Privacy Policy

This policy explains what information Gluten Free Product Reviews collects, how we use it, and the rights you have over it.

Effective date: [To be set on publish]

Who we are

Gluten Free Product Reviews ("GFPR," "we," "us," "our") operates the website at glutenfreeproductreviews.com. We are the data controller for information collected through this site.

Mailing address: [To be added before launch.]

Privacy inquiries: privacy@glutenfreeproductreviews.com

Information we collect

We collect information in the following categories, using the taxonomy from the California Consumer Privacy Act:

Identifiers — email address (if you leave a comment, submit a review, or subscribe to our newsletter); name or display name (if provided); IP address (automatically logged by WordPress when you comment or submit a review).
Internet or other electronic network activity — pages visited, referring URL, browser and device type, analytics cookies, affiliate click events.
Geolocation — approximate location derived from IP address (city/region level, not precise GPS). We do not collect precise location.
Commercial information — products you click through to retailers via our affiliate links. We receive aggregate commission reports from retailers, not individual purchase records tied to you.
Content you submit — review text, star ratings, photos uploaded with user reviews, and comments.
Inferences — aggregated analytics (e.g., "most visitors to this page came from search engines") drawn from the above.

We do not knowingly collect: government ID numbers, financial account numbers, health records, biometric data, precise geolocation, or data from users under 13.

Sources of information

Directly from you, when you comment, submit a review, subscribe to the newsletter, or use the contact form.
Automatically, via cookies and server logs, as you browse the site.
From third parties — for example, aggregate click reports from Amazon Associates or Google Analytics (once those services are active).

How we use your information

To publish and moderate comments and user reviews.
To send newsletter emails (only if you have subscribed).
To analyze site usage and improve editorial coverage.
To measure the performance of affiliate links.
To respond to inquiries you send us.
To detect and prevent fraud, spam, and abuse.
To comply with legal obligations.

Legal basis for processing (for EU/UK visitors)

We rely on the following bases under GDPR Article 6:

Legitimate interest — for site analytics, affiliate click tracking, moderation, and security.
Consent — for marketing emails and for non-essential cookies in jurisdictions that require prior consent (we honor your cookie banner choices).
Contract — to deliver the newsletter you've subscribed to.
Legal obligation — to comply with applicable law (tax, takedown, court orders).

Sharing of information

We share personal information with the following categories of third parties for the purposes described:

Hosting and infrastructure providers — our website host, content delivery network, and database providers, strictly to operate the site.
Analytics providers — Google Analytics 4 (planned). GA4 may receive pseudonymous identifiers and activity data. Under California law (CPRA), GA4's ad-signal behavior is treated as "sharing" even where no money changes hands; we disclose it as such here. You can opt out via the "Do Not Sell or Share" link below or by using a Global Privacy Control signal in your browser.
Affiliate networks — primarily Amazon Services LLC (Amazon Associates Program). When you click an affiliate link, the retailer may set its own cookies and track the click. See the retailer's privacy policy for details.
Email / newsletter provider — if you subscribe (provider to be named once active), the provider processes your email to deliver messages and may track opens and clicks in those emails.
Gravatar — if you comment, a hashed version of your email is sent to Gravatar (Automattic) to display an avatar. See Automattic's privacy policy.
Legal recipients — law enforcement or regulators, if required by law.

We do not sell personal information for money.

Cookies and similar technologies

We use the following categories of cookies:

Strictly necessary — WordPress session cookies, and comment_author_* cookies (set when you leave a comment; default retention 347 days).
Analytics — Google Analytics cookies (_ga, _ga_<ID>; default 2-year retention). In the EU/UK, these load only after you grant consent via our cookie banner.
Affiliate — when you click an affiliate link, the destination retailer (e.g., Amazon) sets its own cookies on its domain. Our site does not set affiliate cookies on your browser.

You can manage cookie preferences through our cookie banner (once active), your browser settings, or by sending a Global Privacy Control (GPC) signal, which we honor as an opt-out of sale/sharing in jurisdictions that require it.

User-submitted reviews and photos

When you submit a review or upload a photo with a review, we store the review text, star rating, email address, and image file. Photos may retain EXIF metadata (camera, date, and sometimes GPS coordinates) unless stripped on upload; we make reasonable efforts to strip EXIF on upload, but you should remove sensitive metadata before submitting. Reviews are retained indefinitely unless you request deletion; deletion may affect aggregate product ratings that incorporate your review.

Retention

Comments and user reviews — retained indefinitely while the post exists, subject to your right to request deletion.
Newsletter subscription — until you unsubscribe, plus 30 days for suppression-list purposes.
Contact inquiries — retained for up to 24 months, then deleted.
Analytics data — retained according to Google's default GA4 retention (14 months unless we adjust).
Server and error logs — up to 90 days.

International data transfers

We are based in the United States, and some of our service providers (including Google and Amazon) process data in the US and other countries. For personal data originating in the EU/UK, we rely on the Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, as implemented by those providers.

Your rights

Depending on where you live, you may have the following rights. To exercise any of them, email privacy@glutenfreeproductreviews.com. We respond within 30 days (GDPR) or 45 days (CCPA / most US state laws), and we don't discriminate against you for exercising your rights.

Access / know — request a copy of the personal information we hold about you.
Correction — correct inaccurate information.
Deletion — request deletion, subject to limited exceptions.
Portability — receive your data in a machine-readable format.
Opt out of sale or sharing — for California, Colorado, Connecticut, Virginia, and other US state residents. We honor Global Privacy Control signals.
Opt out of targeted advertising — we don't currently run targeted advertising, but we disclose this right in case that changes.
Restrict or object to processing — for EU/UK residents under GDPR.
Withdraw consent — where processing relies on consent.
Appeal — if we decline a rights request, residents of Virginia, Colorado, Connecticut, and certain other states may appeal; we provide appeal instructions in our response.
Complain to a supervisory authority — EU/UK residents may file a complaint with their Data Protection Authority; California residents may contact the California Privacy Protection Agency or Attorney General.

Do Not Sell or Share My Personal Information

California and similar state laws define "sale" and "sharing" broadly to include certain uses of analytics and advertising cookies. You can opt out by: (1) clicking the "Do Not Sell or Share" link in our cookie banner once active; (2) emailing privacy@glutenfreeproductreviews.com; or (3) sending a Global Privacy Control (GPC) signal via your browser, which we honor automatically.

Children's privacy

This site is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has submitted information, contact us at privacy@glutenfreeproductreviews.com and we will delete it.

Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

Security

We use reasonable technical and organizational measures to protect personal information, including HTTPS, secure hosting, access controls, and keeping WordPress and plugins up to date. No system is perfectly secure; we cannot guarantee absolute security.

Changes to this policy

We may update this policy as the site evolves or as law changes. When we make material changes, we update the effective date at the top and, where appropriate, post a notice on the site or email subscribers.

Contact

Questions, requests, or complaints: privacy@glutenfreeproductreviews.com.