Privacy Policy

Last updated: May 16, 2026

This Privacy Policy explains how Gerim-Sterling LLC collects, uses, stores, and protects information when you use IngredientCompliance at ingredientcompliance.com ("the Service"). By using the Service, you consent to the practices described here.

1. Who We Are

Gerim-Sterling LLC ("we," "us," "our") operates IngredientCompliance. We are incorporated in the State of Texas, United States. For privacy inquiries, contact [email protected].

2. What We Collect and Why

Account data (registered users only): Email address and display name provided via Google OAuth. We collect this solely to authenticate you and associate your access tier with your account. We do not collect your Google password.

Usage data: Ingredient check queries, timestamps, and feature usage counts — used for rate limiting, abuse prevention, and service improvement. We do not permanently store individual ingredient query text beyond what is needed for rate-limit enforcement (max 90 days). Uploaded PDF or Excel files are processed in memory and are never written to permanent storage.

Payment data: We do not collect, store, or have access to your credit card number, bank account, or full financial details. Payments are processed entirely by PayPal. We receive only: payment confirmation status, PayPal transaction ID, payer email address (for receipt), and report tier purchased.

Cookies: We use strictly necessary cookies for authentication (session cookie, HttpOnly, Secure, SameSite=Lax) and anonymous usage gating (checks_used, 1-year TTL). We do not use tracking, advertising, or behavioral profiling cookies of our own. Google AdSense may set cookies on free-tier pages (see Section 6).

Log data: Standard server logs (IP address, browser user-agent, request path, timestamp) are retained for 90 days for security and debugging, then purged. IP addresses are not used for behavioral targeting.

3. How We Use Your Data

We use collected data only for:

  • Authenticating your account and managing your access tier
  • Processing payments and delivering paid report access
  • Sending transactional emails (payment receipts only)
  • Enforcing rate limits and preventing abuse
  • Improving and debugging the Service
  • Complying with legal obligations

We do not: sell your personal data. Share your ingredient queries with third parties. Use your data for advertising profiling. Send marketing emails without your explicit consent. Use your data to train AI or machine learning models.

4. Data Retention

Account data: Retained while your account is active. Upon request, deleted within 30 days of account closure.

Usage logs: Retained for 90 days for rate-limiting and abuse prevention, then purged automatically.

Payment records: Retained for 7 years as required by U.S. tax law. These records contain only transaction ID, amount, tier, and payer email — not full payment credentials.

Anonymous cookies: Expire after 48 hours (usage gate cookies) or end of session (CSRF tokens).

5. Security

We implement industry-standard security measures including: HTTPS/TLS for all connections (enforced via Cloudflare), HttpOnly and Secure cookie flags, CSRF token protection on all state-changing endpoints, rate limiting on authentication and check endpoints, and server-side session validation. Passwords are not stored — authentication is delegated to Google OAuth. No system is 100% secure; we cannot guarantee absolute security of data in transit or at rest.

6. Third-Party Services

PayPal: Processes all payments. Your payment data is governed by PayPal's Privacy Policy. We do not see or store your full payment credentials.

Google OAuth: Used for account sign-in. Governed by Google's Privacy Policy. We request only your email address and public profile name. We do not access your Google Drive, Gmail, or other Google services.

Google AdSense (free-tier pages only): Advertising shown on free-tier pages may set cookies per Google's Ad Policies. Paid-account pages are ad-free.

Cloudflare: CDN, DDoS protection, and SSL termination. Cloudflare may log request metadata per their privacy policy.

We do not use analytics services (Google Analytics, Mixpanel, Segment, etc.) and do not share usage data with advertising networks beyond what Google AdSense sets on free-tier pages.

7. Your Rights

You may at any time:

  • Access: Request a copy of the personal data we hold about you
  • Correct: Request correction of inaccurate data
  • Delete: Request deletion of your account and associated personal data
  • Restrict: Request that we limit processing of your data
  • Object: Object to processing based on legitimate interests

To exercise these rights, email [email protected]. We will respond within 30 days. Note: deletion requests do not apply to data we are required by law to retain (e.g., payment records for tax purposes).

8. CCPA — California Residents

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to: (1) know what personal information is collected and how it is used; (2) delete personal information; (3) opt out of the sale or sharing of personal information — we do not sell or share personal information for advertising purposes; (4) non-discrimination for exercising CCPA rights; and (5) correct inaccurate personal information. To exercise any right, email [email protected] with subject line "CCPA Request."

9. GDPR — EEA and UK Residents

If you are located in the European Economic Area or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR, including the right to data portability and the right to lodge a complaint with your local supervisory authority. Our lawful basis for processing is: contract performance (for paid accounts), legitimate interests (for rate limiting and abuse prevention), and consent (for any optional data). We do not transfer personal data outside the U.S. except as necessary to operate the Service via Cloudflare and Google OAuth infrastructure.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child has provided us personal data, contact us immediately at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via email to registered users at least 7 days before taking effect. Your continued use of the Service after changes are posted constitutes acceptance.

12. Contact

Privacy questions or requests? Contact [email protected]. We aim to respond within 5 business days. Gerim-Sterling LLC, Harris County, Texas, United States.

Legal Disclaimer

This service is provided "AS IS" without warranties of any kind. Regulatory data is for reference only and does not constitute legal or regulatory advice. Always consult a qualified attorney or regulatory consultant before making compliance decisions. Not affiliated with the U.S. Food and Drug Administration (FDA) or any government agency. IngredientCompliance is an independent tool operated by Gerim-Sterling LLC. © 2026 Gerim-Sterling LLC.

Dispute Resolution — Binding Arbitration: By using this service, you agree that any dispute, claim, or controversy arising out of or relating to these terms or the use of this service shall be resolved exclusively through final and binding individual arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules, and not in any court. You waive any right to participate in a class action lawsuit or class-wide arbitration. Arbitration shall be conducted remotely via video conference under AAA's Consumer Arbitration Rules, with no required physical appearance. This clause does not prevent either party from seeking emergency injunctive relief in a court of competent jurisdiction where necessary to prevent irreparable harm.