Privacy policy

Here's what BatchPure collects from you, what we use it for, what we never do with it, and how you can get your data back or gone. No marketing speak. No "we value your privacy."

This policy covers batchpure.com and any email we send you. It applies to everyone who interacts with us, and includes the specific rights you have as a California resident under the CCPA and CPRA.

What we collect

We collect only what we need to run the operation. Itemized:

1. Email address. When you ask for a launch alert or place an order.
2. Name. Collected at checkout (for the shipping label).
3. Marketing consent record. When you sign up for email, we store the timestamp, your IP address, your user-agent string, and the URL you signed up from. This is the proof that you opted in. It's required under US anti-spam law and it's what lets us honor an unsubscribe cleanly later.
4. Shipping address. Collected only at order time. Required to ship a package.
5. Payment data. We accept Bitcoin only. Payment runs through our self-hosted BTCPay Server. We do not collect or store credit card numbers, bank account numbers, or any traditional payment instrument. The record of your payment is a BTCPay invoice ID and the on-chain transaction. That's it.
6. Order history. Which peptide and dose, how many vials, ship date, and the carrier tracking number.
7. Email delivery metadata. Bounces and spam complaints from Amazon SES (our sending infrastructure) flow back to us so we can stop emailing addresses that don't want our mail or can't receive it. We do not track opens or clicks. There are no tracking pixels in our emails and no click-wrapping on our links. Our SES configuration set receives bounce and complaint feedback only.
8. Support correspondence. If you email support@batchpure.com, the message and our reply live in the support mailbox.

That's the full list. No date of birth, health data, government ID, or device fingerprints.

How we use it

Each piece of data has a specific job.

• Email and name run the email program: launch alerts, order confirmations, shipping notifications, and replies to support requests.
• Consent record proves the subscription was valid if a regulator, a mailbox provider, or you ever ask.
• Shipping address is handed to a carrier so the package arrives.
• Payment data (invoice ID, blockchain transaction) matches a paid invoice to an order, and exists in our tax and accounting records.
• Order history powers reorder lookup, customer support, and the records we're required to keep for tax and regulatory purposes.
• Bounce and complaint data updates your status in our subscriber list so we stop sending to addresses that shouldn't be receiving mail.
• Support correspondence exists to answer your question and to keep a record if the issue comes back.

We don't build behavioral profiles. We don't enrich your data with third-party sources. We don't feed it to ad networks.

Who we share it with

Named, not vague:

• Amazon Web Services (SES + SNS). Sends our email. Receives bounce and complaint feedback.
• Shippo. Creates shipping labels and tracks packages. Your name and shipping address go to Shippo and to the carrier Shippo selects.
• USPS, UPS, or the carrier printed on your label. Whoever is physically moving the box.
• Microsoft (Outlook / Microsoft 365, via GoDaddy). Hosts support@batchpure.com. Any email you send to support lives there.
• Airtable. Hosts our subscriber list, orders table, and support ticket records.
• Hetzner. Hosts our self-run n8n automation server, which is where the email flows execute.
• LunaNode. Hosts our self-run BTCPay server, which is where Bitcoin invoices live.
• Government authorities, if we're legally compelled by a subpoena, warrant, or equivalent. We push back on overbroad requests.

Stated plainly:

• We do not sell personal information. Not to advertisers, not to data brokers, not to anyone.
• We do not share personal information for cross-context behavioral advertising. No retargeting pixels.
• There is no third-party payment processor. BTCPay is ours. Bitcoin settles on the public blockchain, which is pseudonymous and outside our control, but we don't share your identity with it.

Retention

• Subscriber records are kept while you're subscribed. If you unsubscribe, your email stays in a suppression list so we don't accidentally email you again. The suppression record is the minimum needed (email + status + timestamp) and is kept indefinitely for that purpose.
• Order records are kept for approximately seven years to satisfy US tax and business recordkeeping obligations.
• Support emails are kept per Microsoft 365 mailbox defaults (retained until manually deleted). We periodically clean out old threads.
• Consent records (IP, user-agent, timestamp, source URL) are kept for the life of the subscription and a reasonable period after, in case we need to prove the opt-in was legitimate.

If a law requires us to keep something longer, we keep it longer. If it requires us to delete something sooner, we delete it sooner.

Security

What's actually in place:

• TLS everywhere. The website, the BTCPay server, the n8n automation server, webhook endpoints, and email transport (SES SMTP on port 587 with STARTTLS) all run over TLS.
• Encryption at rest for credentials. Our automation server encrypts stored credentials with a key that doesn't live in the same place as the encrypted data.
• HMAC-signed unsubscribe links. One-click unsubscribe URLs are signed so they can't be forged or reused for other addresses. This is RFC 8058 compliant.
• Access controls. Admin surfaces on the website are gated. Airtable and the underlying servers are accessible only to the operator.
• DKIM, SPF, and DMARC are configured on our sending domains so mail claiming to be from us can be authenticated by receivers.

No system is impossible to break. If we learn of a breach that affects your data, we'll tell you, and we'll tell you what we know, not a PR version of it.

Your rights

You have the right to:

1. Know what personal information we hold about you and how we use it.
2. Access a copy of that information.
3. Correct information that's wrong.
4. Delete your information, subject to the retention obligations above (we can't delete a tax record we're required to keep, but we can delete everything else).
5. Port your information to another service in a machine-readable format.
6. Opt out of marketing email at any time. Every marketing email has a one-click unsubscribe link. Transactional email (order confirmation, shipping) is tied to a purchase and isn't part of the marketing list.

California residents (CCPA / CPRA)

If you're a California resident, the above rights are yours under state law, plus:

• Right to know what categories of personal information we've collected, the sources, the purposes, and who we've shared it with. This policy is the answer. If you want a specific, personalized report, email us.
• Right to delete personal information we've collected, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We don't sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of. We're stating that plainly instead of hiding behind a "Do Not Sell" link that doesn't do anything.
• Right to limit the use of sensitive personal information. We don't collect sensitive personal information as the CCPA defines it (no government IDs, financial account numbers, precise geolocation, health data, biometrics, etc.), so there is nothing to limit.
• Right to non-discrimination. Exercising any of these rights doesn't change the price you pay or the service you receive.

You can exercise any of these rights yourself (no agent required) or through an authorized agent. We'll verify the request by matching the email you use to contact us against the record we hold.

How to exercise your rights

Email privacy@batchpure.com with what you want: access, correction, deletion, or export. Use the email address you ordered with so we can verify you.

We'll acknowledge within 10 calendar days and respond substantively within 45 calendar days, which is what California law requires. If we need longer, we'll tell you why.

If we deny a request, we'll tell you why and how to appeal.

Children

BatchPure sells research-use-only materials. The site is not directed at anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, email privacy@batchpure.com and we'll delete it.

International transfers

BatchPure operates from the United States. Some of the infrastructure we use is outside the US:

• Our automation server runs on Hetzner, which operates data centers in Germany and Finland.
• Our BTCPay server runs on LunaNode in Toronto, Canada.
• Our email and cloud infrastructure (AWS, Microsoft 365) uses US regions by default but is run by global providers.

If you're outside the US, your data will be transferred to and processed in the US and potentially in the countries listed above. By using the site or subscribing, you consent to that transfer.

Cookies and tracking technologies

The current website does not run any third-party analytics, advertising, or tracking pixels. No Google Analytics, no Meta Pixel, no TikTok pixel, no session-replay tool. The site uses a small number of first-party cookies and local-storage entries to remember UI state (for example, whether you've dismissed the age-gate). Nothing is shared with a third party.

If we add analytics later, we will list the specific tool here and update the effective date before turning it on. We have a preference for privacy-respecting, aggregate-only tools (Plausible, Fathom, or equivalent). We will not add behavioral ad tracking.

Global Privacy Control signals sent by your browser are honored as a valid opt-out request under California law. Browser-level controls (Safari's Tracking Prevention, Firefox's Enhanced Tracking Protection, uBlock Origin, etc.) will work against anything running on the site.

Changes to this policy

If we change this policy, the "Last updated" date at the top changes. If the change is material (new categories of data, new third parties, new uses), we'll email active subscribers and post a notice on the site before it takes effect.

We won't retroactively apply a looser version of this policy to data we've already collected under a stricter one.

Contact

privacy@batchpure.com for anything in this policy: access, correction, deletion, export, complaint, or a question about a specific practice.

support@batchpure.com for everything else: orders, shipping, product questions.

BatchPure / batchpure.com