Your documents stay yours.

1 · What this policy covers

This policy covers the personal information we hold when you visit this site, hold an account, apply for certification, buy a certification or a membership, or look a certificate up in the register. It does not cover what a maker does with their own customers' information — that is theirs, and their own policy governs it.

2 · What we collect

Account details: your name, your email address, your phone number if you give one, and your business details. Application content: the answers you give and the documents you upload — including, where you give one, a mobile number for updates about the application by text, and your answer to whether you want those updates. An application that is started and left unfinished: the answers typed into it are saved to us as they are typed, so that an application somebody gave up on can be read and, if they come back, picked up where it stopped — section 9 says what that copy holds and how long it stays. Certification records: what was certified, when, and for how long. Payment records: what was charged, in what currency and when — never your card details. Contact form: what you send us through the contact form, which is your name, the email address you give us to reply to and your message. Technical information needed to run the site, such as a session cookie when you sign in. Measurement, where it applies: which pages were visited, roughly from where, and on what kind of device — section 7 says exactly when that happens and when it does not.

3 · Your documents: held, logged, not shared

Documents submitted as evidence are held on our own systems and remain available in your account. They are not published, and they are not shared. They are not posted to the register, they are not sold, and they are not passed to anyone outside the review that needs them to reach a decision.

Reviewers see them in order to assess the claim they support. Nobody else does — not other makers, not the public, not a buyer, not a retailer. They are stored on Cloudflare's infrastructure, in our own database, and are served to a signed-in account rather than from a public address: there is no link to one of your documents that would work for anybody else. Access is limited to the review team, and every time one of us opens a document it is recorded in our audit log against the person who opened it.

We hold them while the certificate is active — including across renewals — so the evidence behind a claim can be returned to at renewal or on appeal. When the certificate ends, the documents are deleted. How long we keep it sets out exactly what stays.

4 · What the public sees

The public register and a verified seal show the certificate: the holder, the product line, the claims certified, where the product is made, the certificate number and the dates it is valid for.

It never shows your personal details, your contact information, your documents, your evidence, or the reasoning behind a decision.

5 · Why we hold it

To assess an application and reach a decision, to issue and publish a certificate, to keep the record behind it, to take payment and renew it, to answer appeals and enquiries, to keep the register accurate, and to meet our own legal and accounting obligations.

We also write to you about your account and about the service: that an application has been received, that a decision has been made, that a certificate is approaching renewal, or that something about the service itself has changed. That is because we hold an account for you rather than because you agreed to be written to, and it is part of what running the account involves.

6 · Payments

Payments are processed by Stripe. Card details are entered with Stripe and are never stored on our systems. All charges are in Canadian dollars (CAD). Stripe holds the payment record it needs to process the charge; we hold what was charged, when, and for which certification or renewal.

7 · Who processes information for us

Five companies process information for us, each for one purpose and each on our instructions:

Stripe — payments, subscriptions and renewals. Card details are entered with Stripe and never reach us. Cloudflare — hosting, database, storage and delivery, which is where applications and documents live, the traffic measurement built into the platform, which records page views without identifying anyone, and the email we send you, which is carried by Cloudflare's Email Sending service. Resend — the same email, kept as a fallback if that service cannot be used: confirmations, decisions, appeals, renewal notices and announcements. Google Analytics — an optional measurement of how the site is used, described precisely below. Meta — optional advertising measurement, which is a separate question from measurement and is also described below.

There are two kinds of measurement through Google Analytics, and they are not the same thing.

Page measurement happens in your browser and only if you agree to it. Where you agree, Analytics records which pages are visited, roughly from where, on what kind of device and which page led to which — the ordinary picture of how a site is used, so that we can see which pages help a maker or a buyer and which do not. Where you decline, or simply never answer, nothing is loaded and no request reaches Google at all: the tag is not fetched, so there is no measurement and no Analytics cookie. The site works identically either way, and declining costs you nothing on it.

Two business events are sent from our own server whatever you choose. When an application is submitted, and when a payment is taken, an event is sent to Analytics with the amount, the currency and an internal reference for the application or the payment. This is deliberate: a browser can block measurement and a visitor can decline it, and the count of applications and the record of what came in still have to be true. Those events carry no name, no email address, no postal address, no document, no free-text answer and no IP address, and they are never joined to anything you told us. Nothing else about you is sent from the server.

Advertising measurement is asked about separately, and is off unless you turn it on. Where you agree to it, Meta's pixel records that a page was visited and may use that to show what is made here to people who resemble the people who visited — that is all an advertising audience is. It is a question of its own rather than bundled with measurement, because agreeing to be counted is not agreeing to be advertised to. Where you decline it, or never answer, nothing is loaded and no request reaches Meta at all. It is not loaded on the pages where you work on an application or a certification. The one exception is the page a payment returns you to, and there it reports the payment and nothing else — no page view, and nothing about the application or what is in it. Declining changes nothing about the site, and nothing about your application or your certification.

Where you have agreed to advertising, a confirmed payment is reported to Meta from our own server. An extension can block the browser pixel and a background tab can hold it back, so the purchase itself is sent from here instead: the amount, the currency, the id of what was bought, and a hashed form of the email address on your account — hashed means one-way, and the address itself never leaves the server. No IP address, no user agent, no name and nothing from an application is included. Your answer to the advertising question is recorded against your account so that the server knows whether it may report at all: where you declined, or never answered, no purchase is ever reported.

Each of them publishes its own data processing terms and is bound to process information only on our instructions. The typefaces, scripts and styles are served from this site. Advertising storage and advertising personalisation stay switched off in the Analytics configuration itself, and advertising measurement runs only through Meta, only where a visitor agrees to it. We do not sell personal information. We do not share what you give us in an application with anyone for advertising, and no processor here receives a name, a document or an answer in order to advertise anything.

8 · Cookies

We set a session cookie when you sign in so that the site knows who you are, and it is what keeps you signed in while you work. That cookie is necessary for the site to function, and it is set whether or not you agree to measurement.

If you agree to measurement, Google Analytics sets its own cookies, which is how a visit is counted once rather than twice and how a return visit is told apart from a new one. If you agree to advertising as well, Meta sets its own cookie, _fbp, for the same kind of reason: telling a return visit from a new one. No advertising cookie is set unless you have agreed to advertising, and none is set on the pages where you work on an application or a certification — with the single exception of the page a payment returns you to, where the pixel is loaded to report that payment and sets that cookie.

If you decline, no Analytics cookie is set by us and no request reaches Google from your browser — and the same is true of Meta if you decline advertising. If you change your mind later, clearing this site's data in your browser brings the question back and your answer is asked again.

9 · How long we keep it

Account and certificate records are kept while the account is open, and afterwards for as long as is needed to stand behind a certificate that was issued, to deal with appeals and disputes, and to meet legal and accounting requirements.

Evidence documents are deleted when the certificate ends — when it expires, is revoked, or is withdrawn. They are not kept afterwards, and they are not kept to build a history of a maker's business.

What stays on file when a certificate ends is the decision record: what was claimed, what was decided, the reason given, and the dates. That is the record a dispute would turn on, and it is the only part we keep. Anything we hold that is not needed for a live certificate, a decision record, or a legal or accounting obligation can be deleted on request.

An application that is started and never sent in is kept as well. The answers typed into the form are saved to us as they are typed, before any account exists, so that an application somebody stopped halfway through is not lost with the tab it was typed in. That copy holds what was put into the form and nothing else: there is no account, no email address and no document behind it, and it is not shown to anyone, published anywhere or joined to a certificate. It is deleted the moment it becomes an application — that is, as soon as an account is made and the answers are carried into it — and if it is never finished it stays until you ask us to delete it, which we will do. Coming back to a half-finished application is unaffected either way: it resumes exactly as it would have, and nothing about that copy is treated as a decision about you.

10 · Your choices

You can ask to see what we hold about you, ask for it to be corrected, ask for information to be deleted where we do not need to keep it, withdraw an application that is still in progress, and close an account. Write to [email protected] and we will answer.

Where a certificate is live or has been published, the record of it stays: a register that could be edited on request would not be worth consulting.

Any announcement we send carries a link that stops further announcements, and using it takes effect at once. Stopping announcements never stops the messages your account needs — a password reset, a receipt, a payment notice, or a reminder that a certificate is expiring or has expired. Those go with holding the account, and they keep arriving whether or not you want announcements.

11 · Security

Documents are stored privately rather than served publicly, access to them is limited to the review, sign-in is protected and sessions are short-lived. No system is perfect: if you believe information has been exposed or an account has been used without your authority, tell us at once and we will act on it.

12 · Data sharing

• Customer data is not shared with 3rd parties for promotional or marketing purposes.
• Mobile opt-in and consent are never shared with anyone for any purpose. Any information sharing that may be mentioned elsewhere in this policy excludes mobile opt-in data.

13 · Messaging program terms and conditions

1. The messaging program consists of general customer care messaging to answer questions and provide support to customers. Messages will be sent from (855) 772-4625.
2. You can cancel the SMS service at any time. Just text 'STOP' to the phone number from which you received messages. After you send the SMS message 'STOP' to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time and we will start sending SMS messages to you again.
3. If you are experiencing issues with the messaging program you can reply with the keyword HELP for more assistance, or you can get help directly at [email protected].
4. Carriers are not liable for delayed or undelivered messages.
5. As always, message and data rates may apply for any messages sent to you from us and to us from you. Message frequency will vary based on communication needs. If you have any questions about your text plan or data plan, it is best to contact your wireless provider.
6. If you have any questions regarding privacy, please read our privacy policy details contained in the rest of this page or contact us at [email protected].
7. Updates about an application are sent by text only where the applicant asked for them on the application itself, and only to the mobile number given there. Every one of those messages is written and sent by a person at ArtisanCheck: none of them is generated automatically, and nobody is texted who did not ask for it. They stop on the same terms as any other message — reply 'STOP' to the number the message came from and no more will be sent.

14 · Changes to this policy

We will date every version of this policy, and we will say on this page when something material changes. Version 1.10 adds text updates about an application: section 2 now says that a mobile number given for updates about an application by text, and the answer to whether those updates are wanted, are part of the application; and section 13 says that every one of those messages is written and sent by a person, that none is generated automatically, and that nobody is texted who did not ask for it. Version 1.9 keeps an application that is started and left unfinished: section 2 now says that the answers typed into an application are saved to us as they are typed, before any account is made, and section 9 says what that copy holds, how long it stays and that it is deleted as soon as the answers become an application. It is what lets a half-finished application be read and picked up rather than lost with the tab. Version 1.8 changes a requirement of the standard rather than this policy: the origin claims are now “Made in [location]” at 51% or more of the direct production costs and “Product of [location]” at 98% or more, and the share a maker states is printed on the certificate. Nothing here about what we hold or why has changed. Version 1.7 adds data sharing and the messaging program: section 12 now says that customer data is not shared with third parties for promotional or marketing purposes, and that mobile opt-in and consent are never shared with anyone for any purpose — so the sharing described elsewhere in this policy does not extend to mobile opt-in data; and section 13 sets out the terms of the messaging program, which sends customer care messages from (855) 772-4625, and says how to stop them, how to get help, and that carriers are not liable for messages that are delayed or undelivered. Version 1.6 says that we write to account holders: section 5 now says that we write to you about your account and about the service because we hold an account for you rather than because you agreed to be written to; section 10 now says that every announcement carries a link that stops further announcements, and that stopping them never stops the messages the account needs — a password reset, a receipt, a payment notice, or a reminder that a certificate is expiring or has expired; and section 7 now names the service that carries our email. Version 1.5 covers the contact form: section 2 now says that where someone writes to us through the contact form — which people without an account can do — we hold their name, the address they give us to reply to, and their message. Version 1.4 asks for a name, and a phone number if you want to give one: section 2 now says so. The name is what your account is called, and what a new application starts from so that you are not typing it a second time; the phone number is optional, and is only ever a way to reach you. Version 1.3 reports purchases to Meta from our own server: section 7 now says that where a buyer has agreed to advertising, a confirmed payment is reported to Meta with a hashed, one-way form of the email address on their account and never the address itself, that the advertising answer is recorded against the account so the server knows whether it may report at all, and section 8 corrects the cookie note for the one page a payment returns to. Version 1.2 adds advertising measurement: section 7 now lists Meta and describes advertising as a question asked separately from measurement, refused unless a visitor turns it on; section 8 says which cookie that sets, and that nothing is set without that answer. Version 1.1 adds measurement: section 7 now lists Google Analytics and separates the two kinds of measurement — page measurement, which happens only where a visitor agrees, and two business events sent from our own server, which do not depend on that choice and are described there in full. Section 8 was rewritten to match, and section 2 now names measurement among what we hold. A change never applies backwards to make something we did lawful that was not lawful when we did it.

Questions about privacy, at any time: [email protected].