Privacy and cookies

We use cookies and similar technologies, including local browser storage, to remember your preferences. Browsing statistics are optional: they are only activated when you press "Accept all". The store works even if you reject them.

What do we measure if you accept

Pages visited, sessions, contact clicks, device type, approximate country and origin of the visit. We use random browser and session identifiers. We do not store IP addresses, names, emails or the text of your queries or messages in the statistics.

Storage and duration

The cookie preference and browser identifier expire after 90 days. A session expires after 30 minutes of inactivity. Events are retained for up to 90 days in store hosting. We do not use these identifiers for advertising or cross-site tracking.

Basket, requests and contact information

The basket stores references, formats, quantities and the discount code that you add in this browser for 30 days as storage necessary to prepare your order, even if you reject the statistics. Personal data from the form is not saved in the basket or in the statistics. When completing the order, we record the name, email, telephone number, address and comments that you provide to manage it and contact you. Do not include patient data or medical information.

The name, email, telephone number and address of the orders are stored encrypted on the server. The name, email and telephone number are also gathered in a private wallet for customer management, protected with the same encryption. The internal client portfolio can only be opened with the owner account. A buyer with confirmed email can only access their own orders and addresses from their account. An authorized team member can view the financial and inventory record, including receipts, and record manual orders and their own consumption. They are not automatically sent to product suppliers or added to advertising campaigns. Internal notices of paid orders are sent to the owner's email through Resend. They include the reference, products, quantities, amount and link to the panel; They do not include the name, email, telephone number or address of the buyer. The payment confirmation to the buyer is also sent through Resend: to deliver it, your email and the number, products, quantities and amounts of the order are transmitted. Address, telephone number, name or comments are not included, nor is the buyer added to advertising. Shipping notices are sent by the same service to the order email and include your number, the carrier and the tracking number, without address, telephone number or observations. When you choose bank transfer, we also send a proforma PDF invoice through Resend to the email address indicated in your order: it contains your name, email, telephone number, shipping address, products, quantities, discounts, shipping, total and data for the transfer. This proforma is saved encrypted, does not prove payment or replace a tax invoice and is not used for advertising. They are kept as long as they are necessary to manage the request and the applicable obligations. You can request its rectification or elimination through customer service. To protect the form, an identifier derived from the connection is used that expires every hour; the original IP address is not saved in the requests. When completing the order you choose one of the available methods. With the Revolut link you enter the amount and order reference on its page, without automatically sending your personal data; We check the credit before confirming the payment. If you choose bank transfer, we show you the amount, the order reference and the recipient account information to make it from your bank. We keep the reference of the movement that the owner uses to verify the entry encrypted. When Stripe is available, you receive the reference, the email and the concepts and amounts necessary for collection. Bank and card details are entered on the provider's page and are not stored in this store. We save the identifiers and statuses of the payment and its refunds for the management of the order.

Optional buyer account

You can buy without registering. If you create an account, we keep your email encrypted and password-protected; We do not save the password in readable text. Email must be confirmed before accessing previous orders or addresses. We associate orders through the registered email with each purchase, even if you purchased as a guest; It is not enough to enter an email address to access your orders. You can save up to five encrypted addresses, modify them, and delete them from your account. Deleting a saved address does not change previous order addresses or documents.

The session uses a necessary, protected cookie with a maximum duration of seven days. You can log out; recovering the password invalidates previous sessions. We send account confirmation and recovery emails through Resend, solely at your request, without advertising. The links are single use: email confirmation for 24 hours and recovery for 30 minutes. We use connection-derived identifiers to limit attempts; We do not save the original IP. Account data is kept to provide this service and you can request rectification or deletion to info@hexpeps.shop. Retention obligations for orders, payments and documents are maintained where applicable.

Campaigns and affiliates

With your consent, we store the encrypted cookie hexpeps_attribution_v1 for a maximum of 30 days from the click. Contains campaign and contributor identifiers, and the date of the click. It is used to attribute purchases and calculate commissions; It does not store medical data, name or email. The last valid affiliate link is used, without renewing the term for direct visits. The most recent campaign is recorded separately. When creating the order, we copy this attribution for commission management and reconciliation. Only the account owner can consult it; Reports for collaborators do not include personal data of buyers. The attribution of the order is kept with the commercial records for the time necessary for its management and the applicable obligations. Rejecting the measurement does not affect the purchase. If you withdraw your consent, we stop recording new attributions and delete the cookie; Records of orders already placed are not automatically deleted. The preference for this version is saved in hexpeps_privacy_v2. No pixels or cross-site tracking is used.

Reviews and order photos

If you submit a review with a photo, we save your public signature, rating, text, photo, and publication authorization. With a confirmed buyer session you can choose the public first name and add the last initial. Guest reviews appear as Anonymous followed by four figures. We use the session to check which signature corresponds and save the signature in the review, without the email or account ID. The optional order reference is reserved for the team. Avoid including addresses, faces of third parties or medical information in the photo. We shrink the image and remove its metadata before saving it encrypted. The review is automatically published with your signature, date, and an indication of the incentive. The team can hide spam reviews, personal data or other people's material. A confirmed account does not credit a purchase. When you submit you receive a 10% share code, whatever the rating. To request rectification or withdrawal, write to info@hexpeps.shop. We retain the review as long as it is necessary to manage it or keep it published. Abuse checks use an HMAC-derived identifier of the connection, valid for two days and cleaned up upon receipt of new submissions. We do not save the original IP nor use the review to subscribe you to commercial communications.

Change your choice

You can modify your preference from "Set cookies" at the bottom of the store. Rejecting deletes this browser's statistics identifiers and attribution cookie and stops sending events. You can return to the store and press "Set cookies" to do so.

For privacy inquiries, please use the Hexpeps customer service channel.