Shop by goal

Popular compounds

GHK-Cu

GLP1-RC-RT

GLP1-RC-SM

Ipamorelin

All bestsellers →

Research resources

Research Areas

Certificates of Analysis

Privacy Policy

This Privacy Policy explains how Hilxera Distribution Services LLC collects and processes personal information through New-U Research Compounds. Where processing requires consent, that consent is requested separately.

Version

1.2

Updated

28 August 2026

First published

May 2026

Supersedes

v1.01 · 18 June 2026

New-U Research Compounds is the customer-facing trading brand and research-supply platform operated by Hilxera Distribution Services LLC , a limited liability company registered in the State of Wyoming, United States. Company ID 2026-001928701 . Hilxera Distribution Services LLC is the data controller for personal data processed through new-u.io. Privacy contact: newu.io.peptides@gmail.com.

01 Scope and controller

This policy covers visits to new-u.io, orders placed through it, accounts, customer support, our newsletter and messaging channels, the community forum, the affiliate and referral programmes, and the optional record-keeping tools described in § 05.

It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR and the Data Protection Act 2018, and it addresses equivalent consumer data-protection laws in the United States, including the California Consumer Privacy Act as amended by the CPRA.

Reading this policy does not itself constitute consent to anything. Where a lawful basis for processing is consent, we ask for that consent separately, for a specific purpose, without pre-ticked boxes, and you can withdraw it at any time.

02 Legal bases for processing

Under GDPR Article 6, we process personal data only where one of the following applies:

Performance of a contract (Art. 6(1)(b)) — taking, fulfilling, shipping and supporting your order.

Legal obligation (Art. 6(1)(c)) — tax, accounting, anti-fraud and regulatory record-keeping.

Consent (Art. 6(1)(a)) — marketing email, SMS messages, browser push notifications, non-essential cookies, and the optional tools in § 05. Consent is freely given, specific, informed and withdrawable at any time.

Legitimate interests (Art. 6(1)(f)) — fraud prevention, network and account security, and aggregate analytics. We balance these against your rights and do not rely on this basis where it would override them.

Where we rely on consent, withdrawing it stops the processing going forward but does not make earlier processing unlawful. Where we rely on legitimate interests, you can object — see § 12.

03 Information we collect

Information you provide

Order details: name, email address, delivery and billing address, and telephone number where a carrier requires one.

Account and order-tracking registration details.

Newsletter, SMS and browser-push subscriptions (the endpoint or number, plus the consent record).

Correspondence with customer support, including anything you choose to attach to it.

Affiliate and refer-a-friend programme applications and referrals.

Community-forum content: your chosen handle, posts and replies, and any avatar or banner image you upload.

Entries you choose to record in the optional tools described in § 05.

Information collected automatically

Browser type and version, operating system, device and screen characteristics.

IP address and approximate geographic location derived from it.

Pages visited, time on page and navigation paths.

Referral source and, where the referrer provides it, the search term used to reach us.

Information from third parties

We receive limited information from services we integrate with: payment providers confirming the status of a transaction, carriers and tracking providers reporting shipment status, and affiliate networks reporting referral attribution.

We do not buy personal data from data brokers, and we do not sell, rent or trade personal information to third parties for their own marketing.

04 How we use information

Order fulfilment — processing, packing, dispatching and tracking your order.

Transactional communications — order confirmations, dispatch and tracking notifications, delivery updates and payment receipts.

Customer support — answering enquiries and resolving issues, including through AI-assisted support functionality. Where required to resolve a request, limited account or order information relevant to that request may be processed.

Optional tools and reminders — operating the community forum and delivering the email, SMS or browser-push reminders you opt into.

Referrals and affiliates — attributing referrals and calculating commission.

Marketing — newsletters and product announcements, only where you have consented, with an opt-out in every message.

Compliance — recording the purchaser confirmations required by our Terms, and meeting tax, accounting and regulatory obligations.

Fraud prevention and security — detecting fraudulent transactions, abusive disputes and unauthorised account access.

Service improvement — analysing aggregate usage to improve performance and usability.

We do not use the optional entries described in § 05 for marketing, and we do not use them to personalise product recommendations.

05 Optional health-related information

Purchasing research compounds does not require customers to provide New-U with medical or health information. We do not ask for it at checkout, we do not need it to fulfil an order, and our support team is instructed not to collect it (see Contact).

Some optional New-U tools may allow a user to voluntarily record information such as schedules, quantities, measurements or other entries. Depending on the information entered and the context in which it is used, those entries may reveal information relating to health.

Where entries you record could reveal information relating to health, we treat them as special-category data under Article 9 UK/EU GDPR and process them only on the basis of your separate, explicit opt-in for that specific purpose. That opt-in is never bundled into accepting the Terms, creating an account, or completing a purchase.

Where that opt-in applies, the following hold:

Separate explicit consent. A distinct, unbundled opt-in, requested before the feature processes anything, never pre-ticked.

Specific purpose. The entries are used to display your own records back to you and to deliver reminders you have asked for. Nothing else.

Consent record. We record that consent was given, and when.

Withdrawal. You can withdraw consent at any time from the tool itself or by emailing us. Withdrawal stops further processing.

Deletion. You can delete your entries at any time, and can ask us to delete them for you.

Restricted access. Access is limited to the accounts and personnel that need it to operate or support the feature.

Defined retention. Entries are retained while the feature is in use and deleted within 30 days of withdrawal, deletion or account closure — see § 10.

Not used for marketing. These entries are never used for marketing, profiling, product recommendation, or shared with advertising partners.

These tools are record-keeping and display tools. They do not provide medical advice, do not recommend or calculate quantities, and the research materials in our catalogue remain research-use-only.

Outside this optional feature, we do not seek and do not knowingly process special-category data. If you send us health information we did not ask for — for example in a support email — we will use it only to answer your enquiry and will delete it once the enquiry is resolved.

06 Payment processing and financial data

Payments are handled by independent third-party payment providers. The methods available to you are shown at checkout and change as providers are added or retired, which is why this policy describes them by category rather than by name. The current list is published in our service-provider disclosure.

What each provider receives

Card and digital-wallet providers receive your billing address, the order amount, an order reference, and the card or wallet credentials you enter on their own hosted form. The card number, security code and expiry are submitted directly to the provider and are never received by New-U systems . We receive a tokenised reference, the card brand, the last four digits, and the authorisation and settlement status.

Cryptocurrency payment providers receive the order amount, an order reference and, where the provider sends invoice notifications, a contact email address. They return a deposit address, an invoice identifier and the on-chain transaction status. We never receive, request or store wallet private keys, seed phrases or wallet balances.

Each provider receives only the fields it needs to settle a single transaction. We do not share browsing history, marketing data or unrelated order history with them, and no single provider sees all of your payments.

On-chain transparency

Cryptocurrency networks are public ledgers by design. Once you broadcast a payment, the sending address, deposit address, amount and transaction hash become permanent public records on the relevant network. We add nothing to that record beyond the deposit address generated for your invoice, and we cannot remove or redact entries that already exist on a public chain. If on-chain privacy matters to you, consider funding payments from a wallet with no link to your identity.

What we retain

We do not store complete card numbers, security codes or expiry dates.

For card transactions we retain the tokenised provider reference, the last four digits, the card brand, the authorisation status and the settlement timestamp.

For cryptocurrency transactions we retain the deposit address generated for the invoice, the settlement asset and network, the transaction hash, the confirmed amount and the payment status.

Retention periods for these records are in § 10.

07 Service providers and processors

We share limited personal data with the organisations below, where necessary to provide services to you or to run New-U. They are described here by category and purpose : naming every active provider inside a legal document meant a routine supplier change silently made the policy inaccurate. The current named list is maintained separately and kept up to date.

Not every recipient is our processor. Depending on the service and the processing activity, an organisation may act as our processor, as a subprocessor, or as an independent controller in its own right — carriers and payment providers commonly do the latter for parts of their own processing, under their own privacy notices and for their own legal obligations. Where required, our relationships are governed by appropriate contractual and data-protection terms.

Category Purpose and data shared Hosting and infrastructure Serving the website and application. Technical request data, including IP address. Database and storage Storing customer, order and account records, and images uploaded to the community forum. Payment processing Settling transactions. See § 06 for exactly what each type of provider receives. Fulfilment and carriers Picking, packing and delivering an order. Recipient name and delivery address. Shipment tracking Reporting carrier status. Order reference and tracking number. We do not share your email address with the tracking provider; tracking notifications are sent by us. Communications Sending transactional email, opt-in SMS and marketing email. Name, email address, and mobile number where you have consented to SMS. Analytics Understanding aggregate site usage. Pseudonymous usage and device data. Fraud prevention and security Detecting fraudulent orders, abusive disputes and attacks. Order, device and network signals. Customer support Handling enquiries, including AI-assisted support functionality. Where required to resolve a request, limited account or order information relevant to that request may be processed. Authentication Signing you in and protecting account access. Address validation Checking that a delivery address is deliverable at checkout.

A current list of the named providers in each category is available at new-u.io/privacy/subprocessors, or on request from newu.io.peptides@gmail.com.

We describe what a provider does for us. We do not describe a provider as licensed, certified, regulated or compliant with a particular standard unless that status has been verified and applies to the specific service New-U uses.

08 Cookies and similar technologies

Essential — cart persistence, session management, checkout, security and age verification. These cannot be disabled without breaking the site.

Preference — your selected currency, language and display settings.

Analytics — understanding how visitors use the site. Set on the basis of consent where consent is required.

Affiliate attribution — attributing a referral to the partner who made it.

You can manage or clear cookies in your browser settings. Disabling essential cookies will prevent checkout and some account features from working. Where we record a cookie-consent choice, that record is kept for the period in § 10.

09 International data transfers

We serve customers in the EEA, the United Kingdom, North America, Australia, New Zealand and other supported destinations. Personal data may be processed in any of those regions, including the United States.

For customers in the EEA or the United Kingdom, where personal data is transferred outside the EEA or UK and applicable law requires additional safeguards, we use an appropriate transfer mechanism applicable to that relationship. Depending on the provider and destination, this may include an adequacy decision, the European Commission Standard Contractual Clauses together with any required UK addendum, or an equivalent lawful mechanism. We do not state a single mechanism as covering every transfer, because which one applies is a per-relationship fact we verify rather than assume.

You can request the specific transfer mechanism applying to your order from newu.io.peptides@gmail.com.

10 Data retention

We keep personal data only as long as we need it. Where a fixed period applies it is stated below. Where no fixed period applies, data is retained only for as long as reasonably necessary for the stated purpose and any applicable legal, accounting, fraud-prevention or dispute-resolution requirement, and is then deleted or anonymised.

Record Retention Orders and order items 7 years from the order date (tax and accounting). Checkout intents that did not become orders 90 days, then deleted. Unsuccessful payment attempts 12 months (fraud prevention and dispute handling). Payment transaction references 7 years, alongside the order they belong to. Security and fraud events 24 months, or longer where an investigation is open. Customer-service correspondence 24 months from the last message in the thread. Privacy and data-subject requests 3 years (evidence that the request was handled). Account records Duration of the account, plus 2 years after last activity. Newsletter consent records Until you unsubscribe, plus 3 years (proof of consent). SMS subscriptions Until you opt out, plus 3 years (proof of consent). Browser push subscriptions Until revoked or the endpoint expires, then deleted. Affiliate accounts Duration of the relationship, plus 3 years. Referral records 24 months from the referral. Forum posts and uploads Until you delete them or close your account; removed content is purged within 30 days. Optional tracker entries (§ 05) While the feature is in use; deleted within 30 days of withdrawal, deletion or account closure. Analytics 26 months at event level, then aggregated. Aggregate statistics hold no personal data. Cookie-consent records 12 months, then re-requested. Backups 35 days on a rolling cycle. A deletion request is applied to live systems immediately and works through backups as they roll off.

You can request deletion at any time (§ 12). Where a legal retention obligation applies — most often the 7-year order record — we will restrict the data to that purpose rather than delete it, and tell you when we do.

11 Security

We maintain appropriate technical and organisational safeguards designed to protect personal data, including access controls, encryption in transit and at rest, monitoring, logging, network protections and restricted administrative access. Personal data is held in access-controlled systems that are not open to the public internet, and access is granted on a need-to-know basis.

No internet-connected system can be guaranteed to be completely secure.

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as required by GDPR Article 33, and we will notify affected individuals where Article 34 requires it.

Further detail on our security controls is maintained in internal security documentation rather than published here. Security researchers and enterprise customers with a specific question can contact us at newu.io.peptides@gmail.com.

12 Your rights

All customers

Request access to the personal data we hold about you.

Request correction of inaccurate or incomplete data.

Request deletion, subject to legal retention obligations.

Opt out of marketing at any time.

Withdraw consent where consent is the lawful basis.

EEA and UK customers

In addition to the rights above, you have the right to:

request restriction of processing;

receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;

object to processing based on legitimate interests; and

lodge a complaint with your data-protection supervisory authority.

California residents

You have the right to know what personal information we collect and how it is used, to request deletion or correction, and to be free from discrimination for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA.

How to exercise a right

Email newu.io.peptides@gmail.com from the address associated with your account or order, and tell us what you are asking for. We respond within 30 days. If a request is complex we may extend that and will tell you why. We may need to verify your identity before acting on a request, and we will ask for the minimum needed to do so.

13 Children's privacy

This site and our services are not intended for anyone under 18, and purchasing research materials requires purchasers to be at least 21. We do not knowingly collect personal information from minors. If we learn that we have collected data from a person under 18, we will delete it.

14 Contact and complaints

For privacy questions, data-subject requests or complaints:

New-U Research Compounds Operated by Hilxera Distribution Services LLC Wyoming, United States · Company ID 2026-001928701 Email: newu.io.peptides@gmail.com

EEA and UK residents also have the right to complain to their national data-protection supervisory authority — for example the UK Information Commissioner's Office at ico.org.uk, or the relevant EU member-state authority listed at edpb.europa.eu. We would welcome the chance to address your concern first.

Please do not send medical histories, diagnoses or other health information you have not been asked for. See Contact.

15 Changes to this policy

We may update this policy to reflect changes in our practices, our service providers or applicable law. Every revision is published with a new version number and date, and recorded in the version history below. Superseded revisions are retained, not deleted.

Where a change is material, we will give notice by email or a prominent notice on the site before it takes effect. Where a change requires consent, we will ask for it rather than assume it.

Version history

Version Date What changed v1.2 28 August 2026 Removed “by using our website you consent to the practices described here”. Consent is now requested separately, for a specific purpose, where consent is the lawful basis. Added a dedicated Optional health-related information section (§ 05), replacing the contradiction between the previous blanket statement that no special-category data was processed and the separate acknowledgement that the tracker held schedules, quantities and weight entries. Article 9 treatment is now set out explicitly: separate unbundled opt-in, specific purpose, consent record, withdrawal, deletion, restricted access, defined retention, and no marketing or recommendation use. Stated that purchasing does not require customers to give New-U medical or health information. Replaced the named list of active card and cryptocurrency processors with processor categories plus a separately maintained current-provider disclosure, so a routine supplier change no longer makes the policy inaccurate. Removed unverified descriptions of third parties as licensed, PCI compliant, certified or regulated. Replaced the published security implementation detail (database topology, row-level security, SQL practice, key-management product, API rate limits, internal networking) with an Article 32-appropriate description of the safeguards in place. Detail moved to internal security documentation. Added an explicit retention table covering orders, checkout intents, unsuccessful payment attempts, payment references, security events, support correspondence, privacy requests, accounts, newsletter and SMS consent, push subscriptions, affiliates, referrals, forum content, optional tracker entries, analytics, cookie-consent records and backups. Removed “retained indefinitely” for analytics. Added a California residents subsection and a described process for exercising a right. Identified the controller consistently with the Terms, About, Contact and Delivery pages. Rebuilt the page as an institutional document with breadcrumbs, an inline contents list and this version-history table. v1.01 18 June 2026 Previous published revision, retained on the record. It stated consent by use of the website, named individual payment processors in the body of the policy, described the security implementation in detail, stated that no special-category data was knowingly processed while separately describing tracker entries, and retained aggregated analytics indefinitely. v1.0 May 2026 First published Privacy Policy, GDPR-aligned.

Related information

Certificates of Analysis

Official Domains

PRECISION. PURITY. PERFORMANCE.

Research peptides at >99% HPLC-verified purity, third-party tested by Janoshik Analytical & Freedom Diagnostics, with Certificates of Analysis published per released batch. Supplied strictly for laboratory research use.

Shop

All research compounds

Price list

Where to buy peptides

Research