Who is responsible
This website, isthatnatural.com (“Is That Natural?”, “we”, “us”), and its free tools at allergen.isthatnatural.com and hlb.isthatnatural.com are operated from Canada. We are responsible for the personal information described in this policy. Questions, requests and complaints go to info@isthatnatural.com.
What is collected
- Analytics. isthatnatural.com uses Google Analytics 4, loaded through the Site Kit plugin, to count visits and see which pages are read. It records the pages you view, the approximate location derived from your IP address, your device and browser type, the page that referred you, and how you move between pages. It is used in aggregate; we do not try to identify individual readers from it. The allergen and HLB calculators have no analytics.
- Security and delivery. The site and its tools are served through Cloudflare, which sits in front of it to deliver pages quickly and to block attacks. Cloudflare processes the technical details of each request, including your IP address, on our behalf.
- What you send us. If you e-mail us — to report a scoring error, ask about the method, or ask about certification — we receive your e-mail address and whatever you choose to put in the message.
- Certification requests. The Get certified form sends us your name, e-mail address, brand, product and market details and your message. They are stored on our server and e-mailed to us.
- Formulas submitted for assessment. If you ask for a formula assessment or certification, we receive the ingredient list and percentages you send. This is commercial information rather than personal information, and it is treated as confidential; see below.
- The formula scorer. Score a formula sends the ingredient list you type to our server to calculate the score. It is not stored, and the PDF of the result is made in your own browser.
- The allergen calculator. It needs a free account. We keep your e-mail address, a salted one-way hash of your password (never the password itself), your name and company if you give them (they appear as “Prepared by” on your reports), your settings, and when you signed up and last logged in. We keep what you add: your materials, with the supplier figures, IFRA limits and notes you enter, and your saved calculations. PDF and CSV reports are made from those when you ask for them and are not stored.
- Logging in to the allergen calculator. To stop password guessing, we record failed logins, sign-ups, password-reset requests and two-step codes sent, with the IP address and e-mail address involved, for 24 hours. If you turn on two-step login, we e-mail you a 6-digit code when you log in on a new device; it is stored only as a keyed hash and is gone within 10 minutes. If you tick “Remember this device”, we keep the name of the browser and operating system (for example “Chrome on Mac”) and the dates, so you can see and forget remembered devices on your Account page.
- The HLB calculator. It has no accounts and sets no cookies. The oil phase and emulsifiers you enter are sent to our server to calculate the result and are not stored, apart from server logs that are overwritten automatically. If you request an ingredient, we keep what you put in the request (the ingredient, its supplier, the HLB value and its source, your notes) and your e-mail address if you give one, which is used only to tell you when the ingredient is added. Requests are recorded with your IP address for 24 hours to stop abuse.
The only accounts are on the allergen calculator, and nothing on the site or its tools is for sale. We do not collect payment card details, and we do not ask for information about health, children or anything else sensitive.
Why it is collected
Analytics and security data are used to keep the site up, keep it fast, protect it from abuse, and understand which ingredient pages are worth expanding. Your correspondence is used to answer you and to make the corrections you report. Formula data is used only to produce the assessment you asked for. What you keep in the allergen calculator is used only to run the calculator for you: it is never published or shared, and we do not look at it unless you ask us to (for example to help with a problem) or the law requires it. Login records and codes are used only to keep accounts secure, and ingredient requests to decide what to add to the HLB calculator. We do not use any of it to build profiles, and we do not sell or rent personal information to anyone.
Cookies
Google Analytics sets cookies in your browser so it can tell a returning visit from a new one. Cloudflare may set cookies that are necessary to route and secure your request. This site does not show a cookie banner and does not run advertising or cross-site tracking cookies.
The allergen calculator sets one cookie that it needs for its forms and to keep you logged in (itn_session: until you close the browser, or up to 30 days once you log in, or until you log out). Only if you tick “Remember this device” does it set a second (itn_device, 30 days), which lets that browser skip the two-step code. The HLB calculator sets no cookies.
You can refuse or delete these cookies at any time in your browser settings — every major browser allows you to block cookies, block third-party cookies, or clear them on exit. To opt out of Google Analytics across every site you visit, install Google’s opt-out browser add-on. Nothing on this site stops working if you do either.
Who it is shared with
Personal information is shared only with the service providers that make the site work: Google (Analytics 4, via Site Kit, on isthatnatural.com; and Google Workspace, which delivers the e-mail the site and its tools send — password resets, two-step codes, and the notices of certification and ingredient requests that come to us) and Cloudflare. Both process it on our instructions under their own terms. They operate internationally, which means your information may be stored or processed outside Canada, including in the United States, where it can be subject to the laws of those countries. We may also disclose information if we are legally required to. Your allergen calculator account and its contents are stored on our own server and are not shared with anyone.
Confidentiality of formulas
Formulas sent for assessment or certification are received in confidence and are used only to produce your report. Full ingredient lists and percentages are never published. The final product score is published only if you opt in to publication.
How long it is kept
Analytics data is kept in Google’s service for as long as it is useful for understanding how the site is used, and is reported in aggregate. Cloudflare’s request and security logs are short-lived and are retained according to that service’s own schedule. E-mail correspondence is kept while we are dealing with it and afterwards as a record of what was changed and why, which matters for an audit trail of corrections. Formula submissions and their reports are kept for as long as needed to provide and support the work, and are deleted on request once there is no longer a reason to hold them.
An allergen calculator account and everything in it is kept until you delete the account. Deleting it removes it from the live database at once; copies in our backups, which are kept on our own equipment in Canada, are overwritten within about two months. Login records are kept for 24 hours, two-step codes for at most 10 minutes, sessions for up to 30 days and remembered devices for 30 days. HLB ingredient requests are kept as a record of what was asked for and added; ask us and we will delete yours.
Your rights
You can ask us what personal information we hold about you and get a copy of it; ask us to correct anything inaccurate or incomplete; ask us to delete your correspondence, your formula data or an ingredient request; and withdraw your consent to analytics at any time using the browser controls described above. Write to info@isthatnatural.com and we will answer within a reasonable time. Allergen calculator account holders can also do it themselves at any time: Download my data and Delete your account are on the Account page. If you are not satisfied with how we have handled a privacy question, you may take the matter to the Office of the Privacy Commissioner of Canada.
Security
The site and its tools are served over HTTPS. Passwords are stored only as salted one-way hashes, and login sessions, reset links, two-step codes and remembered devices only as hashes, so the database holds nothing that can be used to log in directly. Account holders can add a second step to their login with two-step login. Access to correspondence, formula data and the tools’ databases is limited to the people who need it to run the service. No system is perfect, but the safeguards are proportionate to what is held.
Changes to this policy
If this policy changes, the revised version is posted on this page with a new effective date. Material changes will be noted at the top of the page.
Contact
Privacy questions, access requests and complaints: info@isthatnatural.com, or via the contact page. The terms of use cover the rest of the relationship between you and this site.