Privacy policy
Last updated: 22 October 2026
This policy explains what Cerience collects when you use this site, why, and what you can do about it. We follow the EU General Data Protection Regulation (GDPR).
What we collect
- Accounts: your email address, your name, a hashed version of your password (never the password itself), when you confirmed your email and when you accepted the research-use notice.
- Store claims: which store you claimed, the proof method you chose, the email address at the store’s domain you gave us, and the DNS verification token.
- Reviews: the name or alias you choose, your email address, your rating and your review. Your email is never shown publicly.
- COA verifier: we read the file you upload in memory and never save it. We keep a fingerprint of the file (a SHA-256 hash), the report ID and lab name if you entered them or we found them in the file, and the result of the check. The fingerprint lets us spot the same COA turning up under different stores.
- Community lab tests: which tests you joined, your slot status and when you joined.
- Searches: what you searched for, how many results it returned, the site language, where your visit first came from, and the visitor ID described below.
- Clicks to stores: which store, the page you clicked from, where your visit first came from (referring site, landing page and campaign tags) and the visitor ID. We also count profile views and code copies per store per day, without any information about you.
- Google Analytics: on public pages we use Google Analytics 4, loaded through Google Tag Manager, to see how the site is used. Google receives technical data such as your IP address, browser and the pages you view, and sets its own cookies.
Cookies
Besides Google’s cookies, we set these first-party cookies:
- ps_vid — a random visitor ID, kept for 1 year. It lets us count unique visitors and link a search to a later store click.
- ps_attr — where your first visit came from: the referring site, the landing page and any campaign (UTM) tags. Kept for 1 year.
- Sign-in cookies — keep you signed in, for up to 30 days.
We use ps_vid and ps_attr to measure which pages send visitors to stores. You can block or delete cookies in your browser; the site still works without them.
Why we use it
- To run your account and sign-in, and to send the emails you asked for: confirmation and password-reset links, claim updates and lab-test updates.
- To check that you run a store before you can manage its profile.
- To publish and moderate reviews, and to spot recycled COAs across stores.
- To understand which pages are useful and which send visitors to stores, so we can improve the site. Links to stores carry our name as a campaign tag, so stores can see the visit came from us — no personal data is included.
Who processes it
- Google — Analytics 4 and Tag Manager.
- Resend — sends our emails (your email address and the message).
- Railway — hosts the site and the database where everything above is stored.
Some of these providers are based outside the EU. We don’t sell your data.
How long we keep it
- Email confirmation links expire after 24 hours, and password reset links after 1 hour.
- The ps_vid and ps_attr cookies expire after 1 year.
- Everything else we keep while your account or the related store profile is active, and we delete it when you ask.
Your rights
Under the GDPR you can ask us to:
- show you the data we hold about you;
- correct it;
- delete it;
- stop using it, including for analytics.
You can also complain to the data-protection authority in your country.
Contact
Email [email protected] with any privacy question or request.