This Cookie Policy explains how THE STACK SOURCE LLC, doing business as Peptavo ("Peptavo," "we," "us," or "our"), uses cookies and similar tracking technologies on peptavo.com and related services (the "Services"). It should be read together with our Privacy Policy and our Terms of Service, each of which is incorporated into this Cookie Policy by reference. By accessing or using the Services, you acknowledge and agree to our use of cookies and similar technologies as described in this policy, subject to any consent or preference mechanism we make available to you.
1. What Cookies Are
Cookies are small text files that a website places on your device when you visit it, allowing the site to recognize your device over time and store information about your preferences or past actions. We use the term "cookies" in this policy to refer collectively to cookies and functionally similar technologies, including browser local storage and session storage, regardless of whether they are stored for a single session or persist across visits. Section 2 describes every category we actually use. Our analytics providers send their measurements from your browser to their own servers, which can take the form of a small tracking pixel (including the Meta Pixel described in Section 2). Apart from that, we do not use web beacons, device fingerprinting, or unrelated cross-site tags on the Services.
2. Categories of Cookies We Use
Strictly necessary cookies. These are required for the Services to function and cannot be disabled through our systems. Our authentication cookies are issued by Supabase, our authentication provider, and hold the session and refresh tokens that keep you signed in, identify you to our servers on each request, and let us enforce access to paid course content. Your course progress, quiz results, and certificates are stored in our database rather than in any cookie, but without a valid session cookie we cannot identify you in order to read or write those records. Because these cookies are essential, blocking or deleting them through your browser will materially impair or entirely prevent your ability to use the Services, and we are not responsible for any resulting loss of functionality, access, or saved work.
Session storage during signup. If you begin signup and then choose to continue with Google, your browser holds the answers you already gave in session storage under the key peptavo_signup_presignup so that they survive the trip to Google and back. Depending on how far you got, those answers can include your name, NPI number, practitioner type, practice name, and practice address. This is stored by your browser on your own device, is never read by a third party, is removed as soon as it is applied to your profile, and is cleared when you close your browser. We also use local storage in one place unrelated to visitors, to preview unsaved blog drafts inside our own admin tools.
First-party attribution and referral cookies. We set a small number of first-party cookies so we can tell which channel brought you to us, and so we can apply a discount and credit whoever referred you:
pv_first_touch stores the first visit this browser made to our site: the domain that referred you (hostname only, never the full referring URL), the utm_source, utm_medium, utm_campaign, utm_content and utm_term values in the link you arrived on, the name of any advertising click parameter on that link (never its value), the path of the page you landed on, and the date. It is written once and never overwritten. pv_latest_touch stores the same fields for the most recent visit that arrived from a known source, and is rewritten on each such visit.
peptavo_ref and peptavo_gift store only a referral or gift code you arrived with, and nothing else: no referring domain, no campaign values, and no landing page. They exist to give you the discount that the link you followed offers, and to credit the partner or colleague who sent it, so we set them wherever that link is followed. Without them a discount you were promised would not reach checkout.
When you create an account or request a resource we copy these two touches onto that record, together with a broad device category (mobile, desktop, or tablet) read from your browser's user agent string. We do not fingerprint your device, and we do not store your IP address with it.
All of these cookies are first-party and are marked HttpOnly so page scripts cannot read them. pv_first_touch and pv_latest_touch expire one year after they are set; the others expire after seven days. None is used for advertising, cross-site tracking, profiling, or sale to anyone, and none is shared with an advertising network.
Analytics. We use Vercel Web Analytics to understand aggregate traffic to the Services, including which pages are viewed, what broad device and browser category a visitor used, and what site referred them. Vercel Web Analytics does not set cookies on your device and does not build a persistent profile of you across sites. We use what it reports in our sole discretion to measure, audit, and improve the performance, security, and content of the Services.
We use Ahrefs Web Analytics for the same purpose. It also sets no cookies and stores nothing on your device, reports only aggregate page views, referrers, and broad device and location categories, and does not build a persistent profile of you across sites. Because it stores nothing on your device, it runs in every region.
We also use Google Analytics 4, a service provided by Google, for the same purpose. Where it runs, it sets first-party cookies named _ga and _ga_<container id> that store a randomly generated identifier so that repeat visits from the same browser can be counted as one visitor rather than several. Google receives the pages you view, approximate location derived from your IP address, and broad device and browser information, and acts as our service provider in doing so. We have not enabled Google Signals or any advertising, remarketing, or cross-device feature on the property, and we do not sell or share what it collects for cross-context behavioral advertising.
If you buy the course while Google Analytics is running, we also send Google the order reference Stripe assigned to that payment, the amount paid, the currency, whether a partner or gift discount applied, and the partner code where one did. We send this so we can tell which marketing channels lead to enrollments. We do not send your name, email address, or anything about your account, your progress, or your certification, and the order reference identifies a payment only inside our own Stripe account.
The Google Analytics tag is subject to the same regional gate as the signup funnel cookies described above, and the check fails closed: we load it only in regions where our reviewed policy permits notice-based analytics without a prior consent prompt, and in every other region, and whenever the region signal is missing or unrecognized, the tag does not load and no Google Analytics cookie is set. You can also opt out of Google Analytics in any region by installing Google's browser opt-out add-on.
Meta Pixel.We use the Meta Pixel (and, where our CRM confirms a lead or appointment, Meta's Conversions API through our GoHighLevel account) to measure whether Meta advertisements led to visits, opt-ins, booked discovery calls, checkout starts, and course purchases, and to improve the delivery of those advertisements. Where the browser Pixel runs on peptavo.com, Meta may set cookies such as _fbp and, when you arrived from a Meta ad, _fbc, and receives the pages you view on public marketing and checkout surfaces, approximate location derived from your IP address, and broad device and browser information. We do not load the Pixel on the learner dashboard, admin tools, assessment score pages, or other authenticated product surfaces, and we do not send Meta assessment answers, health or clinical information, treatment interests, your name, or your email address from peptavo.com.
If you start Stripe Checkout while the Pixel is running, we send Meta an InitiateCheckout event with the course product identifier and the Stripe Checkout Session reference. If you complete a purchase and return to our success page, we send a Purchaseevent with the amount paid, the currency, the course product identifier, and the Stripe payment reference. Lead and appointment events are sent from GoHighLevel's servers when those actions are confirmed in our CRM, not from assessment or clinical content on peptavo.com.
The Meta Pixel is subject to the same regional gate as the signup funnel cookies and Google Analytics, and the check fails closed: we load it only in regions where our reviewed policy permits notice-based analytics without a prior consent prompt, and in every other region, and whenever the region signal is missing or unrecognized, the tag does not load and no Meta advertising cookie is set from peptavo.com. Meta's use of the information it receives is governed by Meta's Privacy Policy. You can also limit Meta advertising cookies through Meta's ad preferences and through your browser controls.
Marketing and advertising cookies. Apart from the Meta Pixel cookies described above, which we use for advertising measurement and delivery on Meta, we do not set additional advertising or unrelated cross-site tracking cookies on the Services. If we introduce further advertising technologies, we will update this policy and, where applicable law requires it, obtain your consent before setting them.
3. Third-Party Cookies
Certain cookies and similar technologies used in connection with the Services are set or controlled by third parties that provide infrastructure to us, including authentication and database infrastructure through Supabase, hosting and traffic analytics through Vercel, audience analytics through Google Analytics and Ahrefs, and advertising measurement through Meta. Google's use of the information it collects is governed by Google's Privacy Policy, Ahrefs' by Ahrefs' Privacy Policy, and Meta's by Meta's Privacy Policy. We do not load Stripe's scripts on peptavo.com and Stripe sets no cookies on our site. When you pay, we send you to a checkout page hosted by Stripe on Stripe's own domain, where Stripe sets and controls its own cookies under its own policies, and then return you to peptavo.com. We may engage other analytics or infrastructure providers from time to time. Third parties set and control their own cookies independently of us, in accordance with their own privacy and cookie policies, and we do not control, and are not responsible or liable for, how any third party collects, uses, or protects information gathered through its own cookies. We encourage you to review each third party's policies directly, and any interaction you have with a third-party cookie or service is at your own risk.
4. Cookie Duration
Some cookies are session cookies that are automatically deleted when you close your browser, while others are persistent cookies that remain on your device for a set period, or until you delete them, in order to recognize you on return visits. Our referral cookies peptavo_ref and peptavo_gift expire seven days after they are set, and pv_first_touch and pv_latest_touch expire one year after they are set. The Google Analytics cookies described in Section 2 expire two years after your most recent visit, unless you delete them sooner. Meta Pixel cookies such as _fbp typically persist for up to about ninety days, and _fbc when present for up to about ninety days after the Meta ad click that set it, unless you delete them sooner. Authentication cookies last for the life of your signed-in session and are refreshed while you remain active. The specific duration of any other cookie is determined by us or by the applicable third party in our or its sole discretion and may change at any time without notice.
5. Managing and Disabling Cookies
Most browsers allow you to control cookies through their settings, including blocking new cookies, deleting existing cookies, or receiving a warning before a cookie is set, and you can find instructions for doing so in your browser's help documentation. In regions whose law requires prior opt-in consent for non-essential cookies, we do not set our measurement cookies at all, so there is nothing for you to consent to or withdraw. A referral or gift code you arrived with is still stored in those regions, because it is what delivers the discount you asked for by following that link, and it records nothing about your visit beyond the code itself. If we later introduce cookies that require consent in your region, we will request that consent before setting them and will provide a mechanism to withdraw it going forward. You acknowledge and agree, however, that disabling or deleting strictly necessary cookies will prevent you from signing in, completing the Course, or otherwise using core features of the Services, that we bear no responsibility for any loss of access, functionality, or saved progress that results from your browser settings or from your decision to block or delete cookies, and that it is your sole responsibility to manage your browser and device settings as you see fit.
6. Do Not Track
Some browsers offer a "Do Not Track" signal. Because there is no common industry standard for how to interpret such signals, we do not currently respond to them, and your use of the Services after enabling a Do Not Track setting will be treated the same as any other use.
7. Limitation of Liability
TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, WE DISCLAIM ALL LIABILITY ARISING OUT OF OR RELATING TO COOKIES AND SIMILAR TECHNOLOGIES, INCLUDING ANY LOSS OF ACCESS, FUNCTIONALITY, SESSION DATA, OR SAVED COURSE PROGRESS RESULTING FROM YOUR BROWSER OR DEVICE SETTINGS OR FROM YOUR DECISION TO BLOCK OR DELETE COOKIES, AND ANY COLLECTION, USE, OR DISCLOSURE OF INFORMATION BY ANY THIRD PARTY THROUGH ITS OWN COOKIES. Any liability that is not excluded is subject in all respects to the disclaimers, releases, exclusions, aggregate liability cap, and time limit on claims set out in our Terms of Service, which are incorporated into this Cookie Policy by reference.
8. Changes to This Policy
We may update this Cookie Policy at any time and in our sole discretion, including to reflect changes in the cookies or similar technologies we use, changes in our service providers, or changes in applicable law. We will post the updated policy on this page, and your continued use of the Services after any update constitutes your acceptance of the revised policy. It is your responsibility to review this page periodically.
9. Contact Us
If you have questions about this Cookie Policy, contact us at privacy@peptavo.com, or write to:
THE STACK SOURCE LLC, doing business as Peptavo
1908 East 11th Street
Austin, Texas 78702