Legal
Privacy Policy
Last updated: [DATE OF PUBLICATION]
1. Who we are
zeroresidue.io is operated by 2780017 Alberta Inc., operating as SubstanceWorks AI ("SubstanceWorks", "we", "us", "our"), a corporation incorporated under the laws of Alberta, Canada, and located in Calgary, Alberta.
For the purposes of the European Union and United Kingdom General Data Protection Regulation ("GDPR"), SubstanceWorks is the controller of personal data described in this policy.
This policy explains what we collect when you use zeroresidue.io (the "Site"), why, and what rights you have.
2. Our approach in short
- The Site requires no account, login, or registration.
- We do not collect, log, store, or transmit anything you type into our tools.
- The only personal data we process is limited website analytics, and only if you consent.
- We do not sell personal data, and we do not use it for advertising.
3. What you enter into our tools is not collected
Our tools run in your browser. Substance names, CAS numbers, quantities, search terms, and any other values you enter into a tool are processed locally on your device to produce a result.
We do not log, store, transmit, or analyse those inputs. They do not reach our servers or any third party.
We consider this important because our users are compliance professionals whose queries may reveal confidential formulation or business information. We have designed the Site so that we never hold that information.
4. What we do collect
4.1 Analytics — only with your consent
If you consent, we collect limited, pseudonymous information about how the Site is used, in order to understand which tools are useful and to improve the Site. This may include:
- pages visited and the order in which they were visited;
- the referring website or source that brought you to the Site;
- which tool was used, identified only by the tool's name (for example, "pfas-screener"), and whether a result was produced or exported;
- clicks on links to our commercial platform;
- approximate location derived from IP address at the country or region level;
- browser type, operating system, device type, and screen size;
- website performance measurements, such as page load timings.
Analytics never includes the content of what you type into a tool. We record that a tool was used — never what it was used to look up.
If you do not consent, no analytics are collected and no analytics cookies or similar technologies are set.
4.2 Server logs
Our hosting provider automatically records standard technical information when a page is requested, including IP address, timestamp, requested URL, and user agent. These logs exist for security, abuse prevention, and operation of the service, and are retained for a limited period by the provider.
4.3 If you contact us
If you email us, we receive your email address and whatever you choose to include in your message. We use that only to respond and to keep a record of the correspondence.
5. Cookies and similar technologies
The Site uses only what is necessary to function, plus analytics if you consent.
| Purpose | Set without consent? | Description |
|---|---|---|
| Consent preference | Yes | Records whether you accepted or declined analytics, so we do not ask repeatedly. Strictly necessary. |
| Analytics | No — only with consent | Distinguishes visits and sessions for the analytics described above. |
We do not use advertising cookies, tracking pixels, or third-party marketing trackers.
Withdrawing consent. You can change or withdraw your choice at any time using the link in the footer of the Site. Withdrawal takes effect immediately and stops further collection. You can also clear cookies and site data in your browser.
6. Analytics provider and international transfer
We use PostHog as our analytics processor. PostHog Inc. processes analytics data on our behalf under a data processing agreement and does not use it for its own purposes.
Analytics data is processed and stored on infrastructure located in the United States.
If you are in the European Economic Area, the United Kingdom, or Switzerland, this means your analytics data is transferred outside your jurisdiction. That transfer is made under Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum where applicable), incorporated into our agreement with PostHog, together with supplementary measures where required.
You may request a copy of the relevant transfer safeguards by contacting us.
7. Legal basis for processing (GDPR)
Where the GDPR applies, we rely on the following legal bases:
| Processing | Legal basis |
|---|---|
| Analytics | Consent — Article 6(1)(a). You may withdraw it at any time. |
| Security and abuse prevention via server logs | Legitimate interests — Article 6(1)(f): operating a secure and available service. |
| Responding to your enquiries | Legitimate interests — Article 6(1)(f), or performance of a contract where relevant. |
We do not process special categories of personal data, and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
8. How long we keep information
| Data | Retention |
|---|---|
| Analytics | Retained by our processor for up to 12 months from collection, then deleted or irreversibly aggregated. |
| Consent preference | Stored in your browser until you clear it or withdraw consent. |
| Server logs | Retained by our hosting provider for a short operational period, typically no more than 30 days. |
| Email correspondence | Retained while needed to address your enquiry and for a reasonable period afterwards. |
9. Sharing
We do not sell, rent, or trade personal data.
We share personal data only with:
- Service providers who process it on our behalf under contract — currently our hosting provider (Vercel Inc.) and our analytics processor (PostHog Inc.);
- Authorities, where we are required to do so by law, or where necessary to establish, exercise, or defend legal claims;
- A successor entity, in the event of a merger, acquisition, or sale of assets, subject to this policy continuing to apply.
10. Security
We use HTTPS for all traffic, restrict access to systems, and design the Site to minimise the personal data we hold. The most significant safeguard is structural: because tool inputs never leave your browser, that information cannot be exposed by a breach of our systems.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Your rights
11.1 If you are in the EEA, UK, or Switzerland (GDPR)
You have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict processing; object to processing based on legitimate interests; receive your data in a portable format; and withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
You also have the right to lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office (ico.org.uk).
11.2 If you are in Canada (PIPEDA and Alberta PIPA)
You have the right to access the personal information we hold about you, to request correction of inaccuracies, and to withdraw consent, subject to legal and contractual restrictions.
You may make a complaint to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Alberta, to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).
11.3 Making a request
Contact us at legal@zeroresidue.io. We will respond within the time required by applicable law — generally one month under the GDPR and thirty days under PIPEDA.
Because our analytics data is pseudonymous and we hold no account information, we may be unable to identify data relating to you from the information available to us. Where that is the case, we will tell you, and we may ask for additional information to help locate the data. We are not required to collect additional data solely to identify you.
12. Children
The Site is intended for professional use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy. The "Last updated" date shows when it was last revised. Where changes are material, we will take reasonable steps to bring them to your attention and, where the law requires it, seek fresh consent.