Plain-language privacy.

• Account info — email, hashed password, store domain. Used to log you in and bill you.
• Catalog data — product titles, URLs, descriptions, ingredient lists you publish on your storefront. We crawl what you've already made public on your website.
• Usage telemetry — counts of widget loads, scans run, refunds prevented (if you opt in to share). No personally identifiable information.

Almost nothing. The pet profile lives in the shopper's browser (localStorage) by default — pet name, species, listed allergies. None of it touches our servers unless the shopper explicitly creates a Chompick account.

We do log anonymous events: which product was viewed, which verdict was shown, which CTA was clicked. None of these are tied to a person.

• Shopper email or phone, unless they sign in.
• Payment data — Stripe handles billing and never gives us card numbers.
• Veterinary records, prescriptions, medical history.
• Geolocation, IP-tracking for advertising, third-party ad cookies.

Our servers run in the EU (Railway, Frankfurt region). The Postgres database, Redis queue, and worker processes all sit there. Backups are encrypted at rest. We don't ship customer data to any third-party analytics or AI training pipeline.

We use OpenAI's API to identify allergens in product ingredient lists. Per OpenAI's API policy, none of that input is used to train their models.

• Export — email hello@chompick.com and we'll send a JSON dump of everything we have on your account within 7 days.
• Delete — same email; we wipe your account and catalog within 7 days. Anonymous aggregates may persist.
• Withdraw consent — uninstall the widget snippet. The shopper-side data lives on their device anyway.

If we materially change what we collect, we'll email every active account at least 30 days before. No sneaky updates.