What we collect, and what we deliberately do not.

The badge does not watch shoppers

A brand can place a verification badge on its own storefront. When that badge renders, or someone opens it, our servers add one to a counter. The counter belongs to the product, not to a person.

We do not store an IP address, a cookie, a device identifier or any other visitor identifier alongside those events. There is nothing in that record that could be traced back to an individual shopper, because nothing identifying is ever written. A brand reading its own dashboard sees how many times a badge was seen and opened, and never who saw it.

What a brand gives us

A brand that submits a formula gives us the things needed to review it: the product, its label or listing, its ingredient declarations, and any certificate of analysis it chooses to upload. We keep those to produce and support the verification record.

An account carries the contact details needed to run it, which means a working email address and the store it belongs to. There is one login per brand. We do not operate seats or send invitations, so we hold no data about a brand employee who never signed up.

Payments

Subscriptions are billed through Shopify. Card numbers and payment credentials go to Shopify and never reach our systems, so we cannot store, see or leak them. What we keep is the plan a brand is on and whether it is active.

Visitors to this site

Reading ingredient pages, the registry or a public record requires no account and no sign-in. We use aggregate analytics to understand which pages are useful, and we do not sell data about visitors to anyone.

What we do not do

Some of this is worth stating plainly, because the absence is the point.

• We do not sell personal data.
• We do not build advertising profiles, and we run no advertising on the public record.
• We do not identify the shoppers who see a brand badge, to that brand or to anyone else.
• We do not let a paid plan change what a verification says. That is a product rule, and it is also why we have little reason to collect more than we do.

Keeping and removing data

We keep a verification record for as long as it is published, because a public record that silently disappears is not a record. A brand can unpublish, and can ask us to delete the account data behind it.

Ask us to delete something and we will, except where we are required to keep it. We will say plainly which category anything falls into rather than refusing without a reason.

Your rights

Depending on where you live you may have the right to see the data we hold about you, correct it, take it elsewhere, or have it deleted. Write to us and we will act on it. You do not need to cite a regulation to be taken seriously.

Changes

When this page changes materially we will update the date at the top and, for anything that affects a brand account, tell the account directly rather than relying on someone re-reading this page.