Security, Privacy & Compliance

Customer accounts are protected by email-and-password authentication backed by our managed backend provider. Sessions use signed tokens stored in the browser and are rotated on sign-in. Administrative views are gated by a server-validated role assignment — role membership is never read from client-side storage.

Checkout requires an authenticated session and a completed researcher qualification record before a payment session can be created.

Traffic to the site and to backend APIs is encrypted in transit using industry-standard TLS. Row-level access rules restrict customer data (orders, subscriptions, qualifications, affiliate records) so that signed-in users can only read rows tied to their own account. Order and subscription rows are written only by trusted server-side webhook handlers, never directly by the browser.

Sensitive payment details are handled entirely by our payment processor (Stripe) and are never stored on our servers.

We collect the information needed to process orders and operate your account: name, email address, shipping address, institutional affiliation (for researcher qualification), and order history. We do not sell or rent personal data. See the full Privacy Policy for details on collection, use, and retention.

Operating the site relies on a small set of trusted subprocessors:

• Lovable Cloud (Supabase) — application database, authentication, edge functions, storage.
• Stripe — payment processing and subscription billing.
• Resend — transactional and alert email delivery.
• Lovable AI Gateway — AI assistant and content generation features.

Each subprocessor is used only for the function listed above. Credentials are stored as server-side secrets and are not exposed to the browser.

Platform-level capabilities (managed hosting, database, authentication, secret storage) are provided by Lovable Cloud. Configuration of access rules, data handling practices, content, and compliance disclosures on this site are the responsibility of Kayethel Peptides. Customers are responsible for maintaining the confidentiality of their account credentials and for using our products in accordance with the Research Use Only terms.

All products sold are intended strictly for in-vitro laboratory research. Orders require an 18+ acknowledgement and a researcher qualification record (institution, role, and institutional email) before checkout. Users cannot self-assign a "verified" status — verification flags are administered server-side.

If you believe you've found a security issue, please report it to security@kayethelpeptides.com. Please include reproduction steps and avoid testing that could affect other users or their data. We will acknowledge reports and work in good faith to investigate and remediate confirmed issues.

To request access to, correction of, or deletion of personal data we hold about you, contact privacy@kayethelpeptides.com. For general inquiries, see our FAQ.