The short version
I’m a one-person business. I collect what I need to run it, and not much else.
I don’t sell your information. I don’t trade it. I don’t share it with other members. If you upload a formulation, I don’t show it to anyone, and it isn’t used to train AI models.
The rest of this explains the details, because you’re entitled to them and because California law requires me to write them down. If you’d rather just ask me something, email [email protected].
1. Who I am and what this covers
I’m Marie Gale, a sole proprietorship at 1485 Overlea St., Clearwater, FL 33755. You can reach me at [email protected].
This policy covers both of my sites:
- mariegale.com, my blog and the place I sell books and consulting
- advisor.mariegale.com, the Compliance Advisor subscription service
It also covers my email list, whichever site you joined it from.
I’ve organized this by what you’re doing rather than by which site you’re on, because nobody keeps track of which subdomain they’re on.
2. What I collect, and why
If you just visit
My web host records requests to the site, including IP addresses. That’s ordinary server logging. I use it to keep the site running and to look into problems.
Analytics and cookies are covered in Section 4.
If you comment on the blog
I collect what you type into the comment form, plus your IP address and browser information, which helps catch spam.
Comments are checked by Akismet, an automated spam filtering service run by Automattic. Akismet receives the comment itself along with your email address, IP address and browser information, and decides whether it looks like spam. Automattic’s privacy policy is at https://automattic.com/privacy/.
If you sign up for emails
I collect your email address, and your name if you give it.
You can end up on my email list several ways: registering on the blog, giving your email when you run the free MoCRA Wizard, ticking the box on my contact form, buying a Label Quick Check, subscribing to Compliance Advisor, buying consulting from me, or buying a book directly from me.
Blog registration is the standard WordPress kind, with a password and a profile, and you need to be registered to leave a comment. Registering also adds you to my email list — a plugin sends your details to GoHighLevel as you register — so your information sits in two places: the blog’s registration records on mariegale.com, and GoHighLevel, which is what actually sends you anything. Every email has an unsubscribe link.
I use “register” for the blog and “subscribe” for Compliance Advisor, so it’s clear which is meant.
On the Quick Check and Compliance Advisor signup forms there’s a box you can check to receive promotional email. That box is up to you.
Whether or not you check it, you’ll receive transactional email while you have an account with me: receipts, account notices, password resets, renewal reminders, and announcements about the service. Those aren’t marketing and you can’t turn them off while your account is open.
Every promotional email has an unsubscribe link. Unsubscribing stops the promotional email and leaves your account notices alone.
The two kinds of email travel by different routes. Bulk and promotional email goes through GoHighLevel, which holds my mailing list. Transactional email goes through Postmark. Both receive your email address, your name, and the content of the message being sent. Postmark retains the data for for 45 days.
If you use the contact form
Your name and email address are recorded in my database, and the content of your message is emailed to me so I can reply to you directly.
There’s a box you can tick to join my email list. If you tick it, your name and email are added; if you don’t, they aren’t.
If you send feedback
Each tool has a feedback form, available when you run it. What you write is emailed to me, and it’s attached to the tool run it came from, so I can see the result you were looking at. That’s how I find out what needs fixing, correcting or updating — and, sometimes, that something worked well.
Because the feedback is attached to the run, it’s connected to your account.
Feedback on the MoCRA Wizard works differently, because the Wizard is anonymous. Your feedback is attached to the Wizard result, and nothing identifying you is attached to it unless you give your email address so I can reply. If you do, I keep that address to write back to you, and it comes to me with the notification that feedback arrived.
If you use the free MoCRA Wizard
The Wizard is free and doesn’t need an account.
Your answers are recorded anonymously. I keep them to run and check the tool and to make it better, and they contain no personal information. Nothing in the record identifies you.
If you give your email address, it goes on my mailing list. It is never attached to your Wizard answers, and your results don’t follow you into a Compliance Advisor membership if you join later.
Because nothing is linked to you, your results can’t be retrieved afterward — not by you and not by me. Print or save them before you leave the page.
If you buy a Label Quick Check or subscribe to Compliance Advisor
I collect your name and email address, and a password, which is stored only as a hash. I can’t see it and I can’t recover it. If you give a business name, I keep that too.
Payment is handled by Stripe. Compliance Advisor talks to Stripe directly. Your card number never reaches my systems and I never see it. What comes back to me is a customer ID, a subscription ID, your plan, your rate, and whether your subscription is active.
I also record when you log in.
If you use the tools
When you run a check, I keep a record of it: which tool, when, what you entered, and what the tool returned.
What you enter — ingredient lists, formulations, percentages, product information — is kept with the run record.
Label images work differently. When you run a label check, the image you upload is used to read your label. I keep it for 90 days from the run. It isn’t shown in your dashboard — you can’t retrieve it, and no one else who logs in can see it either. During those 90 days I may look at it myself, in the admin area, to check that the tool read your label correctly and to make the checks more accurate. That means me reviewing images and refining my own rules. The images are not used to train AI models. After 90 days the image is deleted.
Uploaded label files are limited to 8 MB.
If you use the Ingredient Lookup
The Ingredient Lookup is a one-off tool — the result isn’t saved to your dashboard.
I do keep a log of lookups, and it’s connected to your account. I use it to see how often the tool is used and what people are looking for, so I can find gaps where someone didn’t get the result they expected. Because the log is tied to your account, I can also get in touch if I spot a problem with a result you were given.
If you ask me a question
Ask Marie questions come straight to me. No AI is involved and no third party sees them.
Questions and answers may later be anonymized, edited, and added to a shared Library section so other members can benefit. Your name, any identifying information, and any product name or identifying detail are removed first.
If you attend Office Hours
Office Hours calls are held over Zoom, and they are recorded. The recording captures your voice unless you’re muted, your video if your camera is on, your display name, and anything you show on your screen.
Recordings go into the Compliance Advisor Library, where current members can watch them. They are not public. They stay in the Library indefinitely.
The recording is made in Zoom’s cloud, then downloaded and deleted from Zoom once I have it.
You can attend without being in the recording. Stay muted, keep your camera off, use whatever display name you like, and send your question through the chat if you’d rather not be heard asking. I’ll answer it without saying who asked.
I don’t normally edit recordings after the fact. If something comes up and you need a recording changed, email me and I’ll sort it out.
If you buy a book or consulting from me
I collect what’s needed to fill the order and do the work, and you go onto my email list.
3. How artificial intelligence is used
AI is used in one place: the label checks, where it reads your label and reports what it sees. That’s all it does. Every determination comes from logic I wrote, not from the AI.
Label images go to my AI provider, Anthropic, only to be read. They are not used to train AI models. Anthropic is contractually prohibited from training on customer content.
Nothing else uses AI. Ask Marie doesn’t. The Fragrance Allergen Checker, the Ingredient Declaration Builder and the Ingredient Lookup don’t. Neither does the MoCRA Wizard.
4. Cookies and tracking
Cookies that make the site work
On Compliance Advisor:
- A session cookie that keeps you signed in, lasting 3 days
- If you choose “Remember me,” a cookie lasting 60 days
On the blog:
- A temporary cookie that checks whether your browser accepts cookies, discarded when you close it
- Login cookies lasting two days, or two weeks if you choose “Remember Me,” and a screen-options cookie lasting a year
- If you comment and choose to, a “Remember Me” cookie saving your name, email and website for a year, so you don’t retype them
If you block these, parts of the site stop working.
Analytics
Google Analytics uses cookies to collect device and browser information, your IP address, and what you do on the site, and derives your general location from your IP address. Google keeps this data for 30 months. Google publishes information for visitors of sites using Google Analytics and an opt-out browser add-on.
Clicky records visits, pages viewed, and IP addresses. It doesn’t collect your name, email address, or anything you’d have to type in. Clicky’s privacy policy is at https://clicky.com/terms/privacy.
Advertising
I use advertising pixels, including Meta’s, to measure how my ads perform and to show ads to people who have visited my site.
Amazon affiliate links
Some links to my books, and occasionally other products, are Amazon affiliate links. Clicking one places a cookie identifying that you came from my site. If you buy something at Amazon within 24 hours, I usually receive a small commission.
Embedded content
I sometimes embed content from other sites, usually YouTube videos. Embedded content behaves as though you had visited that site directly. Those sites may collect data about you, set their own cookies, and track your interaction with the embedded content, including linking it to your account there if you’re logged in.
Managing cookies
You can set your browser to warn you when a cookie is being sent, or to refuse cookies entirely. Every browser is different, so check its help menu. Turning off all cookies will disable some features here.
Do Not Track
Some browsers send a “Do Not Track” signal. There’s no agreed standard for what a site should do about it, and I don’t currently respond to those signals. The cookie controls in your browser, and the Google Analytics opt-out linked above, do work.
5. Who your information goes to
I use a small number of services to run my business. Each gets only what it needs.
- Stripe — payment processing, called directly from Compliance Advisor
- GoHighLevel — my mailing list, contact records, and bulk and promotional email
- Postmark — transactional email: receipts, account notices, password resets, reminders
- Anthropic — reads label images for the label checks, and is contractually prohibited from training its models on them
- Zoom — Office Hours calls and recordings, which I remove from Zoom’s cloud after downloading
- Words in a Row — my web host, on rented servers in the United States
- Google Analytics and Clicky — analytics
- Meta — advertising pixels
- Akismet (Automattic) — spam filtering for blog comments
I’ll also disclose information if I’m legally required to, or where it’s necessary to protect someone’s rights or safety. If I ever sell or transfer my business, customer information would transfer with it.
6. What I don’t do
- I don’t sell your information
- I don’t rent or trade it
- I don’t share your formulations or label content with anyone
- I don’t share your information with other members
- I don’t use your content to train AI models
- I don’t use your information to build a profile of your business for anyone else
7. Using anonymized examples
Real questions and situations are the best teaching material there is, so I sometimes use them in articles, on Office Hours calls, and in Library materials.
When I do, identifying details come out first: your name, your business name, your brand and product names, and any detail distinctive enough to point back to you.
If I use a formulation as an example, I remove the percentages or replace them with ranges, so the actual formulation is never disclosed. The ingredients make the teaching point. The percentages are yours.
If a situation can’t be explained without a detail that would identify you, I’ll ask you first.
8. Testimonials
If you write something kind in a feedback form or in an email, I may ask whether I can use it as a testimonial.
I’ll always ask first. You can say no, and that’s the end of it. You can also say yes on conditions — without your full name, without your business name, or without anything else you’d rather not have attached.
9. How long I keep things
- Account information — while your account exists, and afterward as described below
- Tool run records — indefinitely, for running your account and for understanding how the tools are used
- Label images — 90 days from the run, then deleted
- MoCRA Wizard answers — kept anonymously, with nothing linking them to a person
- Ingredient Lookup log — kept with your account, so I can improve the tool and follow up on a result
- Blog registration records — until you ask me to remove them. Unsubscribing from email doesn’t delete your blog registration.
- Contact form messages and feedback — indefinitely. I use them to track how the tools are being used and to make sure corrections and updates actually get made.
- Your results in your dashboard — as long as you want them. See Section 10.
- Label Quick Check results — readable for 30 days from the run. An unused Quick Check expires 365 days after purchase. If you subscribe within 60 days of running it, the check comes across to your dashboard.
- After you cancel — your run history can be restored if you rejoin within 60 days; after that I can’t promise it
- Office Hours recordings — indefinitely, in the Library
- Ask Marie questions — on the same basis as your other information, and permanently once anonymized and added to the Library
- Email between us — indefinitely. It sits in my email the same way it would with any business you’ve written to.
- Email delivery records — GoHighLevel and Postmark each keep a log of messages sent to you
- Blog comments — indefinitely, so follow-up comments from you are approved automatically
- Email list — until you ask me to remove it. If you unsubscribe, I keep your email address so you don’t get added back by accident.
- Google Analytics data — 30 months, held by Google
- Payment records — as long as tax and accounting rules require
10. Your choices
You can do all of these whether or not the law where you live requires it.
- See what I have. Ask, and I’ll send you a copy.
- Correct it. Update your profile, or email me.
- Tidy your dashboard. You can hide any tool result you don’t want to see, and unhide it later. Hiding only changes what’s displayed to you — the underlying record stays until you ask me to delete it.
- Delete it. I’ll delete your account and your history. Run data may be kept in anonymized form for statistics, with nothing connecting it to you. Anonymized Library entries stay, because there’s nothing in them identifying you. Email between us stays in my email — if you want a particular exchange deleted, ask and I’ll delete it.
- Stop the marketing email. Unsubscribe link in every one. Account notices continue while your account is open.
- Close your account. From your dashboard, any time.
Email [email protected] for any of these. I’ll respond within 30 days.
I won’t treat you differently for asking.
11. If you’re in the EU or the UK
While the information I provide is primarily directed at people in the United States, I do accept Compliance Advisor subscribers and blog registrations from outside the US, and I have registrants in Europe.
If you’re covered by the GDPR or the UK GDPR, this section is for you. I’m the controller of your information.
Why I’m allowed to process your information
- To perform our contract — running your account, performing the checks, billing you
- With your consent — promotional email where you ticked a box to receive it, on the Compliance Advisor signup, the Label Quick Check purchase, or my contact form. You can withdraw that consent at any time.
- For my legitimate interests — sending article notices and related email to people who registered on the blog, since registration itself puts you on the list. Object or unsubscribe at any time and I’ll stop.
- For my legitimate interests — keeping the site secure, preventing fraud, and improving the tools through anonymized analysis
Your rights
You can ask me to give you a copy of your information, correct it, delete it, restrict how I use it, or send it to you in a portable form. You can object to processing based on legitimate interests. You can withdraw consent to marketing at any time, and withdrawing it doesn’t affect anything I did beforehand.
Email [email protected]. I’ll respond within 30 days.
You also have the right to complain to the data protection authority in your country if you think I’ve handled your information badly. I’d rather you told me first so I can fix it, but the right is yours either way.
Automated decisions
The tools evaluate labels, not people. Nothing here makes an automated decision about you personally.
Where your information goes
I’m in the United States, and I process your information here.
The services I use are mostly US companies, but several of them operate internationally and may process your information outside the United States, under their own privacy policies. Those are linked in Section 5.
12. Security
Connections to my sites are encrypted. Passwords are stored as hashes, so nobody, including me, can read them. Card numbers never reach my systems. Access to member information is limited to me.
No system is perfectly secure, and I’m not going to pretend otherwise. What I can tell you is that I keep the amount of information I hold small, which is the most effective protection there is.
Use a strong password you don’t use anywhere else, and don’t share your login.
If information I hold is ever exposed in a way that could affect you, I’ll tell you promptly.
13. Children
Compliance Advisor is for adults, and members must be 18 or older. My sites aren’t directed at children, and I don’t knowingly collect information from anyone under 13.
14. Changes to this policy
If I change this policy, I’ll update the version number and effective date at the top. For anything significant I’ll email members and registrants.
I don’t publish old versions on the site, but I keep them. If you’d like to see an earlier version, or the version that was in force when you joined, email me and I’ll send it to you.
15. Contact
Marie Gale
1485 Overlea St., Clearwater, FL 33755
[email protected]
Questions about your information, this policy, or anything else all come to the same place. Just email me.