Privacy policy

This policy explains what personal data Peptinote holds, why, for how long, who helps us process it, and the rights you have. It’s written to meet the EU General Data Protection Regulation (GDPR) and the French Data Protection Act, and it applies to everyone, wherever you live.

Who we are

Peptinote is published by a French company, which is the “controller” of your personal data: the one that decides why and how it’s used.

Controller

VENDOME ONE (trade name Maison Vendome)

Address

8 rue de Longpont, 92200 Neuilly-sur-Seine, France

Registration

994 779 106 R.C.S. Nanterre

Legal representative

Ali Memarzadeh, Président

Privacy contact

privacy@peptinote.com

We haven’t appointed a data protection officer. Every privacy question or request goes to privacy@peptinote.com, and a real person answers it.

What stays on your device

The most sensitive things you could tell Peptinote never reach us.

• The tracker. Your vials, doses, injection sites, weight, side effects and notes are stored only in your browser’s storage, on your device. They aren’t sent to our servers, there’s no sync, and we have no copy. Backups are export files you download and keep yourself. Reminders are calendar files your browser creates for your own calendar, and the report for your prescriber is generated in your browser.
• Calculators. Calculations run in your browser. The vial sizes, water volumes and doses you type aren’t sent to us. Calculators remember your last inputs and a few recent results on your device, so they’re still there when you come back.
• The injection-site rotation tool. The sites you mark are stored on your device only.

Because we never receive this information, we can’t read it, share it, lose it in a breach or hand it to anyone. It also means we can’t recover it: see your tracker data. The cookie policy lists exactly what your browser stores and how to clear it.

What we collect

We only hold what we need to run accounts, Pro and the newsletter. None of it includes dose or health details.

Your account

If you create an account: your email address, when the account was created, when you confirmed you’re 18 or older, and when you accepted our terms (with the version you accepted).

Signing in

When you ask for a sign-in link, we store a scrambled (hashed) copy of the one-time code, your email address and when the link expires. When you sign in, we store a hashed copy of your session identifier, which account it belongs to, and when it was created and expires. The session cookie in your browser holds the identifier itself.

Peptinote Pro

If you subscribe, Stripe handles the payment. Stripe collects your card or other payment details, your billing country and anything else its checkout asks for, under its own privacy policy. We never see your full card number. Stripe sends us what we need to give you Pro: your Stripe customer and subscription identifiers, the subscription status, monthly or yearly, when the current period ends, and whether you’ve canceled. Your invoices are kept by Stripe.

The newsletter and free downloads

If you sign up, we store your email address, which form you used (for example “calculator” or “cheat sheet”), when you gave your consent, a hashed copy of your IP address at that moment (to show the consent was real), when you confirmed, and when you unsubscribed. We only add you after you click the link in our confirmation email (double opt-in).

Abuse protection

To stop people flooding the sign-in and sign-up forms, we count requests for a short time under a hashed key derived from your IP address or email address.

Server logs

Our hosting provider, Replit, automatically processes basic technical information with every request to keep the site running and secure: your IP address, the page requested, the date and time, and your browser and device type. We use it only to deliver the site, protect it and fix problems. We don’t use it to build profiles.

Emails you send us

If you email us, we receive your address, your name if you include it, and your message. We use them to reply and to act on what you wrote. Please don’t send health details we don’t need.

Why we use it and our legal bases

The GDPR requires a legal basis for each use of personal data. These are ours:

We don’t make decisions about you based solely on automated processing, we don’t profile you, and we don’t use your information for advertising.

Who we share it with

We don’t sell your personal information. We don’t share it with advertisers, data brokers or social networks, and no advertising or analytics code runs on Peptinote. Three service providers (“processors”) handle data for us, only on our instructions:

• Replit, Inc. (United States) hosts the site and its database: accounts, subscriptions and the newsletter list.
• Stripe (United States and EU) handles payments, invoices and the customer portal for Pro.
• Resend (Plus Five Five, Inc., United States) sends sign-in links, confirmations and the newsletter.

Stripe also uses some payment data for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy.

Beyond these, we disclose personal information only when the law requires it (for example a valid court order), to protect our rights or someone’s safety, or to a company that takes over Peptinote, which would have to honor this policy. We’d tell you first wherever the law allows.

International transfers

Replit, Stripe and Resend process data in the United States. When personal data from the EU goes there, it’s protected as the GDPR requires:

• Stripe and Resend say they comply with the EU–US Data Privacy Framework, which the European Commission found provides adequate protection on July 10, 2023. Both also offer the European Commission’s standard contractual clauses.
• Replit relies on the European Commission’s standard contractual clauses (Decision 2021/914) in its data processing agreement.

You can check a company’s current certification on the Data Privacy Framework list. Email privacy@peptinote.com for a copy of the safeguards that apply.

How long we keep it

When you delete your account, we cancel Pro at Stripe, delete your account details and sign you out everywhere. Stripe keeps the invoices it must keep by law.

Your rights

Wherever you live, you can ask us to:

• access the personal data we hold about you and get a copy;
• correct it if it’s wrong;
• delete it (you can also delete your account yourself from your account page);
• restrict how we use it while a question is being resolved;
• receive it in a portable format, or have it sent to another company;
• object to any use based on our legitimate interests;
• withdraw your consent at any time, for example by unsubscribing from the newsletter, without affecting what we did before.

If you live in France, you can also leave instructions for what happens to your data after your death.

If you think we’ve mishandled your data, please tell us first. You also have the right to complain to a data protection authority, in particular where you live or work. In France, that’s the CNIL (Commission nationale de l’informatique et des libertés).

Your rights in the US

Several US states give residents privacy rights, such as California (CCPA, as amended by the CPRA), Colorado, Connecticut, Virginia and others. We give everyone the same rights, whether or not a state law applies to us:

• Know and access: what personal information we hold about you, where it came from, why we use it and who receives it (this policy lists all of it).
• Correct and delete it.
• Get a copy in a portable format.
• No selling or sharing. We don’t sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or profile you. There’s nothing to opt out of, so we don’t need a “Do Not Sell or Share” link. Browser signals such as Global Privacy Control are respected by default, because we don’t track you.
• Sensitive information. We only use it to provide the service you asked for. Read how we handle health data in our consumer health data privacy policy.
• No discrimination. We won’t charge you more or give you a worse service for using your rights.
• Appeal. If we refuse a request, you can appeal (see below).

How to make a request

Email privacy@peptinote.com from the address you use with Peptinote, and say what you’d like. You can also write to VENDOME ONE, 8 rue de Longpont, 92200 Neuilly-sur-Seine, France.

• Verification: we may ask you to confirm the request from your account’s email address. We only ask for what we need to be sure it’s you.
• Authorized agents: someone can make a request for you with your signed permission. We may still ask you to confirm it.
• Timing: we answer within one month. If a request is complex, we may extend that by up to two more months and tell you why within the first month. We always answer within any shorter time your local law sets.
• Cost: free. If requests are clearly unfounded or excessive, we may decline or charge a reasonable fee, and explain why.
• Appeals: if we decline all or part of a request, reply to our answer with “Appeal” in the subject. We review the decision again and answer in writing within 45 days, with the reasons. If you’re still not satisfied, you can contact your data protection authority or your state attorney general.

Emails we send

• Sign-in links and account emails (including Pro receipts and renewal reminders) are part of the service. You get them only when you use your account or subscription.
• The newsletter is sent only after you confirm your sign-up. Every newsletter has a one-click unsubscribe link, and you can also email privacy@peptinote.com. We never sell or rent our list.

Cookies and local storage

Peptinote uses one strictly necessary cookie, set only after you sign in, and stores the tracker, calculator and rotation data in your browser. There are no advertising or analytics cookies, so there’s no cookie banner. The cookie policy lists everything.

Children

Peptinote is for adults. You must be 18 or older to create an account or subscribe to Pro. The site and the newsletter are written for adults and aren’t directed to children. If you believe a child has given us personal information, email privacy@peptinote.com and we’ll delete it.

Security

Holding as little as possible is our main protection: we can’t lose what we don’t have. On top of that:

• the site is served only over encrypted HTTPS connections;
• sign-in links and sessions are stored only as one-way hashes, and the session cookie can’t be read by scripts on the page;
• access to the database is limited to the people who need it to run Peptinote;
• payments are handled entirely by Stripe.

If a breach of personal data creates a risk for you, we’ll notify the CNIL and, where required, tell you, as the law requires. No system is perfectly secure, so please don’t email us health details we don’t need.

Changes to this policy

We update this policy before we change how we handle personal data, and the date at the top shows when it last changed. If a change materially affects data we already hold about you, we’ll tell you by email before it applies, and ask for your consent where the law requires it.

Contact us

Privacy questions and requests: privacy@peptinote.com. Anything else: hello@peptinote.com. By mail: VENDOME ONE, 8 rue de Longpont, 92200 Neuilly-sur-Seine, France.