What we keep, and for how long

An order needs a name, an address and a way to reach you. This page says what else we hold, why, how long it stays, and what to do if you want it gone.

Updated October 2026Jurisdiction: United Kingdom

Encrypted end to end: TLS on everything, including the bits nobody looks at
UK GDPR and DPA 2018: The framework we operate under, not one we aspire to
Yours to remove: Delete your account yourself, or ask. It goes 14 days later, with the exceptions named below

1. Who holds your data

Lucid Grove LTD (company number 16705822), which trades as Viper Peptides, is the data controller. That means the decisions about what is collected, why, and how long it stays are ours, and so is the responsibility when they are wrong. We operate under the UK General Data Protection Regulation and the Data Protection Act 2018.

2. What we collect, and why

An order needs a name, an address and a way to reach you. Here is everything else, and why each piece exists:

Date of birth, taken at registration and used for one thing: checking the 18+ eligibility term in our Terms. It is not used for marketing and it is not used for profiling. What gets recorded afterwards is the OUTCOME of that check — pass, or fail and why — so the restriction is auditable and repeated attempts to get round it are visible. Those records hold the outcome, not the date. They are kept as long as security and compliance reasonably need and no longer. We do not ask for identity documents and we do not run independent identity or age verification, so nothing here should be read as us having confirmed who you are.

Active Disclosure

Institutional/Personal Account Details
Date of Birth (18+ eligibility only)
Verified Shipping & Logistics Addresses
Technical Support Correspondences

Automated Telemetry

Anonymized Usage & Traffic Patterns
Browser Fingerprinting for Security
Session State & Cart Authentication
Referral & Visit Attribution (which site, partner or campaign sent you)

3. What happens to it

What we hold is used to get your order to you and to run the shop. Money is handled by regulated third parties — Fena for Pay by Bank, and our card provider for cards. Card numbers are typed into their form, never ours. Pay by Bank authentication happens inside your own bank, and your banking credentials never touch this platform.

What we will never do

We do not sell customer lists or research data. Nothing goes to a marketing firm. The only third parties who see your details are the ones who have to — the payment providers above and the courier carrying the parcel.

Referrals and visit attribution

To credit the websites, partners and campaigns that introduce customers to us, we keep a random visitor ID, and a note of which website or campaign first and last brought you here, in our own cookies for 90 days and against your visit (and your account, if you sign in). These hold no name, email or payment details and are not shared.

Support threads and anything you upload

You can only send a file when support has asked for one. There is no always-on upload box. A request stays open for 3 days, sends one reminder, then shuts itself.
What you upload is visible to the support team and nobody else. It is never made public and it is used for your enquiry and nothing else.
Every file has a removal date from the moment it lands. It goes when the conversation permanently closes, or when your account deletion is carried out at the end of the 14-day wait in section 4 — whichever is sooner. The one exception is a file supporting a live payment dispute, which is kept until the dispute ends and then deleted.
The text of a support thread is kept as business correspondence, and your rights below apply to it like anything else. When your account is deleted, the messages go; only the fact that a conversation happened, and when, stays.

4. What you can make us do

These are rights, not courtesies. Under UK GDPR you can require us to:

Ask for a copy of everything we hold about you (Right of Access)
Make us correct anything that is wrong (Rectification)
Make us delete it (Erasure)
Make us stop using it while a dispute is settled (Restriction)
Take it elsewhere in a portable format (Portability)
Object to a use you did not ask for (Objection)
Refuse a decision made about you by a machine alone (Automated decision-making)

When you delete your account

It happens 14 days after you ask. Until then you can cancel it from the same page and nothing is lost. The wait is there so that a deletion nobody meant, or somebody else started, can be stopped.
Anything still in progress has to finish first: an order on its way, a refund or return being processed, or an open payment dispute. The Privacy page tells you what, before you start.
Store Credit does not survive it. Any balance left is written off when the deletion runs. We show you the amount and warn you before you confirm, so spend it first if you want it.

What we keep afterwards, and why

Records of what you bought and paid for — orders, payments, refunds and your Store Credit history. The law makes us keep them for 6 years from the end of our financial year (see section 5), so they stay, with your name, email address, phone number and address taken out. What is left is what was bought, the figures, and the country it went to.
Invoices we issued. A VAT invoice is a legal document and cannot be altered, so an invoice already issued is kept unchanged for the same 6 years and then deleted.
Payment disputes. A dispute record stays with its order for as long as the order does, because a claim can be brought over it.
Fraud prevention. The fraud checks run on your orders, and any block placed on a card, address or email address, stay for the periods in section 5, because we have a legitimate interest in not being defrauded twice.
Reviews you published. They stay on the site as “Former customer”, with nothing that identifies you. If a review names you or anyone else, tell us and we will take those words out.
One marketing record. We keep a scrambled, one-way fingerprint of your email address, and nothing else, so that we never send you marketing again, even if your address reaches us another way.

5. How long we keep things

Each kind of record has a period. When a period below ends, the record is deleted automatically. Deleting your account removes your personal details from the records below sooner; it does not shorten the periods the law sets.

Your account: Until you delete it. Deletion runs 14 days after you ask.
Orders, payments, refunds, invoices and Store Credit history: 6 years from the end of the financial year of the last thing that happened to them (a late refund moves the year on), as HMRC requires. Then deleted.
Payment disputes: With the order they belong to, and never deleted while still open.
Fraud checks on an order: 2 years from the last check, which is longer than a card payment can be disputed. Never while a dispute is open.
Fraud blocklist entries: 6 years from the last time the entry was used or changed.
Security and audit records: 6 years from the event. A record about an order we still keep stays as long as the order.
Support uploads: As section 3 describes: when the conversation closes, or when your account is deleted.
Support messages: Kept as business correspondence. The messages go when your account is deleted.
Marketing opt-out: For as long as we send marketing, as a one-way fingerprint of your email address only.
Data download links: 24 hours.

6. How to use any of that

Most of it you can do yourself. Signed in, go to Account › Privacy: you can download a copy of everything we hold about you, or delete your account.

Email still works for all of it, and for anything the page does not cover, including if you have no account or cannot sign in. Say what you want and we will do it — no form, no template, no escalation path to climb. A request by email is carried out the same way, with the same wait before a deletion. Subject Access Requests are answered within 30 days, which is the statutory limit rather than our target.

Account › Privacy Email support team