Privacy Policy — CEL Ingredients

1. Introduction and Scope

This Privacy Policy explains how Chem Eco Luxe LLC, a Michigan limited liability company ("Company," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information in connection with the CEL Ingredients application and website at celingredients.app (the "App"). It applies to visitors, account holders, and paying subscribers. It does not apply to third-party sites we link to. By using the App you acknowledge this Policy; where consent is required by law, we will obtain it separately.

2. Information We Collect

We collect only what is needed to run the App. Categories of personal information collected in the past 12 months:

• Identifiers and account data: email address, name, hashed authentication credentials or federated sign-in identifiers, and account settings
• Commercial and billing data: subscription plan, billing cycle, subscription status, invoice and payment history, and payment processor customer and subscription identifiers. Full payment card numbers are collected and stored by Stripe, Inc. and are never received or stored by us
• Business inventory content you submit: ingredient and supply names, INCI names, photographs, lot numbers, SKUs, expiration dates, supplier names, Certificates of Analysis and other uploaded documents, quantities, thresholds, stock movement history, and notes
• Communications data: alert recipient email addresses you designate, lot records you email to recipients, support messages, and questions you type into the in-app AI assistant
• Technical and usage data: IP address, device and browser type, timestamps, pages viewed, feature interactions, and error and security logs
• Cookies and local storage: session and authentication tokens, theme and display preferences

We do not intentionally collect Social Security numbers, financial account numbers, precise geolocation, biometric identifiers, health information, or other categories treated as sensitive personal information under state law. Please do not upload them.

3. Sources of Information

We obtain information directly from you when you register, upload records, configure alerts, contact support, or subscribe; automatically from your device when you use the App; and from service providers such as our authentication provider and payment processor (for example, subscription status and payment outcomes).

4. How and Why We Use Information

We use personal information for the following business and commercial purposes:

• Providing, maintaining, and securing the inventory, supplies, export, PDF, and sharing features you request
• Processing and extracting structured data from uploaded label photos and CoA documents, and answering questions in the in-app assistant, using AI services
• Sending transactional messages: low-stock and expiry alerts, lot record shares you initiate, password resets, security notices, and billing receipts
• Processing subscriptions, payments, renewals, cancellations, and refunds, and detecting and preventing fraud and abuse
• Diagnosing errors, monitoring performance and reliability, and improving features
• Complying with legal obligations and enforcing our Terms of Use

We do not use your inventory content or uploaded documents to train our own or any third party's general-purpose AI models.

5. No Sale or Sharing; No Targeted Advertising

We do not sell personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act, as amended by the CPRA, or comparable state laws. We do not serve targeted advertising in the App, and we have not sold or shared personal information in the preceding 12 months, including information of any consumer we know to be under 16.

6. AI Processing of Uploaded Content

Label photos, CoA files, INCI lookup queries, and assistant messages may be transmitted to AI service providers to extract structured data or generate responses. These providers act as our service providers and are contractually restricted to processing the content on our behalf for the purpose we specify; they are not permitted to retain it for their own purposes or to use it for model training. AI outputs are estimates and may be inaccurate — verify assay values, expiry dates, lot numbers, and INCI names against the original documents before relying on them.

7. Disclosure of Information

We disclose personal information only as described here:

• Service providers and processors: cloud hosting, managed database and file storage, authentication, AI processing, transactional email delivery, and payment processing, each bound by contract to protect the information and use it only for our instructions
• Recipients you designate: alert recipients and people you email a lot record link to receive the content you choose to send
• Legal and safety disclosures: to comply with a law, subpoena, court order, or lawful government request, or to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of any person
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy or an equivalent successor policy

We do not disclose your personal information to third parties for their own independent marketing purposes.

8. Data Storage, Security and Access Controls

Your data is stored with reputable cloud providers in the United States. We use encryption in transit (TLS) and at rest, row-level database access rules that scope records to your account, scoped and time-limited links for shared files, hashed credentials, rate limiting on sensitive endpoints, and least-privilege administrative access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach of security affecting your unencrypted personal information, we will notify you and applicable regulators as required by state breach-notification laws and other applicable law, without unreasonable delay.

9. Data Retention

We keep account and inventory data for as long as your account remains active. You may delete individual ingredient, supply, alert, and movement records at any time in the App. When you delete your account, we permanently delete your inventory, supplies, movement history, alert recipients, profile, subscription record, and stored photos, CoA files, and lot PDFs, and we cancel any active subscription. Residual copies may persist in encrypted routine backups for a limited period before being overwritten. We retain a minimal set of transaction and tax records as required by law, and security logs for a limited period for fraud prevention.

10. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal information:

• Know and access: request the categories and specific pieces of personal information we hold about you
• Correct: request correction of inaccurate personal information
• Delete: request deletion of your personal information, subject to legal exceptions
• Portability: receive a copy in a portable, machine-readable format — you can also self-serve this from the Export screen at any time
• Opt out: of sale, sharing, targeted advertising, and profiling with legal effects — we do not engage in these activities
• Limit use of sensitive personal information — we do not collect it for purposes requiring this right
• Non-discrimination: we will not deny service, charge different prices, or provide a different level of service because you exercised a privacy right
• Appeal: if we deny a request, you may appeal by replying to our decision; residents of some states may also contact their state attorney general

To exercise these rights, use the in-app tools or email us at the address below. We will verify your request through your account email and respond within 45 days, with one 45-day extension where permitted. An authorized agent may submit a request on your behalf with written permission and verification.

11. Cookies, Local Storage and Do Not Track

We use strictly necessary cookies and browser local storage to keep you signed in, protect against forgery, and remember preferences such as light or dark theme. We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, but sign-in and some features will stop working. Because there is no common industry standard for interpreting them, we do not currently respond to browser Do Not Track signals; we do honor recognized opt-out preference signals where required by law, though we do not sell or share personal information in any event.

12. Email Communications

Transactional emails — alerts you configure, lot records you send, password resets, security notices, and billing receipts — are part of the service and are not marketing. If we send promotional email, it will identify us, include our postal contact, and provide a one-click unsubscribe honored promptly, in accordance with the CAN-SPAM Act, 15 U.S.C. §§ 7701–7713. You can stop all messages by disabling alerts or deleting your account. Before adding another person as an alert or share recipient, confirm that they expect to receive those messages from you.

13. Children's Privacy

The App is a business tool intended for users 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 13, consistent with the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and we do not knowingly collect information from users under 18. If we learn we have collected such information, we will delete it promptly. Parents or guardians who believe a child provided us information should contact us at the address below.

14. Confidentiality of Business Information

Much of what you store — supplier names, formulation inputs, CoAs, and lot histories — is your confidential business information rather than personal information. We treat it as confidential, restrict internal access to personnel who need it to operate or support the App, and do not disclose it except as described in this Policy or as you direct.

15. International Users and Data Transfers

The App is operated from and hosted in the United States. If you access it from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where an applicable law requires a lawful transfer mechanism or additional rights, we will provide them as required.

16. Third-Party Links and Services

The App may link to third-party websites and relies on third-party providers. Their privacy practices are governed by their own policies, and we are not responsible for them. Review those policies before providing information to them.

17. Changes to This Privacy Policy

We may update this Privacy Policy as the App or the law changes. We will update the "Last Updated" date and, for material changes, provide advance notice by email or prominent in-app notice before the change takes effect. Continued use after the effective date means you accept the revised Policy.

18. Contact Us

Chem Eco Luxe LLC, a Michigan limited liability company, is the controller of the personal information described here. Privacy questions, rights requests, and appeals can be sent to: chemecoluxe@gmail.com