Privacy Policy

This Privacy Policy describes what information SDSentry collects, how we use it, and the choices you have. We collect only what we need to run the service. We do not sell your data. We do not use your inventory data to train AI models.

1. Scope

This Policy applies to the SDSentry web application served from sdsentry.0xpi.com and sds.0xpi.com, and to any related communications we send you. It does not apply to third-party services we link to (their own privacy policies apply).

The service is operated by Dale Weaver, a sole proprietor doing business as 0xpi and as "SDSentry" ("we," "our," "us").

2. Information we collect

Information you give us

• Account info: email address, password (stored bcrypt-hashed, never in plain text), name (optional), facility / company name, role.
• Inventory & SDS lookups: the chemicals, products, manufacturers, EPA registration numbers, CAS numbers, barcodes, notes, and locations you enter into the service.
• Billing info: we do not store your credit card number or bank details. PayPal stores those. We retain the PayPal subscription ID, payer ID, and plan ID associated with your account.
• Support correspondence: if you email us, we retain the message and our reply.

Information collected automatically

• Session data: a randomly-generated session token (cookie), the IP address of your connection, your user-agent (browser identifier), and the time of each request.
• Audit log: every meaningful action in your tenant (login, password change, role change, inventory add/remove, billing event, export) is logged with user, time, IP, and a brief description. This is a feature of the service; you can export it on demand.
• Server logs: short-term request logs (URL, status, response time, IP) for debugging and security. Retained ≤ 7 days.
• Free AI tools (MCP): when an AI assistant calls our free SDS lookup or HazCom tools, we log the time, the tool used, the assistant's client name and user-agent, the IP address, the outcome, and the length of the query. We do not store the query text in that log. The product name is sent to the public sources in section 4 to find the sheet.

We use Google Analytics 4 and the Google Ads conversion tag (Google LLC) to count visits and measure which ads and pages lead to sign-ups. We also run Umami, a cookieless analytics tool hosted on our own servers. We do not use Facebook Pixel, and we do not sell data to advertisers. Our analytics do not load for automated browsers. We do not fingerprint your device.

3. How we use it

• To operate the service: authenticate you, scope inventory to the right tenant and location, return SDSs you ask for, generate posters and exports.
• To send service-related email: subscription receipts, password-reset notices, security alerts, trial status reminders (e.g., "your trial ends in 7 days"), and product-activation nudges when you haven't completed key setup steps (e.g., adding a first chemical). These emails are directly about operating your account. We do not send promotional or advertising email unrelated to your account.
• To bill you and respond to billing disputes through PayPal.
• To enforce our Terms and Acceptable Use Policy and protect the service from abuse.
• To improve the service through aggregated, anonymized usage analysis (e.g., "X% of searches go to product names vs. CAS numbers"). This never involves selling or sharing identifiable data.
• To comply with legal obligations (e.g., responding to subpoenas).

4. Who we share it with

We share data only with the third parties below, and only as needed to run the service:

We do not sell your personal data. We do not share your data with advertisers. We do not allow PayPal or Anthropic to use your data for their own marketing. We may disclose information if compelled by a valid legal request (subpoena, court order), and we will notify you unless we are legally prohibited from doing so.

5. Cookies

We set three first-party cookies of our own: sds_session, an HttpOnly, Secure, SameSite=Lax cookie that holds a random session token used to recognize your browser between requests; and two measurement cookies, sds_aid (a random visitor ID) and sds_ft (the page, referring site and campaign tags of your first visit), used only to count how many people reach each sign-up step and which pages brought them. They are HttpOnly, last up to 1 year, contain no name or email, and are not shared with anyone. Google Analytics and Google Ads set first-party cookies (_ga, _gcl_*) to measure visits and ad conversions. You can block them with any browser's tracker-blocking setting or with Google's opt-out add-on, and the site still works. Umami sets no cookies. See our Cookie Policy for details.

6. Data retention

• Account data and inventory: retained for the life of your account, plus 30 days after cancellation to allow recovery. If nobody on the account signs in during those 30 days, an automatic daily job permanently deletes your company's users, locations, inventory, SDS library and version history, uploaded files, training and incident records, audit log and sessions. If someone signs in after cancellation, a payment was collected in the last 30 days, or a payment dispute is open, deletion is held and reviewed by hand instead.
• Deletion backup: immediately before deleting, we write one access-restricted (administrator-only) backup of the deleted data. It is used solely to recover from an accidental deletion, never for any other purpose, and is itself permanently deleted 30 days later. A minimal company record with the company name removed is kept alongside the billing records described below.
• Audit log: retained for the life of your account (OSHA recordkeeping) and deleted with the rest of your account data as described above. Exported copies are yours to keep.
• Server logs: 7 days.
• Billing records: 7 years (US tax-record requirements).
• Support correspondence: 2 years.

7. Security

We use industry-standard practices to protect your data:

• All traffic is HTTPS with valid TLS certificates. HTTP traffic is redirected to HTTPS.
• Passwords are hashed with bcrypt (work factor 10) and are never logged in plain text.
• Sessions are HttpOnly cookies with 30-day TTLs and are invalidated on password change.
• Multi-tenant data is scoped per-company at the database query level — there is no application path for one tenant to access another tenant's data.
• The application server is firewalled and accessible only behind a reverse proxy.
• Database backups are taken regularly and stored on the same infrastructure.

No system is impenetrable. If we become aware of a security incident affecting your data, we will notify affected users within 72 hours.

8. Your choices

You may at any time:

• Access your data — your inventory, audit log, and account details are all visible in the app, and the audit log is exportable as CSV or PDF.
• Update your data — change your email, password, name, or inventory entries from within the app.
• Delete your data — cancel your subscription, then email dale.weaver@0xpi.com to request immediate purge instead of the default 30-day delay. We run the same deletion right away (including the 30-day deletion backup described in section 6); the only thing that delays it is an open payment dispute.
• Export your data — CSV export is available for inventory and audit log.
• Opt out of non-essential service email (trial reminders, activation nudges) by emailing us. Strictly transactional emails — password resets, billing receipts, and security alerts — cannot be opted out of while the account is active.

California residents have additional rights under the CCPA (right to know, right to delete, right to non-discrimination). To exercise them, email dale.weaver@0xpi.com; we will respond within 45 days.

9. Children

SDSentry is not intended for and is not directed at children under 18. We do not knowingly collect information from anyone under 18. If you believe a child has provided us information, email us and we will delete it.

10. International users

The service is hosted in the United States and intended for U.S.-based facility operators. If you access the service from outside the United States, you do so on your own initiative and are responsible for compliance with local law. We do not target EU residents and have not implemented GDPR-specific data-subject-rights mechanisms.

11. Changes to this Policy

We may update this Policy. The "Last updated" date at the top reflects the latest revision. Material changes will be announced in-app or by email at least 7 days before they take effect.

12. Contact

Privacy questions or data requests? Email dale.weaver@0xpi.com.