What we collect, why, and where it goes

The free check

What you give us. The product page address you paste, or the ingredient list or listing text you paste instead. If you ask for the full report, your email address.

What we record without asking. The IP address the request came from, and the time. That is how the rate limits work — a small number of checks per address per day — and without it the tool could be used to run someone else's catalogue through our screen for free.

What the check keeps about ingredients. Ingredient names on a listing that our screen could not identify, counted, with no link to who asked or which page they came from, so we can add them to the screen. Names from text you paste are never kept.

Why. To return the report, to show you the same report again if you come back, and to stop abuse.

The consent you are shown at the email step, stored word for word against your request: We email you the full report. We may write to you once about registering the product. No newsletter, no list, and we delete the report and your address when you ask.

The quote form

What you give us. The number of products and variants, the markets, the country of origin, your email address and whatever you write in the message field.

Why. To write you a quote and to send you an acknowledgement. The request goes to the person who would sign the report.

If you book a call instead. Booking uses Cal.com, a US service whose data may be processed in the United States, to find a time, and creates a Google Calendar event with a Google Meet link for the call. Cal.com and Google receive your name, email address, the answers you give when booking, and the time you choose. Cancelling or rescheduling updates the same booking; booking a call does not add you to any mailing list. Booking a call works the same way as the check: your request goes through our own server, which records the IP address and the time for the same rate limit, before it reaches Cal.com.

Regulation alerts

What you give us. The email address you enter.

What we record without asking. The IP address the request came from, and the time. The reason is the same as for the free check: a small number of sign-ups per address per day, so that the form cannot be used to fill someone else's inbox with confirm emails.

Why. To send the one confirm email and, once you confirm, to email you when an EU cosmetics rule changes. Nothing else. The line shown next to the form is stored with your request: We email you only when an EU cosmetics rule changes, and, if you ticked a market, when there is news for it. No other mail. Unsubscribe with one click.

Confirming. Nothing is subscribed until you open the link in the confirm email and press Confirm. That link works once and expires; an old or already-used one is refused.

Unsubscribing. The link in every alert email opens a page with one button. Pressing it stops all further mail to that address at once.

Watching your ingredients. After a free check you can separately ask to be told when a rule changes for the ingredients in your listing. This is its own request: the check itself still adds you to no list. Only ingredients we can identify with confidence are watched, and the confirm email lists which ones, and which not and why. For each watched ingredient we store its registry identity (INCI name, CAS number) and the name your listing used. A second product adds to the list. Unsubscribing deletes the whole list; you cannot yet remove a single ingredient on its own.

Market news. You can also tick the UK, the US, India or South Korea, to get news for that market, such as a support programme or a deadline. Each item is written and checked by David before it is sent. After it has been sent, the same item appears on that market's page on this site, with no personal data. The one-click unsubscribe in every email stops market news too.

How long we keep it. Your email address until you unsubscribe or ask us to delete it, whichever comes first. The request log that carries the IP address exists for rate limiting and is kept for 30 days. A sign-up that is never confirmed is deleted a week after it was made. Mail is sent through Amazon Simple Email Service, like every other mail this site sends.

Processors — the other companies involved

Hosting. The site, the check and the database run today on a DigitalOcean droplet in India. That is where your check requests, quote requests and email addresses sit today. This is moving to infrastructure in the EU, and this page will say so, with the date, when it has.

Email. Mail is sent through Amazon Simple Email Service. Your address and the report reach Amazon in order to be delivered.

The claims read. The claims part of the report uses the hosted API of Anthropic, PBC under its commercial terms. Your listing text is sent to that provider only after you ask for the full report by email. Under those terms, API inputs and outputs are not used to train its models.

We do not sell anything you give us, and we do not pass it to your manufacturer, to a retailer, to a marketplace or to an authority.

How long we keep it

We keep a check report, a quote request and the email address that came with it until you ask us to delete them, or until we close the file on our side, whichever comes first. The request log that carries the IP address exists for rate limiting and is kept for 30 days.

Colleague accounts in the client portal

If a client company invites colleagues to use the client portal, we hold each colleague's name and email address for as long as their account is active, and afterwards for as long as the client's own records are kept — because a document, a formula declaration or an uploaded file in a client's regulatory file is attributed to the named person who filed it, and that attribution has to survive the person's account being disabled. A colleague's access can be removed at any time by their own company's administrator inside the portal; removing access does not remove their name from anything they already filed.

Deleting it

Ask, and we delete the report and your address. There is no form and no waiting list for this: write to the address below and say which address to remove.

Email: reg@sarva.im.

Who is responsible for it

David Vandevoort, pharmacist, SARVA Reg, Belgium. See the imprint.

Cookies and analytics

The site sets no analytics cookies and loads no third-party analytics by default. If that changes, it will be described here before it is switched on.

The server keeps a log of page requests (the page, the time, the page you came from and your browser's name, without your IP address) so we can see how the site is found and used.

Visit statistics. We count page visits with GoatCounter, which runs on our own server. It sets no cookies and stores no IP address. To tell one visit from the next it uses a code derived from the connection, which changes every day and is not kept. What we see is which pages were read, which site sent the visitor, the browser, the screen size and the country. It is not shared with anyone.