Privacy Policy
Pro/Profi waitlist
If you leave your e-mail on the paid-plan waitlist or in the promo-code form, we store the address, the plan and the referral source. There are two separate purposes, each with its own basis: issuing your personal promo code once, at your request (GDPR Art. 6(1)(b)); and sending Evigrade updates, only if you ticked the separate optional box, until you withdraw consent. Without that box the address is never used for mailings. You can delete your address anytime at /en/baja or by writing to [email protected]. EU users have the right to lodge a complaint with a supervisory authority (in Spain, the AEPD).
Ingredient evidence summary requests
If you request a free evidence summary for cosmetic ingredients, we store your e-mail, company name, the INCI names and claims you entered, the page and the country of the request. We use them only to prepare and send the summary and to answer your follow-up questions, at your request (GDPR Art. 6(1)(b)). We do not publish the request or share it with anyone, and we do not send you newsletters. You can delete your request anytime at /en/baja or by writing to [email protected].
Evigrade is a service for evidence-based evaluation of cosmetic ingredients and supplements. This policy describes what data the evigrade.com website and the Evigrade browser extension process.
What the extension collects
When you open a product page on a supported store (Wildberries, Ozon, iHerb, Goldapple), the extension reads the ingredient list (INCI) on that page and sends it to www.evigrade.com for matching against the Evigrade database. The response contains an evidence score for each ingredient.
We do not collect: browsing history, product names, prices, purchase data, personal information (name, email, phone), or IP address beyond what is technically required to process the request.
Local storage: your extension preferences (skin type, pregnancy, display mode) are stored only in the browser via the Chrome Storage API and never sent to our server.
Anonymous usage statistics: the extension reports de-identified events – install, popup opened, panel shown, button clicked. Each event carries a random installation identifier, the extension version, the interface language and the country derived from your IP. The identifier is generated on install, is not linked to any account and changes when you reinstall. Once a day, while your browser runs, the extension sends a signal that this installation is still active; it lets us tell a working extension from a removed one without tracking what you do. A single switch in the extension settings turns all of it off. Events that fail to send are kept on your device for up to 30 days for a retry and then discarded.
Site statistics
The site records actions on its pages in our own database: your answer to the question whether you are a professional, a calculator result, a check in the interaction checker, a waitlist signup. It also records a page read when a page stayed on screen for at least 20 seconds and someone scrolled, tapped or pressed a key on it. A record holds the site section and page address, language, country derived from the IP and a salted hash of the IP address. We do not store the IP address itself or browser details. If you are signed in, the record is linked to your account, so we can see whether people keep using the site after they register.
If you click “Accept” in the cookie banner, your browser gets a random identifier, evigrade_vid, kept in localStorage. It tells us whether someone came back on a different day. The identifier is a random string, it is not shared with third parties and is replaced with a new one after 13 months. “Necessary only” deletes it, and statistics then rely on the IP hash alone.
Retention
Ingredient-matching requests are processed in memory and are not logged or persisted. Aggregated, non-identifying statistics (how often a specific ingredient is queried) may be retained to improve the database.
Authentication (Pro and Profi)
A paid subscription requires an account: sign in with Google or with a one-time link sent to your email. We store your email address and, for Google sign-in, your name and avatar, so we can link the subscription to your account, send you a receipt, and show your profile. We hold no passwords at all: sign-in is handled either by Google or by a link that works once and expires in 24 hours. Free users do not need to sign in; the extension works anonymously.
Medicine list
If you create a medicine list in your account, the server keeps the name of the list, the medicines in it, the dosage exactly as you typed it, and your note. A list of medicines someone takes counts as health data (GDPR Art. 9), so it appears only after explicit consent – the checkbox shown when the list is created. We do not ask for and do not store sex, age, diagnoses or allergies.
Until you open a link, the list is visible only to you. The public link is issued on your command, shows the list name, the medicines and the dosages, is closed to search engines and is revoked in one click: once revoked, the old address stops opening. Deleting a list deletes every medicine in it, immediately and with no recycle bin.
Payments and subscriptions
Payments are processed by YooKassa. Card details go directly to the payment provider; we do not see or store them. The Evigrade server stores plan, period, charge amount, and the provider-side payment id – enough to know whether the subscription is active and when the next charge is due.
YooKassa sends a receipt to your email. Cancellation is available in the account page at /account; Pro access remains until the end of the paid period.
Third parties
The extension only communicates with www.evigrade.com, falling back to evigrade.vercel.app when that host is unreachable. Data is never sold, shared with ad networks, or used for credit scoring or financial assessment.
The evigrade.com website uses Vercel Analytics and Vercel Speed Insights for anonymous, aggregated traffic stats. These services do not set cookies or track users across sites.
Sign-in links and the promo-code email are delivered by Resend (servers in Ireland, EU). It receives the recipient address and the body of each email, nothing else: your searches, saved drugs and purchases never reach it.
Pro users: Google (OAuth), Resend (sign-in emails), YooKassa (payments). Each receives only what it needs for its job. Their privacy policies are available on their respective sites.
Extension permissions
activeTab,scripting– injects the ingredient parser into the current product page.storage– stores your preferences locally.host_permissionson wildberries.ru/.am/.by/.kz, ozon.ru, iherb.com, goldapple.ru – the parser runs only on these stores.
Your rights
When you use Evigrade anonymously, no personal data is collected, and you can reset the extension’s preferences at any time by uninstalling it or clearing Chrome storage. If you sign in for Pro/Profi or join the paid-plan waitlist, we store your account data (email, name and avatar), any stop-lists you save while signed in, and your subscription and waitlist records. Under the GDPR you can request access to, correction of, or deletion of that data at any time – from the account page, the /en/baja unsubscribe page, or by writing to us.
For any questions or data-handling requests, contact [email protected].
Changes to this policy
Material changes are reflected in the date at the top of this page. Please check back periodically.