Privacy policy
Last updated: 24 October 2026
This policy describes what personal information SURGE Pept, a trading name of Mulvix LLC, collects when you visit this website, place an order or contact us; why we collect it; who else processes it; and what you can ask us to do with it.
1. Who is responsible
Mulvix LLC (trading as SURGE Pept)
30 N Gould St Ste R, Sheridan, WY 82801, United States
Email: info@surgepept.com — Phone: +1 307 449 2584
We are the data controller for everything described here.
2. What we collect
- Order details — your name, email address, shipping address, the items
you ordered, the amount, the payment method you chose and, if you press
"I've paid", the moment you did. We need these to perform the contract.
- Payment details — when your payment arrives we see what our bank shows
us: the amount, the reference, and the name and account it came from. If you pay
by card or Apple Pay, that happens on Revolut's payment page; we never see or
store your card number.
- Correspondence — what you write to us by email or through the contact
form, and our reply.
- Technical data — your IP address, browser and the pages you requested,
kept in server logs by our hosting provider for security and troubleshooting. To
stop abuse we also count orders and contact messages per IP address; that counter
expires after one hour.
- The intake, if you send it — in our app you can fill in an intake: your age, height, weight, what you are running into and what you hope to achieve. That is health data. It stays on your own device unless you tick the box that explicitly asks us to look at it with you. Only then does it reach us, together with the email address you give so we can reply. We keep it for 180 days and then it is deleted automatically; ask us and we remove it sooner. We rely on your explicit consent for this, and you can withdraw that at any time by emailing us. We never use it for advertising and we never pass it on.
3. What stays on your own device
Your shopping cart lives in your browser's local storage, not on our servers. We do not see it until you place your order. We also store your country code, read once from our hosting provider, so that the free-shipping threshold shown is the one that actually applies to you, and — once you press "I've paid" — a note that you did, so the page shows the right step when you come back. Clearing your browser data removes all of it.
After you order, the address of your checkout page contains a private key. Anyone with that link can see your order number, the items, the amount and our payment details — not your name, address or email. Keep the link to yourself.
If you fill in the intake in our app, your answers are kept in your browser's local storage and nowhere else. They are sent to us only if you tick the box that asks for it. Clearing your browser data removes them, and starting the intake again replaces them.
We do not use advertising cookies, we do not run third-party tracking pixels, and we do not build profiles for targeted advertising.
We measure visits with Cloudflare Web Analytics. It counts page views, referrers and countries in aggregate. It sets no cookies, stores no identifiers on your device, and cannot recognise you across websites or across visits.
4. Who else processes your data
- Cloudflare, Inc. — hosting of this website and storage of order
records. Processes technical data (IP address, request logs) and your order details.
- Resend — our email provider, for order confirmations, shipping updates
and replies.
- Couriers — the name and address needed to deliver your parcel.
Each of these acts on our instructions under a written agreement. We do not sell your personal information, and we do not share it with advertising partners.
When you pay, Revolut (and, for a bank transfer, your own bank) processes the payment. They do so as independent controllers under their own privacy policies and financial regulations, not on our behalf.
5. How long we keep it
Order and payment records are kept as long as tax and accounting law requires. An order that is never paid carries no such obligation: we remove it, and you can ask us to delete yours at any time. Correspondence is kept for two years. Server logs are kept for a short period by the hosting provider. Anything else is deleted or anonymised within twelve months of a request, unless we must keep it for a legal reason.
6. Your rights
Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to someone else. You may also object to processing based on our legitimate interests. Email info@surgepept.com and we answer within one month. We will not treat you differently for asking.
7. International transfers
We are established in the United States and our providers may process data outside the country you live in. Where data leaves the European Economic Area or the United Kingdom, the transfer rests on the European Commission's Standard Contractual Clauses or an equivalent mechanism.
8. Children
This store is not intended for anyone under 18 and we do not knowingly collect information about children. If you believe a child has given us their data, email us and we will delete it.
9. Security
The site is served over HTTPS. Payment happens in your own banking app or on Revolut's payment page; card details never pass through our systems. No system is perfect; please do not send sensitive information to us by plain email.
10. Complaints
If you think we have handled your personal information incorrectly, tell us first — most things are settled faster that way. You may also complain to the supervisory authority where you live or work. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
11. Changes
We may update this policy. The date at the top says when it last changed.