Local review copy, September 13, 2026. Proposed analytics disclosures await owner review and confirmation of production retention practices. The previously effective version is identified below; this review does not change stored acceptances.
Version 2.0. Effective August 24, 2026.
CPGShield LLC, a Wyoming limited liability company.
For support and full mailing details, see Section 11 below.
Account data. Your email address and a hashed password. If you sign in with Google, we store the Google account identifier; a password hash is stored if you set a password. We store the timestamp of your Terms acceptance and which Terms version you accepted.
Business profile. Brand name, website, product categories, product count, retailers and states you sell in, and similar onboarding details. Required fields are marked in the form. These support your account and the scope of relevant checks; providing a website does not start an automatic website scan.
Label Text you submit. The label text, image, or PDF you paste or upload, and the scan results derived from it. If you upload an image, it is processed to extract text and that extracted text is stored with the scan. If you upload a print-ready PDF, we additionally measure artwork geometry from it.
Ingredient concentrations, if you provide them. Where you enter a concentration for an ingredient, we store it against that label so later scans can use it.
Text you type into workflow features. This includes retailer rejection submissions, feedback and suggestion text together with any contact email you give us there, and the names you enter when assigning a compliance Task. Task assignee names are the one place the Service expects a person's name, and they are yours to enter about your own team.
Billing data. Handled by Stripe. We receive a Stripe customer identifier and a record of what was purchased. We never see or store your card number.
Two-factor data, if you enable it. A TOTP secret and recovery codes.
Technical data. IP address and request metadata appear in standard server logs at the infrastructure layer, and those logs can also contain email addresses and excerpts of feedback text where those were part of a request. We do not write your IP address to an application database record, and specifically we do not store it against your account or against your Terms acceptance. Cloudflare Turnstile, our bot-prevention provider, does receive your IP address at the moment you submit the sign-up or sign-in form, under its own privacy practices, before that form reaches us.
Visitor and product analytics. We record page visits and selected product events, such as starting a scan, using a tool or progressing through a purchase workflow. An identifier stored in browser session storage links events within that tab and renews after 30 minutes of inactivity. Events can be linked to your account when you are signed in. We collect referring-page paths, campaign parameters, basic browser/device categories, request paths, response statuses and timing. Network addresses are stored in analytics only as daily-salted, truncated hashes, not raw IP addresses. We use these records to understand visits, product use and acquisition, and to diagnose errors and abuse. Analytics metadata does not accept label text, ingredient lists or report contents. Not using analytics cookies does not mean that no analytics data is collected.
We do not use your Label Text for any purpose other than providing the Service to you. We do not sell it. We do not share it for marketing. We do not use it to train models.
We treat Label Text, and any formulation information it reveals, as your confidential information.
| Data | Purpose | Basis |
|---|---|---|
| Email, password hash | Create and secure your account | Perform the contract |
| Terms acceptance records | Show which version you agreed to, and when | Legal obligation, contract |
| Label Text | Run the screening you asked for | Perform the contract |
| Business profile | Scope which rules apply to you | Perform the contract |
| Concentrations you enter | Evaluate concentration-dependent rules | Perform the contract |
| Workflow text (rejections, feedback, Tasks) | Provide the feature you used it in | Perform the contract |
| Billing records | Sell and refund credits | Perform the contract |
| Server logs | Security, abuse prevention, rate limiting | Legitimate interest |
| Visitor and product analytics | Understand visits and product use; diagnose errors and abuse | Legitimate interest, subject to owner review of applicable requirements |
CPGShield does not use advertising cookies, analytics cookies, or cross-site tracking cookies.
First-party analytics still uses browser session storage as described above.
Your session is held in a signed token in browser storage, not a cookie.
One cookie is set, and only if you use Google sign-in. It is named cpg_google_oauth_state, is scoped to the sign-in path, is short-lived, is deleted as soon as sign-in completes, and exists solely to bind the sign-in response to the browser that started it, which is a security control against cross-site request forgery.
Cloudflare Turnstile may set its own storage on the sign-in and sign-up forms under Cloudflare's practices, as part of distinguishing a person from a bot.
Each of these receives only what it needs to do its job.
| Subprocessor | What it does | What it receives |
|---|---|---|
| Render | Application hosting and managed PostgreSQL | Everything stored by the Service |
| Stripe | Payment processing | Billing details, direct from you |
| Resend | Transactional email and security alerts | Your email address; a security alert can also carry the IP address of the sign-in that triggered it |
| Cloudflare (Turnstile) | Bot and abuse prevention on sign-up and sign-in | Your IP address and browser signals, at the moment you submit the form |
| Google Cloud Vision | OCR, when you upload a label image | The image you upload |
Notes on two of these:
We may also disclose information if required by law, or to protect the rights and safety of users or the public.
You may request access to your data, correction, deletion, or a portable copy, by emailing support@cpgshield.com. We respond within 30 days.
If you are a California resident, you have the right to know what personal information we collect and why, the right to request deletion, the right to request correction, and the right not to be discriminated against for exercising these rights.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We therefore do not offer a "Do Not Sell or Share" opt out, because there is nothing to opt out of.
This section describes how we handle these requests as a matter of practice. It is not a representation that CPGShield is a "business" as that term is defined by the California Consumer Privacy Act, and we make no statement either way about whether the statute's thresholds are met.
We do not knowingly collect information from anyone under 18. An account requires you to be at least 18, as stated in the Terms of Service.
Passwords are hashed. Sessions can be revoked server-side, and signing out ends your session everywhere, not only on the device you used. Optional two-factor authentication is available. Access to production data is limited.
No system is perfectly secure, and we do not claim otherwise.
This policy carries a version number, shown at the top. When we make a material change we bump that version.
We will post changes here and update the effective date.
support@cpgshield.com
CPGShield LLC, c/o Northwest Registered Agent Service Inc, 30 N Gould St, Ste N, Sheridan, WY 82801, USA