Trust & data handling
What Etiq sends to the OpenAI API, what stays on our servers, and how to get your data out.
1 · What is sent
What leaves our systems
When you run an audit, exactly two things are sent to the OpenAI API:
- →The label image you uploaded (JPG or PNG), forwarded as an inline data URL to the vision model.
- →A fixed rule prompt naming the target market (France or EU-generic) and the EU 1169/2011 articles to audit.
What never leaves our systems
- ×Your account email and password — the OpenAI API never receives them.
- ×Payment details — Etiq does not collect card data today; no payment processor is enabled.
- ×The signed-in user identifier attached to your audit history — kept only in our database, never sent to OpenAI.
2 · Model training
Your data is not used to train OpenAI models
Etiq calls OpenAI through the standard API. Per OpenAI's API data-usage policy, data submitted through the API is not used to train or improve their models.
3 · Retention
How long we keep what
| Scope | Retention rule |
|---|---|
| Demo uploads (no account) | The image is held in memory only for the duration of the request, forwarded to the OpenAI API, and discarded — never written to disk or database. Any residual copy is removed within 24 hours. |
| Account audit history | The audit result (product name, score, findings, corrected copy) is retained in your account until you delete it. The source image itself is not stored. |
| Usage logs | Timestamp, hashed IP, model, token counts, latency and status — no image, no result content. Kept to prevent abuse. |
| Contact form and lead captures | Email address and message retained until you ask us to delete them. |
4 · Sub-processors
Third parties that process your data
| Provider | Purpose | Region |
|---|---|---|
| OpenAI | Vision model inference (GPT-4o) on the uploaded label image. | United States |
| Supabase | Hosting, database and authentication for accounts and audit history. | European Union |
5 · Encryption and access
Encryption and who can access uploads
- —Every request between your browser, Etiq and OpenAI is encrypted in transit with TLS.
- —The database that stores audit history is encrypted at rest by the hosting provider.
- —Row-Level Security in the database means one signed-in user can only read and delete their own audits.
- —On the Etiq team, only the two founders hold production database credentials, used solely for maintenance and support requests.
6 · Your controls
Export and delete your data
Export my data
- Sign in and open the workspace at /app.
- Scroll to "Your data".
- Click "Export my data (JSON)" to download a JSON file with every audit on your account.
Delete my account
- Sign in and open the workspace at /app.
- Scroll to "Your data".
- Click "Delete my account" and confirm — your audit history, profile and login are removed immediately.
Questions about how we handle a specific piece of data? Write to contact@etiq.company.