Privacy Policy

Last updated: October 28, 2026

Who this applies to

This policy covers personal information collected through Onex Peptides’s website and by email. It is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

What we collect, and why

When you place an order

Orders are placed through the checkout on this site, and some still arrive by email. Either way we receive your name, email address, shipping address, the compounds ordered, and anything else you choose to include. We use it to fulfil the order, to answer questions about it, and to meet record-keeping obligations. We do not use it for anything else.

When you subscribe to the newsletter

Your email address, the date, and the page you subscribed from. The date and page are the record of consent that CASL requires. You can withdraw consent at any time and the record is retained for three years after the last message sent, which is what the legislation requires of it.

When you browse the site

Your browser stores the contents of your cart locally, under the key onex.cart.v1. This never leaves your device and is not transmitted to us. Clearing your browser’s site data removes it.

Our hosting provider records standard server logs — IP address, timestamp, URL requested, user agent — as every web server does. These are used for security and diagnostics and are not combined with any other information about you.

Analytics

This site uses Google Analytics 4 to count visits and see which pages are read. It sets two first-party cookies in your browser, _ga and _ga_TN9C8696V5, which expire two years after your last visit. They hold a randomly generated identifier for the browser — not a name, an email address or anything you have typed.

What is sent to Google is the pages you view, the site or search engine you arrived from, and your device, browser and language. Google derives an approximate location from your IP address and does not make the address itself available to us. We use this only to understand how the catalogue is used, and we do not attempt to identify individual visitors from it or combine it with your order record.

Google LLC processes this information on servers outside Canada, primarily in the United States, where it is subject to the laws of that country and accessible to its authorities under them. PIPEDA permits a transfer of this kind and requires that we tell you it happens, which is the purpose of this paragraph.

To opt out:block cookies for this site in your browser settings, or install Google’s Analytics opt-out add-on, which stops the measurement on every site you visit. Nothing on this site stops working if you do — the analytics is measurement only, and the storefront does not read it.

What we do not collect

• No advertising or remarketing trackers. There is no Meta pixel, no TikTok pixel, no Google Ads conversion tag and no advertising cookie on this site. The Google Analytics tag described above is measurement only, and is not used to build an audience or to follow you to another site.
• No password of yours is visible to us. Accounts are handled by Supabase, which stores the password as a hash; we can neither read it nor recover it, only trigger a reset to your email address.
• No payment card details. Payment is handled by a link issued with your order confirmation; card details are entered with the processor, not with us, and we never see or store them.
• No health information.Do not send us any. These are laboratory reagents and we have no reason to hold anything about anyone’s health.

Who we share it with

Shipping carriers receive the name, address and contact details needed to deliver the parcel. Payment processors receive what is needed to take payment. Our email and hosting providers process information in the ordinary course of operating the service. We do not sell, rent or trade personal information to anyone, for any purpose.

We disclose information to a law enforcement or regulatory body only where legally compelled to do so.

Where it is held

Service providers we use may process or store information outside Canada, including in the United States. Information held in another country is subject to the laws of that country, including lawful access by its authorities. This is the standard position for any Canadian business using commercial cloud services, and it is stated here because PIPEDA requires that it be.

How long we keep it

• Order records: seven years, which is the retention period Canadian tax and commercial record-keeping rules require.
• Newsletter consent records: three years after the last message sent to that address, per CASL.
• Email correspondence: as long as needed to resolve the matter it concerns, and then deleted on request.
• Server logs: short retention, for security and diagnostics only.

Your rights

Under PIPEDA you may:

• ask what personal information we hold about you and request a copy;
• ask us to correct anything inaccurate;
• withdraw consent to marketing at any time, by the unsubscribe link or by email;
• ask us to delete information we are not legally required to retain;
• complain to us, and then to the Privacy Commissioner of Canada.

Email [email protected] and we will respond within thirty days, which is the statutory window.

Security

The site is served over HTTPS. Access to order information is limited to people who need it to fulfil orders. No system is perfectly secure and we do not claim otherwise; what we can say is that we hold as little as the business needs, which is the most effective security measure available.

Changes

This policy is updated when what the site does changes, not on a schedule. The date at the top reflects the current deployment. Material changes affecting how we use information already collected will be notified by email to affected customers.

See also the terms of service and terms of sale.