Privacy Policy

1. About This Policy

This Privacy Policy describes how Compound Cart Inc. ("PeptiCommerce", "we", "us", or "our") collects, uses, discloses, and protects information when you visit our websites, create an account, or use any of our products, software, or services (collectively, the "Service"). It also explains the choices and rights you have regarding that information.

This Policy does not apply to information that our customers (merchants) collect from their own end-customers through their storefronts. In that context, the merchant is the data controller and PeptiCommerce acts as a data processor under the merchant's instructions.

2. Information We Collect

2.1 Information you provide

• Account information: name, email address, password (stored hashed), phone number, business name, business address, EIN or other tax identifier, and country of operation.
• Billing information: billing name and address, last four digits of your payment card, card brand and expiration, and other information required by our payment processors. Full card numbers are collected and stored by our payment processors, not by PeptiCommerce.
• Onboarding information: information you submit during onboarding about your business, including suppliers, branding assets, product catalog, payment-method preferences, and shipping configuration.
• Support and communications: messages, attachments, and other content you send us through email, in-app chat, or support tickets.
• Marketing information: information you submit through inquiry forms, newsletter signups, downloads, and event registrations.

2.2 Information collected automatically

• Usage data: pages viewed, features used, clicks, search queries, referring URLs, and timestamps.
• Device and connection data: IP address, browser type and version, operating system, device identifiers, and approximate geolocation derived from IP.
• Cookies and similar technologies: we use first-party and limited third-party cookies, local storage, and pixel tags to keep you signed in, remember preferences, secure your session, measure usage, and operate the Service. See Section 7.
• Log and security data: server logs, error reports, audit trails, authentication events, and similar records used to operate, secure, and debug the Service.

2.3 Information from third parties

We may receive information about you from third parties such as our payment processors, hosting providers (e.g., DigitalOcean), email-delivery providers (e.g., Mailgun), domain registrars, fraud-prevention vendors, analytics providers, and lead-enrichment services. We use this information together with information you provide to operate, secure, and improve the Service.

3. How We Use Information

We use the information described above to:

• Provide, operate, maintain, and improve the Service;
• Create and manage your account and authenticate you;
• Process payments, billing, refunds, and tax reporting;
• Provision, monitor, and manage the cloud infrastructure (e.g., droplets, storefronts, databases) used by your account;
• Communicate with you about your account, security, billing, product updates, and policy changes;
• Provide customer support and respond to inquiries;
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service;
• Comply with legal obligations and respond to lawful requests from public authorities;
• Send marketing and informational messages where permitted by law (you may opt out at any time); and
• Develop new features and improve existing ones, including by analyzing aggregated and de-identified usage data.

4. Legal Bases for Processing (EEA / UK)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR / UK GDPR:

• Performance of a contract (Art. 6(1)(b)) — to provide the Service you requested and process payments;
• Legitimate interests (Art. 6(1)(f)) — to operate, secure, and improve the Service, prevent fraud, and conduct ordinary business communications;
• Compliance with legal obligations (Art. 6(1)(c)) — to satisfy tax, accounting, and law-enforcement obligations; and
• Consent (Art. 6(1)(a)) — for non-essential cookies and certain marketing communications, where required.

5. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

• Service providers and subprocessors: with vendors who perform services on our behalf, such as hosting (DigitalOcean), email delivery (Mailgun), payment processing (Stripe, WithoutKYC.to, NOWPayments, and similar), shipping APIs, analytics, error monitoring, and customer support tooling. These vendors may access information only to perform services for us and are contractually required to protect it.
• Within the merchant's storefront: we share account and configuration data with the merchant's own provisioned storefront, droplet, and integrations as required to operate the storefront on the merchant's behalf.
• Compliance and protection: when we believe in good faith that disclosure is required to comply with a law, regulation, subpoena, court order, or other legal process; to enforce our Terms; to protect the rights, property, or safety of PeptiCommerce, our customers, or others; or to detect or prevent fraud, abuse, or security incidents.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, in which case the information may be transferred to the successor entity, subject to confidentiality protections.
• With your consent or at your direction: when you ask us to share information with a third party, such as by enabling an integration.

6. International Data Transfers

PeptiCommerce is based in the United States. Your information may be processed in, transferred to, or stored in the United States and other countries that may not provide the same level of data protection as your home country. Where required by law, we use appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for cross-border transfers.

7. Cookies and Similar Technologies

We use the following categories of cookies and similar technologies:

• Strictly necessary: required to authenticate you, prevent fraud, secure your session, and operate the Service. These cannot be disabled.
• Functional: remember your preferences and settings.
• Analytics: help us understand how the Service is used so we can improve it. We use first-party analytics and limit use of third-party analytics.
• Marketing: used only with your consent where required by law, to measure the effectiveness of our marketing campaigns.

You can control cookies through your browser settings. Disabling certain cookies may affect Service functionality.

8. Data Retention

We retain personal information for as long as your account is active and for as long as needed to provide the Service. After your account is closed, we retain limited information as required to comply with legal obligations (such as tax and accounting records), resolve disputes, prevent fraud and abuse, and enforce our agreements. When information is no longer needed, we delete or de-identify it in accordance with our data-retention policies and applicable law.

9. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. These include encryption in transit and at rest where appropriate, access controls, audit logging, infrastructure hardening, and routine security review. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. To report a security concern, contact [email protected].

10. Your Rights and Choices

Depending on where you live, you may have certain rights under applicable law, including the right to:

• Access the personal information we hold about you;
• Correct or update inaccurate or incomplete personal information;
• Delete your personal information;
• Restrict or object to certain processing;
• Receive a portable copy of your personal information;
• Withdraw consent where processing is based on consent; and
• Lodge a complaint with a supervisory authority.

You can exercise many of these rights directly from your account settings or by emailing [email protected]. We will respond within the time required by applicable law. We will not discriminate against you for exercising any of these rights.

Marketing emails: you can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by emailing us. We will continue to send transactional and account messages.

11. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act ("CCPA"), as amended by the CPRA, provides you with the rights listed in Section 10 above. In the preceding twelve months, we have collected the categories of personal information described in Section 2 for the business and commercial purposes described in Section 3, and disclosed those categories to the recipients described in Section 5. We do not "sell" personal information and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under California law. California residents may designate an authorized agent to make a request on their behalf, subject to verification.

12. Children

The Service is not directed to children under the age of 16, and we do not knowingly collect personal information from children. If you believe we may have collected personal information from a child, please contact us at [email protected] and we will take reasonable steps to delete it.

13. Third-Party Sites and Integrations

The Service may link to or integrate with third-party sites and services that we do not own or control. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third party before providing them with information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice (such as by email or in-product notification). Your continued use of the Service after the effective date of any change constitutes your acceptance of the updated Policy.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Compound Cart Inc.
Attn: Privacy Team
Email: [email protected]
Legal inquiries: [email protected]