertising sharing for that browser: the Meta Pixel, the OpenAI Ads pixel, the Google tag, and the Rumble advertising tag do not load, no advertising server events are sent for your orders, and advertising identifiers and the short-lived IP and user-agent signal are not collected. First-party analytics and campaign codes may continue where analytics is otherwise permitted. The footer control shows when the signal is in effect. A choice on the site cannot override the signal.

Opting out of advertising has the same effect as the signal. We also expire the Meta, OpenAI, Google Ads, and Rumble identifier cookies that our site can reach and remove stored Meta browser and click identifiers from your first-party visitor record. When Rumble visitor click records exist, those are also removed. Opting out does not delete your orders or change order records, attribution summaries, or checkout-time Rumble snapshots already written; later orders are recorded as advertising opted out. You can opt back in through the same control unless a browser signal or regional rule prevents it.

Withdrawing analytics stops future first-party and Vercel analytics collection and removes the slate_vid and slate_sid cookies. Records already collected are kept only for the retention periods below.

We keep a record of each choice made in the banner or preferences dialog: a random choice identifier, the choice, the resulting category, the regional rule applied, whether a browser signal was present, the policy and notice versions, and the time. It contains no IP address, account, or order. Choice records are deleted after 24 months.

We use personal information to:

• Create and administer accounts
• Process orders, invoices, and payments
• Coordinate fulfillment and shipping after payment confirmation and approval
• Provide customer support and respond to inquiries
• Enforce research-use and eligibility requirements
• Protect against fraud, abuse, and security threats
• Comply with legal obligations and enforce our Terms
• Improve site reliability, performance, and usability
• Understand production-storefront traffic and navigation, including product views, add-to-cart actions, and checkout started
• Attribute visits to campaigns and referral sources recorded by the first-party system
• Reduce duplicate analytics events and keep session reporting coherent
• Measure and optimize advertising (see Advertising technologies). This does not mean the current system provides complete purchase attribution or a conversion rate.

We use service providers to operate the Services. Categories and named vendors currently relevant to this application include:

• Supabase — Authentication, database, and account infrastructure
• Vercel — Website hosting and application delivery
• QuickBooks / Intuit — Invoicing and payment processing support
• Warehance / Uptime Fulfillment — Order fulfillment and shipping operations
• Resend — Transactional and support email delivery

These providers process information on our behalf under their own security and privacy practices. We do not sell personal information.

We also use advertising technologies described below. Meta, OpenAI, and Rumble are advertising platforms that process information under their own terms and privacy policies, not only as operational vendors acting solely on our instructions. Some privacy laws may treat advertising pixels and conversion APIs as sharing for cross-context or targeted advertising. We do not claim that this activity is excluded from those definitions. You can opt out of it through Your Privacy Choices or a Global Privacy Control signal.

Raw first-party analytics events, visitor records, and session records may be retained for up to 180 days. A first-party session continues until about 30 minutes pass without activity. Local midnight does not, by itself, start a new session.

Raw IP address and raw user-agent signal records are isolated from the admin traffic dashboard and are retained for no more than seven days. After confirmed successful Meta Purchase delivery, the system attempts to delete the matching signal for that visitor. If cleanup fails or no confirmed delivery occurs, the seven-day maximum still applies.

The slate_privacy choice cookie lasts up to 12 months, and choice records are deleted after 24 months. Campaign codes on visitor and session records follow the 180-day analytics retention above.

Checkout-time links between an order and a visitor and session are deleted 180 days after checkout once the order’s attribution summary exists (or if the order was never verified paid). Supporting touch details (campaign labels, landing paths, referring hostnames, and checkout device, browser, operating system, country, and region) are deleted 180 days after the summary is written, and checkout diagnostics 180 days after the last checkout attempt. Success-page links are deleted with the visitor record. The per-order attribution summary, campaign codes snapshotted with the order, the order’s privacy-state record, the customer-reported source, records of advertising events suppressed for privacy, internal/test flags, manual assessments, checkout-time Rumble snapshots, and their change history are kept with the order and deleted when the order record is deleted. Visitor-level Rumble click records, when they exist, are retained for up to 30 days.

We otherwise retain personal information for as long as needed to provide the Services, maintain order and accounting records, resolve disputes, enforce our agreements, and meet legal or operational requirements. Order, accounting, fraud-prevention, and legal records may be kept for different periods. Deletion remains subject to operational, accounting, fraud-prevention, and legal requirements.

We use reasonable administrative, technical, and organizational measures designed to protect personal information, including encrypted transport (HTTPS) and access controls for sensitive server credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use cookies and similar technologies for purposes such as:

• Maintaining authenticated sessions (via our auth provider)
• Persisting cart contents on your device
• Remembering your privacy choice in slate_privacy (strictly necessary, up to 12 months)
• First-party traffic measurement, when analytics is permitted. slate_vid is a first-party visitor identifier that may last up to 180 days. slate_sid is a first-party session identifier that is refreshed around a 30-minute inactivity boundary. Both are used for traffic measurement, attribution continuity, duplicate-event prevention, and session reporting. They contain opaque identifiers, not names, email addresses, payment data, or order contents.
• A page bootstrap identifier in the browser tab’s session storage, used only before slate_vid is established. It is not a cookie.
• Separately configured storefront traffic measurement via Vercel Web Analytics. That provider is distinct from Slate’s first-party cookies.
• Advertising measurement via Meta Pixel, OpenAI Ads Measurement Pixel, Google tag, Rumble Advertising Center on public storefront pages, when advertising is permitted. When Rumble tracking is enabled, slate_raclid may retain a Rumble click identifier for up to 30 days. Cart, authentication, Meta, OpenAI, Google Ads, and Rumble cookies or identifiers remain separate from slate_vid and slate_sid.

You can control cookies through your browser settings. Disabling certain cookies or clearing local storage may affect login, cart, traffic measurement, or advertising-measurement features. Browser cookie controls do not necessarily stop every server-side operational or security record.

Six measurement systems stay separate. Slate’s first-party traffic analytics is not the Meta Pixel. Vercel Web Analytics is a separately configured traffic provider and is not used to operate advertising pixels. Meta advertising measurement, OpenAI Ads measurement, Google Ads measurement, and Rumble Advertising Center measurement are advertising technologies, not the first-party traffic system.

We use Meta Pixel, OpenAI Ads Measurement Pixel, Google tag, Rumble Advertising Center on public storefront pages for advertising measurement, attribution, audience measurement, and campaign optimization, only when your privacy state permits advertising. Rumble measurement also requires that integration to be enabled. For each verified-paid order whose privacy state did not permit advertising, or had no recorded privacy state, Slate sends no advertising server event and records only the platform and a categorical reason. They do not run on admin, sales-rep, account, API, authentication, invitation, or sign-in/sign-up/password-reset pages. Preview, localhost, and other non-production hosts do not install the Meta Pixel, the OpenAI Ads pixel, the Google tag, or the Rumble advertising tag, and do not send Meta Conversions API, OpenAI Ads Conversions API, or Rumble server conversion events.

Slate’s first-party system stores valid Meta attribution identifiers that are already present in the browser, unhashed, with the visitor record for up to 180 days after the visitor’s last activity, so a visit can stay associated with its originating campaign. Raw fbclid is not sent in the Purchase payload. Only a previously validated _fbc may be sent, which may be the value built from a valid fbclid when the visit was recorded. Per-order attribution summaries and admin reports record only whether these identifiers were present.

Meta may set or read cookies or similar browser identifiers. Automatic Advanced Matching is enabled in Meta Events Manager. That feature may allow Meta to match information that is available in the browser under Meta’s own advertising systems. Slate’s browser commerce events send only a value, currency, and a generic product content type. Slate does not manually send email addresses, phone numbers, names, postal addresses, order contents, product names, product slugs, quantities, payment credentials, card data, health or research free-text, canonical product cost, or admin-only data in our Meta event payloads.

After an order is verified paid, we also send a server-side Meta Conversions API Purchase event so Meta can deduplicate it with the matching browser Purchase event. When an exact authorized attribution link exists, that server event may include hashed email, hashed phone when a valid number is already stored on the order, a hashed order identifier, a valid _fbp, a valid _fbc, the trusted client IP and user agent from the unexpired signal for that same visitor, the verified-paid value, currency, the stable event identifier, and a query-free source URL. Optional matching fields are omitted when they are missing, invalid, or expired. Without an authorized link, the event is limited to the hashed email, hashed phone when available, hashed order identifier, value, currency, event identifier, and source URL. We do not send raw email or phone, names, postal addresses, order contents, product names, product slugs, quantities, payment credentials, card data, health or research free-text, canonical product cost, or admin-only data through the Conversions API. A raw IP and user-agent signal is deleted after confirmed successful delivery when that cleanup succeeds. If cleanup fails, the signal remains subject to the seven-day maximum. This Purchase event does not mean purchase attribution or the dashboard conversion rate is complete.

Meta’s use of information is also governed by Meta’s terms and privacy policy. Browser or device settings, and any advertising controls Meta provides, may limit some of this activity. This description is not a certification of compliance with any particular privacy statute.

OpenAI Ads measurement also requires advertising permission. When that permission is present on a production public storefront page, Slate may load the OpenAI Ads Measurement Pixel so it can capture OpenAI attribution identifiers from a ChatGPT ad click. The pixel may set or read first-party cookies or similar browser identifiers, including __oppref, __obref, and slate_oppref. After a verified payment, the only browser conversion Slate emits is order_created. That event sends the paid order total, currency, and the order identifier, plus a stable event identifier used to pair a later server event if one is sent. It does not include product identifiers, names, quantities, or per-item prices. Server-side OpenAI Ads Conversions API events are currently not sent. The reviewed server payload, which is not sent today, can include a hashed email when available, a hashed phone only when the number can be normalized without putting locality in the event, stored OpenAI click identifiers when present, the paid total, currency, a query-free source URL, a timestamp, and the same event identifier. It omits street address, city, state, postal code, and country. We do not send raw email or phone, payment credentials, card data, health or research free-text, or canonical product cost. The pixel may process additional browser, device, request, or page information automatically. Slate does not claim to control or fully inventory that automatic collection.

OpenAI’s use of information is also governed by OpenAI’s terms and privacy policy. Browser or device settings, and any advertising controls OpenAI provides, may limit some of this activity.

Google Ads measurement also requires advertising permission. When that permission is present on a production public storefront page, Slate may load the Google tag so it can measure advertising attribution, including advertising click information such as a gclid when one is present on a landing-page URL. After an order is verified paid, the only conversion Slate emits is a Google Ads Purchase conversion. That event sends the paid order total as a USD amount, currency, and the order identifier as a transaction ID. Standard event information such as purchase value, currency, transaction or order identifier, and advertising click information may be processed for measurement. It does not include customer email, phone number, name, postal address, product names, product identifiers, quantities, payment credentials, card data, or health or research free-text. Enhanced conversions are not enabled. Slate does not send customer contact details to Google. The Google tag may process additional browser, device, request, page, or advertising click information automatically. Slate does not claim to control or fully inventory that automatic collection. Google’s use of information is also governed by Google’s terms and privacy policy. Browser or device settings, and any advertising controls Google provides, may limit some of this activity.

When Rumble tracking is enabled and your privacy state permits advertising, Slate may load the Rumble global advertising tag on public production storefront pages. Rumble automatically supplies the _raclid advertising click identifier on qualifying landing URLs. Slate may retain a valid identifier in slate_raclid and a visitor-level click record for up to 30 days for attribution. With a qualifying click identifier, Slate may send browser Add to Cart and Initiate Checkout conversions constructed by Slate. After an order is verified paid, Slate may send one server-side Purchase conversion. The Slate-constructed server payload can include the Rumble click identifier, the conversion-action identifier, the USD order value, and optional technical request metadata (IP address and user-agent) when those values are reliably available from trusted production request helpers. It does not include payment credentials or card data, research or health free text, admin-only information, full order contents or product names, or postal addresses. The global tag may process additional browser, device, request, or page information automatically. Slate does not claim to control or fully inventory that automatic collection. Rumble Advertising Center may serve campaigns across Rumble, Truth Social, and other participating inventory. Rumble processes data under its own terms and privacy practices.

In the conversion payloads Slate constructs for Meta, OpenAI, Google Ads, and Rumble, Slate does not intentionally include payment credentials or card data, research or health free text, admin-only information, full order contents or product names, or postal addresses. This description is limited to those manually constructed payloads.

Depending on where you live, you may have rights to request access to, correction of, or deletion of certain personal information, or to ask questions about how we process your data. To make a request, contact support@slatepeptides.com or use our contact form and choose “Privacy request.” Requests are handled by our team, not automatically. We may need to verify your identity before responding, typically by confirming control of the email address on the account or order. Some records (such as completed orders) may need to be retained for legal or accounting reasons.

To opt out of advertising sharing or withdraw analytics, use Your Privacy Choices in the footer; you do not need to submit a request.

Residents of certain U.S. states may have additional privacy rights under applicable state law. If those laws apply to you, you may contact us to exercise available rights. This Privacy Policy is intended to provide transparency about our practices; it is not a certification of compliance with any specific statute.

The Services are intended for adults 21 years of age or older. We do not knowingly collect personal information from anyone under 21. If you believe we have collected information from someone under 21, contact us so we can take appropriate steps.

The Services are operated from the United States. If you access the Services from outside the United States, you understand that your information may be processed in the United States, where privacy laws may differ from those in your country.

We may update this Privacy Policy periodically. When we do, we will revise the “Last updated” date. Material changes may also be highlighted on the website or communicated by email when appropriate.

Privacy questions: support@slatepeptides.com or Contact.