← Back to the install guideOther documents:Terms of ServiceRefund & Subscription Policy

Privacy Policy

Last updated: 2026-09-15 · Effective: 2026-09-15 (new orders) / 2026-10-15 (existing subscriptions) · Version v1.0 · 2026-09-15

1. Who we are and what this policy covers

This Privacy Policy is issued by Safeguard Essentials, a business carrying on business in the Province of Ontario, Canada, with its principal place of business at 300 Village Green Dr, Woodbridge, Ontario L4L 9R3, Canada ("Safeguard Essentials", "we", "us", "our"). Heptapick is a trade name and product of Safeguard Essentials. Telephone +1 647-778-1355 · Email info@aurorisma.com · Privacy: info@aurorisma.com.

Privacy Officer / Person in charge of the protection of personal information: Chen Wantian, Founder, Safeguard Essentials — info@aurorisma.com (subject line "Privacy") · +1 647-778-1355 · 300 Village Green Dr, Woodbridge, Ontario L4L 9R3, Canada.

This policy applies to the Heptapick browser extension ("the extension"), the guide site at https://heptapick.pages.dev (including the page that opens when the extension is uninstalled), and the subscription service at https://heptapick-license.safeguardessentials1.workers.dev ("the subscription service"). It explains what personal information we collect, why, who receives it, where it is stored and what your rights are. It is written to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25) and the Chrome Web Store User Data Policy.

2. Summary

• Almost everything stays on your computer. Searches, product data, scores, your watchlist, price history and savings log are processed and stored only in your browser. We never receive them.
• The only thing sent to us is a random device ID — when the extension checks, cancels or resumes a subscription, and when the uninstall page opens. It contains no name, email, search terms or browsing history.
• Payment goes through Stripe. Stripe receives your email and card details; we receive only the device ID, Stripe's customer and subscription references and the subscription status. We never see your card number.
• Retailer sites receive your ordinary browser requests, including your existing sign-in cookies, when the extension opens their pages on your behalf. Their privacy policies apply to those requests.
• No accounts, no analytics, no advertising, no profiling, no AI models, no sale of data. You can ask us to delete your device record at any time by email.

3. What we collect

What we deliberately do not collect: your name, email (except when you write to us), your searches, the products you look at, your watchlist, prices recorded by your computer, your purchases, your retailer account credentials, your browsing history, analytics events, crash reports or telemetry of any kind.

Data held only on your computer (in chrome.storage.local, never transmitted to us): hp:device (device ID), hp:license (cached subscription status, refreshed at most every 7 days), hp:lang (interface language), hp:region (Canada / United States), hp:filters (your filter settings), hp:watch (watched items: product key, name, brand, time added), hp:hist:<product> (daily price points recorded by your own computer for items it has seen), hp:ledger (savings log: time, product, store, price, saving, currency). Removing the extension from your browser deletes all of these.

4. Consent

By installing the extension you consent to the generation of the device ID and to its transmission for subscription checks; by subscribing you consent to the subscription record described above and to Stripe's processing of your payment. We collect no sensitive personal information. You may withdraw consent at any time by cancelling your subscription and removing the extension, or by asking us to delete your device record (Section 12). Withdrawing consent means the paid features can no longer be verified for that installation.

5. How we use personal information

We use the information in Section 3 only to: (a) verify, activate, renew, cancel and resume subscriptions; (b) process payments, refunds and disputes through Stripe; (c) keep the subscription service secure and available; (d) answer your requests; and (e) keep the records the law requires (tax, accounting and dispute records). We do not use it for advertising, profiling, credit assessment, training of artificial-intelligence models, or any other purpose, and we never sell or rent it.

6. Automated decisions and AI

The extension contains no artificial-intelligence models and sends nothing to any AI service. Product scores, "buying-time" signals and "questionable discount" or "fake sale" flags are arithmetic computed on your own computer from the prices your browser has observed; they are estimates to help you decide, not decisions about you. The only automated process on our side is subscription verification: the service answers "active" or "not active" for a device ID according to Stripe's payment events. If you believe that answer is wrong, email info@aurorisma.com and a person will review it.

7. Who we share it with

We may also disclose personal information if the law requires it (for example, a court order or a lawful request from a Canadian authority), to our professional advisers under confidentiality, or to a successor if the business is sold or merged, in which case the successor is bound by this policy. We have no other recipients.

8. Where it is stored and cross-border transfers

Subscription records are stored in a Cloudflare D1 database on Cloudflare's global network; the region is not pinned to Canada. Payment records are held by Stripe in the United States. While your information is outside Canada it is subject to the laws of that country and may be accessible to its courts, law enforcement and national-security authorities. We use these providers under contracts that require them to protect the information; the residual risk of foreign access cannot be eliminated. If you are in Quebec, the assessment required before communicating personal information outside Quebec has been made for these providers.

9. How long we keep it

• Subscription record (device ID, Stripe references, status, dates): kept while the subscription exists and for 6 years after it ends, because Canadian tax law and card-network dispute rules require us to be able to link payments to what was delivered. Earlier deletion on request: see Section 12.
• Stripe event IDs: kept with the subscription record for the same period (they prevent a payment event from being processed twice).
• Cloudflare edge logs (URL and IP): retained by Cloudflare for a limited period under its own policy; we do not export or archive them.
• Email correspondence: kept for 2 years after the matter is closed, or longer if needed for an ongoing dispute or a legal requirement.
• Data on your computer: under your control; it exists until you clear it or remove the extension.

10. Security

All traffic between the extension, the guide site, the subscription service and Stripe is encrypted in transit (HTTPS). Stripe webhook events are accepted only with a valid Stripe signature. The subscription service holds no card data, passwords, names or emails. Access to the Cloudflare and Stripe accounts is limited to the founder and protected by strong credentials. Keep your device ID private: it is the only key to your subscription on this installation, so anyone who obtains it could query or cancel that subscription. It appears in the address bar when you open the Stripe checkout from the extension and on the uninstall page; do not share screenshots of those addresses. No system is perfectly secure and we cannot guarantee absolute security.

11. Breach notification

If a breach of security safeguards involving personal information under our control creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada and notify you as soon as feasible, and we keep a record of every breach for 24 months. For Quebec residents we also notify the Commission d'accès à l'information du Québec; in other jurisdictions we notify as their law requires. Because we hold no email address for you, notice may be given on https://heptapick.pages.dev and, where Stripe holds your checkout email, by email.

12. Your rights

You may ask us to: access the personal information we hold about your device ID; correct it; delete it; withdraw consent; receive it in a structured, commonly used format (portability — Quebec, EU/UK); ask that it be de-indexed where Quebec law provides; and ask a person to review any automated determination. Email info@aurorisma.com with the subject "Privacy" and quote your device ID (see Section 10 for where to find it; if you cannot find it, send the date and email address of your Stripe receipt and we will locate the record). We answer within 30 days and may ask for reasonable verification, which for this service means demonstrating control of the device ID or of the Stripe receipt. Deleting the device record ends any active subscription for that installation; we will first cancel the subscription so you are not charged again, and we keep the minimum payment record the law requires. Complaints: if you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca); for Quebec residents, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca); for Alberta and British Columbia, the provincial Information and Privacy Commissioner; for EU/UK residents, your local supervisory authority.

13. Cookies and local storage

The guide site sets no cookies, loads no third-party scripts, fonts or analytics, and stores only one value in your browser's localStorage: hp:lang (the language you chose, so that the site does not switch language on you). The extension stores the keys listed in Section 3 in chrome.storage.local. Stripe's checkout page sets its own cookies under Stripe's policy. We do no advertising or cross-site tracking of any kind.

14. Children

You must be at least 18 years old and have reached the age of majority in your province, territory or country of residence to purchase the Service. We do not knowingly collect personal information from children under 13 (under 14 in Quebec) and will delete such information if we learn of it.

15. Chrome Web Store disclosure (Limited Use)

Heptapick has a single purpose: comparing and scoring products across supported retailer sites in your own browser, with an optional paid subscription. The extension's use of information received from Google APIs or from the sites it accesses complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular: data is used only to provide or improve that single purpose; it is never transferred to third parties except as described in Section 7 (payment processing and hosting), for security, or to comply with the law; it is never used or transferred for serving advertisements, for determining creditworthiness or for lending purposes; and no human reads your browsing data. The extension requests host permissions only for the ten retailer domains it compares and for our subscription service, plus the tabs, scripting, storage and sidePanel permissions needed to open retailer pages, read them, keep your data locally and show the panel.

16. EU/UK and US residents

We do not currently market to residents of the European Union or the United Kingdom and have not appointed a representative there. If the GDPR or UK GDPR nevertheless applies to you, our legal bases are performance of the contract (subscription verification and payment) and legitimate interests (security and abuse prevention); transfers to Canada are covered by the European Commission's and the UK's adequacy decisions for PIPEDA-regulated organisations, and transfers to Stripe in the United States by Stripe's own safeguards. Residents of US states with privacy laws: we do not sell or share personal information, do not use it for targeted advertising and make no profiling decisions with legal effects.

17. Changes

The "Last updated" date at the top shows the current version. Material changes are announced on https://heptapick.pages.dev at least 30 days before they take effect for existing subscribers and, where Stripe holds your checkout email, by email.

18. Contact

Privacy Officer / Person in charge of the protection of personal information: Chen Wantian, Founder, Safeguard Essentials — info@aurorisma.com (subject line "Privacy") · +1 647-778-1355 · 300 Village Green Dr, Woodbridge, Ontario L4L 9R3, Canada.

Support and all other questions: info@aurorisma.com. Post: Safeguard Essentials, 300 Village Green Dr, Woodbridge, Ontario L4L 9R3, Canada.

© 2026 Safeguard Essentials. All rights reserved. · v1.0 · 2026-09-15