What we collect, and what we deliberately do not.

The badge does not watch shoppers

A brand can place a verification badge on its own storefront. When that badge renders, or someone opens it, our servers add one to a counter. The counter belongs to the product, not to a person.

We do not store an IP address, a cookie, a device identifier or any other visitor identifier alongside those events. There is nothing in that record that could be traced back to an individual shopper, because nothing identifying is ever written. A brand reading its own dashboard sees how many times a badge was seen and opened, and never who saw it.

What a brand gives us

A brand that submits a formula gives us the things needed to review it: the product, its label or listing, its ingredient declarations, and any certificate of analysis it chooses to upload. We keep those to produce and support the verification record.

An account carries the contact details needed to run it, which means a working email address and the store it belongs to. There is one login per brand. We do not operate seats or send invitations, so we hold no data about a brand employee who never signed up.

The Shopify app

When a store installs IngredientMD Verified, Shopify gives us the store's address, its name and its contact email, and an access token that lets the app work with the store's products. We keep the token encrypted and use the email to run the account and to tell the store what the app has done.

The app reads the products a store chooses to verify: their titles, their handles and their images, so it can find the Supplement Facts photo. To read that photo we send it to Google's Gemini model, which returns the rows it reads; the store confirms them. The app writes three small fields to each verified product (the badge's token, which badge script to load, and the badge's structured data) and changes nothing else on the store.

Order counts are off until a store turns them on in Analytics and approves the extra permission. Then we read the products and quantities of each new order to count how many orders included a verified product that day. We store the daily counts only: never a customer's name, email, address or phone, and never the order itself.

When a store removes the app

Uninstalling stops the badges on the storefront and deletes the access token at once. Forty-eight hours later Shopify asks us to erase the store's data, and we remove the store's email, name and token from our records. We keep the store's verification records and its product links, so a store that reinstalls finds its work where it left it, and the public verification pages stay at their addresses. Ask us and we delete those too.

The services that process this data for us are Shopify, Vercel (hosting), Google Cloud and Firebase (storage and the label read) and Resend (email).

Payments

Subscriptions are billed through Shopify. Card numbers and payment credentials go to Shopify and never reach our systems, so we cannot store, see or leak them. What we keep is the plan a brand is on and whether it is active.

Visitors to this site

Reading ingredient pages, the registry or a public record requires no account and no sign-in. We use aggregate analytics to understand which pages are useful, and we do not sell data about visitors to anyone.

What we do not do

Some of this is worth stating plainly, because the absence is the point.

• We do not sell personal data.
• We do not build advertising profiles, and we run no advertising on the public record.
• We do not identify the shoppers who see a brand badge, to that brand or to anyone else.
• We do not let a paid plan change what a verification says. That is a product rule, and it is also why we have little reason to collect more than we do.

Keeping and removing data

We keep a verification record for as long as it is published, because a public record that silently disappears is not a record. A brand can unpublish, and can ask us to delete the account data behind it.

Ask us to delete something and we will, except where we are required to keep it. We will say plainly which category anything falls into rather than refusing without a reason.

Your rights

Depending on where you live you may have the right to see the data we hold about you, correct it, take it elsewhere, or have it deleted. Write to us and we will act on it. You do not need to cite a regulation to be taken seriously.

Changes

When this page changes materially we will update the date at the top and, for anything that affects a brand account, tell the account directly rather than relying on someone re-reading this page.