Privacy policy

Who we are

VendorVerify ("we", "us") runs vendorverify.net, an independent site that compares research-peptide vendors using third-party lab reports and verified buyer reviews. For anything about this policy or your data, use the contact form and choose "Privacy request".

What we collect

If you just browse

You can read every score, lab result and published review without an account. We don't ask for anything to do that. Our hosting provider processes standard request data (such as your IP address) to deliver pages. For analytics, see Analytics.

Your account

• Email and display name. Needed to sign in and to show who wrote a review.
• Google sign-in. If you continue with Google, we receive your name, email address and, if Google provides one, a link to your profile picture. We never see your Google password.
• Password accounts. We store only a one-way hash of your password (bcrypt), never the password itself.
• Profile photo. Optional; you can add or change it in Settings.
• Sign-in sessions. For each signed-in device we keep when the session started, when it was last used and when it expires. You can see and end sessions in Settings.
• Password resets. If you ask to reset your password we store a hashed, single-use reset token that expires.

Review verification

• Phone number. To send you a verification code, your number is passed to our SMS provider (Twilio). We do not store the number. We keep only a one-way hash of it, so one number can't verify several accounts, and its last 4 digits so we can show you which number you used.
• Receipts. When you upload proof of purchase, the file is stored privately. Only our admins can open it, to approve or reject it. If you give an order number, we store that too. Uploading a new receipt for the same vendor replaces the earlier file.
• Reviews. Your rating, comment, the vendor, the date and the review's verification status.

Lab test submissions

• Lab report files. When you submit a lab test, the report (COA) you upload is stored privately. Only our admins can open it, through a link that expires after 15 minutes, to check it against the numbers you entered.
• Lab values. The vendor, peptide, label dose, results, lab, test date, test key, links, batch and notes you enter, plus the submission's review status.
• Rate limit. We count your submissions per day to limit abuse.

Security and anti-abuse records

To keep accounts safe and stop fake reviews we record:

• An activity log of account actions (for example, deleting your account), with the IP address and browser user agent of the request. You can see your activity in Settings.
• For review submissions: the IP address, browser user agent, a short identifier derived from the user agent, and an automated risk score used to decide whether a review needs a manual check.
• Sign-in attempts: the email address tried, the IP address, the time and whether it succeeded, used to block password guessing.
• Rate-limit counters for sign-ups, password reset requests and the contact form. These store only a one-way hash of the IP address or email, not the value itself.

Contact form

Your name, email address, topic and message, plus a one-way hash of your IP address to limit abuse. Messages are emailed to our admins so we can reply.

Emails we send

Account, review and lab test emails (for example, password resets and review or lab test status updates). You can turn most notification emails on or off in Settings.

Cookies and local storage

Analytics

We use two analytics tools to understand which pages are used: Google Analytics, and the visitor analytics built into our hosting platform (Floot). If you visit from the EU, the EEA or the UK, neither runs until you choose "Accept analytics" in the banner. Elsewhere, analytics is on by default and you can turn it off below at any time. We work out your region from the country our hosting network reports for your connection (or, if it doesn't, from your device's time zone) and don't store it.

When enabled, our host's analytics records the page path, the referring page, your browser and language, and a country inferred from your time zone. It does not record your IP address or the query string of the URL. Google Analytics processes data under Google's own policies.

Service providers

We use these companies to run the site. They process data on our behalf for these purposes:

• Floot: hosting, database, private file storage, the Google sign-in connection and built-in visitor analytics.
• Google: sign-in (if you choose it) and Google Analytics (only if you accept).
• Twilio: sends and checks phone verification codes.
• Emailit: delivers our emails.

We don't sell your personal information, and we don't show ads.

What is public

When a review is published, its rating, comment and date appear on the vendor's page with your display name and profile photo. Your email address, phone details and receipts are never shown publicly. Reviews that are pending or rejected are not shown.

When a lab test you submitted is approved, its lab values appear in the vendor's results without your name. Your lab report file and notes are never shown publicly. Pending and rejected submissions are not shown.

How long we keep data

• Account data, reviews, verification records and activity logs: until you delete your account.
• Lab report files you uploaded: until you delete your account, when they are deleted. The submission records themselves (the lab values and their review status) are kept so published results stay traceable, but they are no longer linked to you.
• Sessions: until they expire or you sign out or end them in Settings. Expired sessions are cleaned up periodically.
• Rate-limit counters: about 24 hours. Old sign-in attempt records are also deleted periodically.
• Contact messages: kept so we can follow up on your request.

Your choices

• Download your data. In Settings → Your data, "Download my data" gives you a JSON file with your profile, reviews, preferences, verification records, lab test submissions, linked sign-in accounts and activity log.
• Delete your account. In Settings → Your data. This removes your account, reviews, sessions, verification records, uploaded receipt and lab report files, notification preferences and activity logs. Lab test submissions are kept without your account attached (see above). It can't be undone.
• Emails. Turn notification emails on or off in Settings.
• Anything else, such as correcting something we hold about you: use the contact form and choose "Privacy request".

Changes and contact

If we change this policy we'll update this page and the effective date above. Questions? Contact us.