Version 2.0. Effective [PUBLICATION DATE].
CPGShield LLC, a Wyoming limited liability company.
c/o Northwest Registered Agent Service Inc, 30 N Gould St, Ste N, Sheridan, WY 82801, USA support@cpgshield.com
Account data. Your email address and a hashed password. If you sign in with Google, we store the Google account identifier instead of a password. We store the timestamp of your Terms acceptance and which Terms version you accepted, and the same for this Privacy Policy. acct
Business profile, optional. Brand name, product categories, SKU count, retailers you sell to, states you sell in, and similar details you choose to provide, used to scope which rules run on your scans.
Label Text you submit. The label text, image, or PDF you paste or upload, and the scan results derived from it. If you upload an image, it is processed to extract text and that extracted text is stored with the scan. If you upload a print-ready PDF, we additionally measure artwork geometry from it.
Ingredient concentrations, if you provide them. Where you enter a concentration for an ingredient, we store it against that label so later scans can use it.
Text you type into workflow features. This includes retailer rejection submissions, feedback and suggestion text together with any contact email you give us there, and the names you enter when assigning a compliance Task. Task assignee names are the one place the Service expects a person's name, and they are yours to enter about your own team.
Billing data. Handled by Stripe. We receive a Stripe customer identifier and a record of what was purchased. We never see or store your card number. stripe
Two-factor data, if you enable it. A TOTP secret and recovery codes. totp
Technical data. IP address and request metadata appear in standard server logs at the infrastructure layer, and those logs can also contain email addresses and excerpts of feedback text where those were part of a request. We do not write your IP address to an application database record, and specifically we do not store it against your account or against your Terms acceptance. Cloudflare Turnstile, our bot-prevention provider, does receive your IP address at the moment you submit the sign-up or sign-in form, under its own privacy practices, before that form reaches us. ip
We do not use your Label Text for any purpose other than providing the Service to you. We do not sell it. We do not share it for marketing. We do not use it to train models.
We treat Label Text, and any formulation information it reveals, as your confidential information.
| Data | Purpose | Basis |
|---|---|---|
| Email, password hash | Create and secure your account | Perform the contract |
| Terms and Privacy acceptance records | Show which versions you agreed to, and when | Legal obligation, contract |
| Label Text | Run the screening you asked for | Perform the contract |
| Business profile | Scope which rules apply to you | Perform the contract |
| Concentrations you enter | Evaluate concentration-dependent rules | Perform the contract |
| Workflow text (rejections, feedback, Tasks) | Provide the feature you used it in | Perform the contract |
| Billing records | Sell and refund credits | Perform the contract |
| Server logs | Security, abuse prevention, rate limiting | Legitimate interest |
CPGShield does not use advertising cookies, analytics cookies, or cross-site tracking cookies.
Your session is held in a signed token in browser storage, not a cookie.
One cookie is set, and only if you use Google sign-in. It is named cpg_google_oauth_state, is scoped to the sign-in path, is short-lived, is deleted as soon as sign-in completes, and exists solely to bind the sign-in response to the browser that started it, which is a security control against cross-site request forgery. cookie
Cloudflare Turnstile may set its own storage on the sign-in and sign-up forms under Cloudflare's practices, as part of distinguishing a person from a bot.
Each of these receives only what it needs to do its job.
| Subprocessor | What it does | What it receives |
|---|---|---|
| Render | Application hosting and managed PostgreSQL | Everything stored by the Service |
| Stripe | Payment processing | Billing details, direct from you |
| Resend | Transactional email and security alerts | Your email address; a security alert can also carry the IP address of the sign-in that triggered it |
| Cloudflare (Turnstile) | Bot and abuse prevention on sign-up and sign-in | Your IP address and browser signals, at the moment you submit the form |
| Google Cloud Vision | OCR, when you upload a label image | The image you upload |
| Anthropic (Claude API) | Optional AI claim review | The complete label text you submitted, including the ingredient declaration, only if you opt in on that scan |
Notes on three of these:
We may also disclose information if required by law, or to protect the rights and safety of users or the public.
You may request access to your data, correction, deletion, or a portable copy, by emailing support@cpgshield.com. We respond within 30 days.
If you are a California resident, you have the right to know what personal information we collect and why, the right to request deletion, the right to request correction, and the right not to be discriminated against for exercising these rights.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We therefore do not offer a "Do Not Sell or Share" opt out, because there is nothing to opt out of.
This section describes how we handle these requests as a matter of practice. It is not a representation that CPGShield is a "business" as that term is defined by the California Consumer Privacy Act, and we make no statement either way about whether the statute's thresholds are met.
We do not knowingly collect information from anyone under 18. An account requires you to be at least 18, as stated in the Terms of Service.
Passwords are hashed. Sessions can be revoked server-side, and signing out ends your session everywhere, not only on the device you used. Optional two-factor authentication is available. Access to production data is limited.
No system is perfectly secure, and we do not claim otherwise.
This policy carries a version number, shown at the top. When we make a material change we bump that version and record which version you were shown and when.
We will post changes here and update the effective date.
support@cpgshield.com
CPGShield LLC, c/o Northwest Registered Agent Service Inc, 30 N Gould St, Ste N, Sheridan, WY 82801, USA
acct users table columns verified against the live SQLite schema: email, hashed_password, email_verified, created_at, accepted_terms_at, terms_version, google_sub, plus plan and credit fields. The per-user privacy acceptance columns are proposed and not yet applied; see the publish checklist.
stripe billing.py uses Stripe Checkout. No card number field exists anywhere in the schema.
totp users.totp_secret, totp_enabled, totp_recovery_codes_json, totp_last_step.
ip crud.create_user writes no IP. No IP column exists on users. _client_address() is used for rate limiting and for an in-memory security-alert counter that resets on restart and is never persisted. Turnstile receives remoteip at human_verification.py.
cookie main.py, _GOOGLE_STATE_COOKIE = "cpg_google_oauth_state", set on the Google auth path and deleted on completion, timeout, and failure.
ai semantic_claims.py. The scan request carries an explicit per-scan opt-in flag that defaults to off and is not persisted to the account.
ocr Google Cloud Vision is primary; Tesseract is the local fallback.