Privacy Policy

Data controller

The controller responsible for processing the personal data collected on this site is the publisher of RAL PEPTIDES — see full details in the Legal Notice.

Data collected

User account: email and password (hashed), managed via Supabase (authentication and database).

Order: name, surname, postal address, phone number and email are collected when an order is placed. This data is stored in our Supabase database for order management and tracking, and sent to Chronopost for delivery.

Referral program: if a referral code is entered, it is linked to the referred customer's account to calculate the cashback owed to the referrer.

Cart: the cart contents are stored locally in the browser (localStorage), with no transmission to any third party until the order is placed.

Purposes and legal bases

Managing user accounts and authentication: performance of a contract / legitimate interest.

Processing and tracking orders, contact for payment: performance of a contract.

Managing the referral program and calculating cashback: performance of a contract / legitimate interest.

Order-related communication (transactional emails): performance of a contract.

Recipients and processors

Data may be shared with the following service providers, strictly limited to their respective duties:

— Supabase: database hosting and account authentication.

— Netlify: site and server function hosting.

— Chronopost: shipping and delivery of parcels.

— Telegram: optional contact and support channel used voluntarily by the Customer (questions, order follow-up). No payment proof is required there.

— Resend: sending of transactional emails (account confirmation, notifications).

No data is sold or transferred to third parties for commercial purposes.

Retention period

Account data: kept for as long as the account remains active; it is deleted upon account deletion request or after an extended period of inactivity.

Order data: kept for the duration of the business relationship, then archived for 3 years from the last order for tracking and evidentiary purposes.

Billing data: kept for 10 years in accordance with legal accounting and tax obligations.

Your rights

In accordance with the General Data Protection Regulation (GDPR) and the French "Informatique et Libertés" law, you have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability and the right to set directives regarding the fate of your data after your death.

To exercise these rights, contact us at contact@ral-supply.com.

Cookies and trackers

This site does not use audience-measurement cookies or third-party advertising trackers (no Google Analytics, no Facebook pixel or equivalent).

Internal (first-party) audience measurement: we count page views and visits anonymously and in aggregate for statistical purposes, without cookies or persistent identifiers. Only the visited page path, the optional referring site (domain name only) and an ephemeral session identifier cleared when the tab is closed are recorded, kept for a maximum of 90 days. No IP address, no personal data and no cross-site tracking are collected. Technical site performance (Web Vitals) is measured under the same principles.

The shopping cart is stored using the browser's local storage (localStorage), a technique necessary for the site to function, and not a tracking cookie. Your account login session may also be stored locally (localStorage) depending on the authentication method.

Security

Technical and organizational measures are implemented to protect your data (secure authentication, HTTPS encryption, security headers, rate limiting on sensitive API endpoints).