Privacy Policy
Last updated: August 4, 2026
What we collect
Searches are not tied to your identity. If you subscribe, submit the help form or request an evidence snapshot, we store the email you provide, the relevant supplier, any context you enter, your watchlist (supplier names and countries), and billing status received from Gumroad. Secure dashboard access uses one-time email links and an opaque browser session cookie; we store only hashes of those random credentials. We use Google Analytics (GA4) for aggregate usage measurement when enabled. Analytics receives only templated paths (for example, /firm/:supplier), generic page titles and allowlisted attributes such as plan, source category, list status and alert count. Query strings, supplier or company names, EORI values, email, free-text context, sale IDs and watchlists are not sent to GA4.
What we use it for
To operate monitoring (daily checks and alert emails to your address), to respond to help requests, and to improve the product. We do not sell personal data, and we do not send marketing email without your consent.
Where it lives
Account and watchlist data is stored in Upstash (Redis, hosted in the US). Magic-link records expire after 15 minutes and session records after 30 days. Billing evidence records contain provider event or sale references, product, amount, currency, recurrence, subscription reference and lifecycle state. A durable delivery queue records attempts for activation email, analytics and initial watchlist provisioning; it does not store card details. Snapshot request records expire after 180 days; transaction or support records may be retained separately when needed to fulfill the purchase. Short-lived, non-reversible hashes derived from the request address and email are retained for up to one hour to limit automated abuse. When you continue to a Snapshot checkout, we pass your email, server-generated request ID, confirmed FDA firm name and country, and attribution parameters to Gumroad in the secure checkout URL so we can match the payment to your request. Payments are handled entirely by Gumroad — we never see your card details. Transactional email is sent through Resend.
Firm data
The firm names, addresses, and listing statuses shown on the site are from the public, official FDA import alert pages. Requests about that data should be directed to FDA; we re-publish the public record with a source link and timestamp.
Your choices
Email us via the intake form to access or delete your account data. Alert emails stop when paid access ends. We may retain limited billing evidence when required for accounting, fraud prevention, refunds or disputes; lead emails are kept only as long as needed to respond. You can sign out to revoke the current dashboard session.