DRAFT draft-2026-10-17. Not in force. To be reviewed by a lawyer (US state privacy laws, Canada PIPEDA). Placeholders in [brackets].

Privacy policy

What we collect

• Account details: your email address, business name, a hashed password (we never store your password itself), when you accepted our terms.
• Pages you ask us to check: page addresses, your notes, screenshots and copies of those public pages, the prices and fees shown, and timestamps. These pages are about your business; our scanner does not type any details into them. If a page happens to display a person's name (for example a review), it may appear in a screenshot; we can blur it on request.
• Capture mode (optional): if you use our browser extension, each time you click Capture it sends us the page address and title, the visible text, any text you selected, and a screenshot of what is on your screen in that tab. It never sends what you type into forms or your browsing history, and reads nothing unless you click. A screenshot can show anything visible in that tab (for example your name if you are signed in), so capture before entering personal details. The extension keeps your connection code and unsent captures on your computer only.
• Booking-system connection (optional): if you connect Hostaway, Guesty or Lodgify, we keep the API key you give us, encrypted, and use it only to read your listings and request price quotes for the listings you choose; we never create, change or cancel reservations. We keep the system's quote answers as evidence. Disconnecting deletes the key.
• Website verification: the code we give you to prove you control your website, and when it was checked.
• Emails we send you: a copy of each email (subject and text) and when it was sent, so we can show what was sent.
• Billing: handled by Stripe. We receive your plan, payment status and a Stripe customer reference, never your card number. Stripe's payment page sets its own cookies under Stripe's privacy policy.
• Technical data: a session cookie that keeps you signed in. Your IP address is used briefly, in memory only, to limit repeated sign-in attempts; our server does not keep a log of visitors' IP addresses. Error logs, kept for a limited time, record technical errors but not your IP address. No advertising, analytics or tracking cookies.

For research (for example, how often checkouts change), we may also look at public booking pages of businesses that are not our customers, the way a shopper would. These pages describe businesses and their prices, not individuals; we publish only aggregate results and do not name the businesses.

The Service is for businesses and is not directed to children.

Why we use it

To provide the Service, prepare and verify reports, bill you, keep records that show what a page displayed on a date, keep the Service secure, and contact you about your account. We do not sell personal information and do not use it for advertising.

Who we share it with

Our hosting provider (netcup GmbH, servers in Germany; network: Cloudflare, Inc.), our payment processor (Stripe), and our email provider (Zoho Corporation (Zoho Mail and ZeptoMail)). Your data is stored on our servers in Germany and may also be processed in the United States and other countries where these providers operate. We share reports only with you, or with others if you ask us to.

How long we keep it

Account data while your account is open; when you close your account we delete it, together with your checkouts and scan records, within 30 days. Otherwise scan records are deleted automatically 3 years after the scan. Backups are overwritten within 14 days (database) and 4 weeks (evidence files). We keep billing records as long as tax law requires.

Your choices and rights

You can ask to see, correct or delete your information, or close your account, by writing to [email protected]. Depending on where you live (for example California, Canada), you may have additional rights; we will honour them.

Security

Passwords are hashed with scrypt, sessions use random tokens over encrypted connections, sign-in attempts are limited, and evidence files are fingerprinted so changes are detectable. No system is perfectly secure; we will notify you of a breach affecting your information as the law requires.

Who is responsible

Ingot Supply, LLC is responsible for your information. Questions, requests and complaints go to the person in charge of privacy at [email protected]. If you are in Canada, you can also contact the Office of the Privacy Commissioner of Canada. The Service is not yet offered to businesses in Quebec.

Contact

Ingot Supply, LLC · [email protected] · 2108 N Street, STE N, Sacramento, CA 95816, USA