Privacy Policy

1. Who we are

InciSights is operated by [[LEGAL ENTITY NAME]], [[registered address]]. For any privacy question, contact [[privacy@yourdomain]].

2. What we collect

We collect only what the service needs to function:

• Account data. If you sign in with Google, we receive your email address, display name, and whether that email is verified. We do not receive your Google password, contacts, or any other Google data.
• Your watchlist. The ingredients, brands, factories and materials you choose to track.
• Usage records. Which reports you open and when, used to enforce plan limits and to improve the product.

We do not collect payment information. Online checkout is not part of this service today; plan changes are handled manually.

3. Cookies and local storage

We set a single short-lived cookie (is_oauth_state, 10 minutes) during Google sign-in to protect against cross-site request forgery. Your session token is kept in your browser's local storage, not in a cookie, and is removed when you sign out. We do not use advertising or third-party analytics trackers.

4. Where the market data comes from

The product, brand, factory and ingredient information shown on InciSights is derived from cosmetics filings published by China's National Medical Products Administration (NMPA) and other public regulatory sources. It is not personal data about you, and your account activity is never mixed into it.

5. How we use your data

• To operate your account and show the items you track
• To apply the limits of your plan
• To diagnose faults and improve the service

We do not sell your personal data, and we do not share it with third parties for their own marketing.

6. Retention

Account and watchlist data are kept while your account is active. Usage records are kept for [[retention period]]. You may request deletion at any time (see §8).

7. Where data is processed

The service runs on cloud infrastructure located in [[hosting region(s)]]. Files associated with your account may be stored in object storage located in [[storage region]]. If you access the service from another country, your data will be transferred to and processed in those locations.

8. Your rights

You may request access to, correction of, or deletion of your personal data, and you may withdraw consent for Google sign-in by removing our application from your Google account settings. Send requests to [[privacy@yourdomain]]; we will respond within [[response window]].

9. Changes

If we change this policy we will update the date above. Material changes will be communicated to signed-in users.