Privacy Policy

1. Who this covers

PeptideApprove provides merchant-services support and packages applications for licensed sponsor-bank, acquiring, processing, payout, and issuing partners. This policy covers visitors to peptideapprove.com and businesses that apply for processing.

We do not sell personal information. We do not share applicant information for third-party marketing.

2. Information we collect

The merchant application collects the legal entity, the owner, and the settlement account required for underwriting.

Business and contact details.

• Legal name, entity type, country, and registered address
• Website and expected monthly volume
• Business email, phone, and a short description of what is sold
• EIN for a business, or the last four digits of an SSN for a sole proprietor

Owner and identity.

• Owner name, role, email, phone, date of birth, and nationality
• Government ID type, number, issuing country, and expiration
• Home address, which is separate from the business address
• A photo of the ID, including the back of a license or identity card
• A proof of address less than three months old

Entity documents and settlement account.

• IRS EIN letter (CP 575 or 147C) and formation documents
• Settlement account holder, bank name, routing number, and account number. The account holder must be the legal entity.
• A bank statement for that account
• Do not upload card numbers, bank login credentials, or a full Social Security number.

The website address is stored with the application. We do not crawl it to prefill the form.

The site host may keep ordinary request logs, such as IP address, browser type, pages requested, and referring URL. We use those logs to operate and protect the site.

3. How we use information

We use application information to:

• Decide whether a merchant profile can be underwritten
• Review the application and the documents you upload
• Prepare a file for a sponsor bank, acquirer, or other program partner
• Communicate with you about the application and, if approved, about processing setup
• Keep records needed for the merchant relationship, disputes, fraud review, and partner requirements

We do not contact your current processor about a statement you upload. A confidentiality agreement for statement review is available on request from privacy@peptideapprove.com.

4. Where documents are stored

Application answers and KYB files are stored in our application platform. That platform is the system of record.

• Files, including photo ID, EIN letters, formation documents, proof of address, and bank statements, are stored in a private file store. That store is not public. Files are not published at a public URL.
• Form answers, ownership details, document status, and extraction results are stored in the project database.
• The public website is hosted separately. Application files are not stored on the website host.

5. How sensitive documents are transmitted

• From your browser. The site and every upload use HTTPS. An upload is accepted only for the application it belongs to: a draft requires a secret draft token, and a submitted application requires the email on that application.
• Into storage. The upload is written by a server-side function into the private file store. The browser is not given a key that can read other merchants’ files.
• Internal review copy. We may email a copy of an application, and of uploaded files that are small enough to attach, to our onboarding inbox. That message is sent over TLS through our email provider. Larger files stay only in the private file store, and the email tells the reviewer to open them there.
• Program partners. If we submit an application for underwriting, we send the partner the package that review requires. We do not post KYB files on a public link to do that.

6. Encryption

Information is encrypted in transit with TLS, including the website, uploads, the file store, and the internal notification email.

The application platform encrypts the database and file storage at rest with AES-256. We rely on that platform encryption. We do not operate a separate customer-managed key for these files.

7. Who can access files

Visitors and applicants cannot read the file store. Access inside PeptideApprove is limited to named operator accounts.

• An operator must have an individual account that is an active internal user. There is no shared login for KYB files. Disabling an account removes that person’s access to application records and stored files.
• Operators may view and update files as part of underwriting and onboarding. Deleting a stored file requires an administrator account.
• Server jobs that accept uploads use a service credential that is not included in the public website.

Operator sign-in is an individual authenticated account. We do not describe a completed SOC 2 examination in this policy.

8. Logging

For each uploaded file we record the document type, original file name, size, storage location, time received, and review status. The upload and extraction functions also write operational logs, which the application platform retains. Administrators use those records to investigate failures, disputed uploads, and suspected misuse. We do not sell log data.

9. Vendors and subprocessors

Service providers process applicant information for the purposes in this policy. We describe them by role:

• Application infrastructure, including the database, authentication, private file storage, and the service that accepts uploads.
• Hosting for the public website.
• Email delivery to our onboarding inbox, including review copies of application files that fit in email.
• The processing partner that underwrites an accepted application, which receives the legal entity, owner, documents, and settlement account from this file.
• Banking, acquiring, processing, payout, issuing, and compliance partners that receive an underwriting package only when we submit an application. Not every applicant is sent to every partner. Clinical, pharmacy, telehealth, and patient-care files may be shared with a healthcare-compliance reviewer when that path applies.

10. Retention and deletion

We keep application and KYB records for the merchant relationship and for seven years after it ends. We keep a declined or withdrawn application for seven years after the decision or withdrawal. A sponsor bank, card network, dispute, fraud investigation, tax obligation, or other law can require a longer period.

You may ask us to access, correct, or delete your information by emailing privacy@peptideapprove.com. If we must keep a record, we will tell you what we still hold and why. We delete or stop using the rest.

11. If something goes wrong

If we confirm that someone accessed applicant information without authorization, we investigate, disable the affected account or credential, and preserve the logs described above. We notify the affected businesses, and any processing partner who needs to know, without undue delay and where the law requires notice.

Report a concern to privacy@peptideapprove.com.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of personal information, and to appeal a denial. California residents have rights under the CCPA. EU and UK residents have rights under the GDPR, including the right to object or restrict certain processing. Email privacy@peptideapprove.com to use those rights. We will not discriminate against you for doing so.

13. Children

Our services are for businesses. We do not knowingly collect information from anyone under 16.

14. Changes

We will update the date on this page when the policy changes. If we materially change how we handle KYB documents, we will also email applicants we can still reach.

15. Contact

Privacy questions: privacy@peptideapprove.com. Application questions: hello@peptideapprove.com or onboarding@peptideapprove.com.