The short version
- We do not sell products, run accounts, or ask you to log in.
- We set no advertising cookies and no analytics cookies.
- We do not sell, rent, or share personal data with data brokers.
- The one thing we store on your device is a record of your cookie choice.
- If you subscribe to the newsletter, we hold your email address and nothing else — and only after you confirm it.
- Some third parties see your IP address because the site loads fonts and scripts from them. That is the main privacy trade-off on this site, and it is explained below.
Who we are
The Skin Peptide Lab is an independent editorial publication about peptides in skincare. It is not a shop, not a skincare brand, and not a medical service.
We are still setting up a published contact address and, where required, a formal data-controller registration. Until that is in place, privacy questions can reach us by replying to any newsletter issue. If you need a contact route before then, please treat this policy as incomplete on that point rather than assuming there is no route — we would rather say so than pretend otherwise.
What we collect
Newsletter signups
If you enter your email address in the subscribe form, that address is sent to Buttondown, the service we use to run the mailing list. Buttondown acts as a processor on our behalf, stores the address, and sends the issues.
We use double opt-in. Submitting the form does not subscribe you. Buttondown emails you a confirmation link, and nothing is sent to you unless you click it. If you never confirm, the pending record expires without becoming a subscription. That confirmation is also our record that you consented, which is why we do not send your IP address along with the signup.
The only thing we ask for is an email address. We do not ask for your name, and we do not attach behavioural or reading data to it. Every issue carries a one-click unsubscribe link, and unsubscribing takes effect immediately. You can also ask us to delete the record entirely rather than merely unsubscribing.
The legal basis is your consent, given by confirming the opt-in email, and you can withdraw it at any time.
Information collected automatically
This site is served by Vercel. Like effectively every web host, Vercel processes standard request data in order to deliver pages and defend against abuse. That typically includes your IP address, the page requested, the time of the request, your browser's user-agent string, and the referring page. We do not use this data to build a profile of you, and we do not have an analytics product layered on top of it.
Cookies and local storage
This site currently sets no cookies at all. Not for advertising, not for analytics, not for personalisation.
One item is written to your browser's local storage, which is a similar technology and is covered by the same rules:
| Name | Type | Purpose | Expires |
|---|---|---|---|
spl-consent | Local storage | Records your cookie choice so the banner does not reappear on every page. | After 12 months, or when you clear site data |
This entry is strictly necessary: without it we could not honour the preference you set. It contains only your choice, the date you made it, and a version number. It is not an identifier and is never sent to a server.
The advertising and analytics toggles
The consent banner offers analytics and advertising toggles even though neither is running yet. This is deliberate. The publication plans to carry clearly labelled display advertising, and we would rather record your preference in advance and honour it from day one than switch tracking on and ask afterwards. Both toggles are off unless you turn them on. If either service launches, it will be gated on the consent already stored, and this page will be updated to name the specific providers and cookies before anything is set.
Changing your mind
Use the Cookie settings link in the site footer at any time. Clearing your browser's site data for this domain also removes the stored choice, and the banner will ask again on your next visit.
Third parties that see your IP address
This is the part worth reading carefully, because it applies whether or not you accept anything in the banner. To render pages, your browser fetches files from the following services. A request to any third-party server necessarily discloses your IP address and user-agent to that server.
| Service | What it provides | Loaded on |
|---|---|---|
Google Fonts (fonts.googleapis.com, fonts.gstatic.com) | Typefaces used across the site | Every page |
jsDelivr (cdn.jsdelivr.net) | The GSAP animation library | Every page |
Tailwind CDN (cdn.tailwindcss.com) | Styling framework | Every page |
| Vercel | Hosting and content delivery | Every page |
| Buttondown | Newsletter delivery | Only when you submit the subscribe form |
None of these are used by us to track you, and we receive no analytics from them. We are naming them because several privacy regimes treat font and script CDNs as a genuine disclosure of personal data, and a policy that omitted them would be misleading. Self-hosting these files would remove the disclosure entirely; it is on our list.
Legal bases
Where the UK GDPR or EU GDPR applies, we rely on:
- Legitimate interests — for server logs kept to deliver the site securely and reliably.
- Consent — for anything non-essential stored on or read from your device. This is what the banner is for, and consent can be withdrawn at any time without affecting what happened before you withdrew it.
How long we keep things
Your consent record lives on your device for up to 12 months. Host-level request logs are retained by Vercel under their own retention schedule; we do not extract, export, or archive them.
A confirmed newsletter address is kept until you unsubscribe or ask us to delete it. An unconfirmed signup is discarded rather than kept as a lead.
Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to it. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office.
In practice, the only personal data we hold is the email address of confirmed newsletter subscribers. If you have never subscribed, there is nothing for us to retrieve or erase. If you have, you can unsubscribe from any issue, or ask us to delete the record outright.
Children
This publication is written for adults making decisions about skincare products. It is not directed at children, and we do not knowingly collect data from them.
Not medical advice
Nothing on this site is medical advice, diagnosis, or treatment, and reading it does not create a clinical relationship. For anything affecting your skin, health, or medication, speak to a licensed professional.
Changes to this policy
When this policy changes materially — and particularly before we start collecting newsletter addresses or serving advertising — we will update the date at the top of this page and, where the change affects consent, ask again through the banner rather than quietly re-interpreting a previous answer.