Last updated September 25, 2026.
Who we are and what this covers
Vow Science LLC (“Vow Peptides”, “Vow”, “we”, “us”) runs vowscience.com, a United States storefront supplying research peptides for laboratory research use only. We are the business responsible for the information described here. This policy covers the website, orders placed on it, and the email we send you. It does not cover sites we link to.
We sell and deliver within the United States only, and this policy is written for buyers and visitors in the United States.
What we collect
- Account and order information. Name, email address, billing and shipping address, phone number if you give one, the items you buy, order totals and status. If you create an account, your orders are linked to it along with your login details.
- Research-use declaration. At checkout we ask you to accept our research-use terms, confirm your age, and give your research field and, where it applies, your organization. Your date of birth is used only to check that you meet the minimum age: we record the result, not the date. We keep your answers, the version of the declaration you accepted, and when you accepted it.
- Payment information. Card payments are processed by a PCI-DSS compliant payment gateway, and we never store full card numbers. What comes back to us is a result: approved or declined, card brand, last four digits, and a transaction reference.
- Support messages. Your name, email address, the message and any files you attach through our contact form. These become tickets in our support system.
- Email subscriptions. If you subscribe to our newsletter or ask for a back-in-stock alert: your email address, the record of your sign-up, and whether you opened or clicked what we sent.
- Wishlist. The products you save, held against your account.
- Browsing and device information. Pages and products viewed, cart and checkout activity, purchases, the site or ad that referred you, browser and device type, and approximate location (such as region or city) inferred from your IP address. This is collected through the cookies and tags described below.
- Order attribution. The referrer, source, medium and campaign (UTM) tags behind each order, recorded on our own server so we can tell which channels work.
- Device and log data. IP address, browser, operating system, timestamps and pages requested, recorded by our host and our security provider on every visit, because that is how a web server runs.
We do not ask for sensitive information and do not want it: no government identifiers, no health records, no biometrics, no precise location. Please keep all of that out of the contact form.
How we collect it
- Directly from you at checkout, on registration, in the research-use declaration, on newsletter or back-in-stock sign-up, through the contact form, and when you save a wishlist.
- Automatically through cookies, analytics and advertising tags, and server logs.
- From our service providers. The payment gateway reports whether a payment cleared; the email service whether a message was delivered or bounced; the tax and shipping services return rates, tax amounts and label status; carriers return tracking events.
- Nowhere else. We buy nothing from data brokers and append no outside data to your record.
Why we use it
- Take, fulfill and ship your order: calculate tax, buy a label, send confirmations and shipping notices.
- Confirm eligibility: check that buyers are 21 or older and have accepted our research-use terms, and keep a record that they did.
- Answer your questions and handle claims, replacements, refunds and complaints.
- Send email you asked for, such as the newsletter or a back-in-stock alert. You can unsubscribe at any time.
- Measure how the site performs and which channels and ads bring visits and orders.
- Advertise through Google and Microsoft, including showing our ads to people who have visited this site.
- Prevent fraud and abuse and keep the site secure.
- Meet tax, accounting and regulatory duties and defend legal claims.
We do not use profiling to make decisions about you that carry legal or similarly significant effects.
Cookies, analytics and advertising
Cookies are small files a website stores in your browser. This site uses its own first-party cookies and tags from Google and Microsoft. We do not show a cookie banner: the cookies and tags below run when you visit, and you control them with the choices listed after them.
- Strictly necessary. Cookies that keep your cart, checkout session and login working, and security cookies Cloudflare may set to help tell people from automated traffic. The store cannot function without them.
- Order attribution. First-party cookies that remember how you arrived, such as the referring site or campaign tags, so an order can record its source. This information stays on our server.
- Analytics. Google Analytics 4 sets first-party cookies holding a pseudonymous identifier and sends Google the pages and products you view, cart and checkout activity, and completed purchases, including order value and items.
- Advertising. Google Ads conversion tracking and the Microsoft Advertising Universal Event Tracking (UET) tag record visits and purchases so we can see which ads lead to orders. Google and Microsoft may link this to cookies they set on their own domains and use it to build advertising audiences, such as people who have visited this site.
When you complete an order, we may also send Google a one-way hashed (SHA-256) copy of the email address on the order, so Google can match the purchase to an ad interaction. Google receives the hash, not the address itself. Google and Microsoft handle what their tags collect under their own policies: see how Google uses information from sites that use its services and the Microsoft Privacy Statement.
Your choices
- Your browser. Block or delete cookies, block third-party cookies, or browse privately. Blocking all cookies will stop the cart and checkout working.
- Google Analytics. Install the Google Analytics opt-out browser add-on.
- Google ads. Turn off personalized ads in Google’s Ads Settings.
- Microsoft ads. Turn off personalized ads in Microsoft’s personalized ads settings.
- Industry opt-out pages. The Digital Advertising Alliance’s WebChoices tool and the Network Advertising Initiative opt-out cover many advertising companies at once.
These choices apply to the browser and device where you make them, and some are stored as cookies, so clearing cookies can undo them. Opting out of personalized ads stops a provider using your activity to target ads, but may not stop its tag recording that a visit or purchase happened; blocking the tags in your browser or with a content blocker does. This site does not currently respond to Do Not Track or Global Privacy Control browser signals.
Who we share it with
We share personal information with the companies below so they can do work for us. Except where noted, they process it on our instructions. As of the date above:
- Payment processing. Our PCI-DSS compliant payment gateway receives your card and billing details from the checkout page to authorize the payment.
- Hosting and security. Our web host stores the site and its database. Cloudflare sits in front of the site as a content delivery and security network, so every request, including your IP address, passes through it.
- Email delivery. An email delivery service sends our order, account and marketing email and tells us whether each message was delivered.
- Email marketing and support. FluentCRM holds subscriber records and engagement, and Fluent Support holds your tickets. Both are self-hosted inside our own WordPress installation, so these records stay in our own database; only the delivery step leaves our server.
- Tax and shipping. Our sales-tax calculation and shipping-label services receive address and order data to calculate sales tax and buy shipping labels.
- Carriers. The carrier on your label gets your name, delivery address and package details.
- Analytics and advertising. Google (Google Analytics and Google Ads) and Microsoft (Microsoft Advertising) receive what their tags collect, as described above, and also use it under their own privacy policies.
- Advisers and authorities. Accountants, lawyers and insurers where they need it; law enforcement or regulators where we are legally required to respond.
If the business is sold or merged, customer records may pass to the buyer. We would tell you first.
Selling, sharing and targeted advertising
We do not sell personal information for money, and we do not sell or rent our customer or subscriber lists.
The advertising tags described above let Google and Microsoft collect information about your activity on this site, which they may use to show you ads on other sites and apps. Some state privacy laws treat that as a “sale”, as “sharing” for cross-context behavioral advertising, or as “targeted advertising”, even though no money changes hands. You can opt out of it with the choices listed under Cookies, analytics and advertising. We do not knowingly sell or share the personal information of anyone under 16.
International transfers
We are a United States business and deliver within the United States only, and your information is processed in the United States. Some of our providers, including Cloudflare, Google and Microsoft, operate worldwide and may process information in other countries under their own safeguards. If you visit from outside the United States, your information is processed under laws that may protect you less than your own.
How long we keep it
We keep information only as long as the purpose or the law requires.
- Orders, invoices, payment records and the research-use declarations attached to them — typically seven years, for tax and legal purposes.
- Account details and wishlist — while your account is open. When it is closed we delete them, apart from the order records above.
- Support tickets and attachments — for as long as we need them to handle your request and any follow-up.
- Newsletter subscription and engagement — while you are subscribed, plus a reasonable period afterwards. We keep a minimal record of an unsubscribe so we can keep honoring it.
- Google Analytics data — event-level data for no more than 14 months.
- Server and security logs — for the short periods our host and Cloudflare need for security and troubleshooting.
When a period ends we delete the records or strip out anything that identifies you.
Security
Every page is served over an encrypted connection, and Cloudflare filters traffic before it reaches our server. Card payments are handled by a PCI-DSS compliant payment gateway and we never store full card numbers, which removes the largest single risk on our side of the transaction. Administrative access is limited to the people who need it, and we keep WordPress, WooCommerce and every plugin patched.
No site is perfectly secure and we will not pretend otherwise. If a breach affects your information, we will notify you and the relevant regulators within the time the law allows.
Your rights and how to use them
- Access. Ask what we hold about you and get a copy, in a machine-readable file if you want one.
- Correction. Ask us to fix anything inaccurate. Account holders can edit most details themselves.
- Deletion. Ask us to delete your information, subject to the limit below.
- Marketing opt-out. Use the unsubscribe link in any marketing email, or tell us and we will remove you. Order confirmations and shipping notices are not marketing and continue while an order is open.
- Analytics and advertising opt-out. Use the choices under Cookies, analytics and advertising. They work in your browser, so they take effect immediately and do not need a request to us.
- No retaliation. We will not charge you more, serve you worse, or refuse to sell to you because you exercised a right.
Email [email protected] or use our contact form. We confirm receipt within 10 business days and answer within 45 days, extending once by a further 45 days if the request is complex. Before acting we may ask you to confirm details we already hold, usually an order number and the email address on it. An authorized agent may act for you with written permission we can verify.
One limit, stated plainly: tax, accounting and commercial law require us to keep records of completed orders and payments, and a deletion request will not remove those. The same applies to the research-use declaration attached to an order: we remove your research field and organization, but keep the record that you accepted our terms and met the age requirement. We delete everything we are free to delete, close your account and take you out of marketing, then keep only what we are obliged to keep.
California privacy rights
If you live in California, the CCPA as amended by the CPRA gives you the rights above plus a few specific ones. In the last twelve months we collected these statutory categories: identifiers such as name, email address, postal address, IP address and cookie identifiers; customer records including billing and shipping details; an age confirmation (that you meet the minimum age, not your date of birth); commercial information such as what you bought; professional information, meaning the research field and organization in your declaration; internet activity such as pages and products viewed; and approximate location inferred from your IP address. Each was collected for the purposes set out here and disclosed for a business purpose to the providers listed above.
Identifiers, commercial information and internet activity collected by the advertising tags are made available to Google and Microsoft, which California law may treat as selling or sharing. You can opt out using the choices under Cookies, analytics and advertising. The only sensitive personal information involved is your account login, used to run your account, and your card details, which are passed to our payment gateway to complete a payment; neither is used for any other purpose. We disclose nothing to other companies for their own direct marketing.
Use the routes above, at no cost, and appeal a refusal by replying to our decision. Residents of other states with comparable privacy laws, including rights to opt out of targeted advertising, have the same rights and routes.
Children’s privacy
This site is for adults buying research materials for laboratory use, and buyers must be 21 or older. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it. If you believe a minor has given us information, tell us and we will remove it.
Changes to this policy
We update this page when our practices, our providers or the law change, and the date at the top always shows the current version. If a change materially affects how we use information you have already given us, we will say so on the site, email subscribers, and ask for your consent where the law requires it.
How to contact us
Email [email protected] or use our contact form for a question, a request or a complaint about privacy. If we have not resolved something, you may complain to your state attorney general or, in California, to the California Privacy Protection Agency.