An Independent Witness for Your Consumer Disputes

A. Information You Provide Directly:

• Account registration data: name, email address, phone number, mailing address
• Case submission data: dispute details, company names, transaction information
• Communications: messages sent through our contact form
• Password (stored as a one-way cryptographic hash - never in plaintext)

B. Information Collected Automatically:

• IP address (collected at login, signup, case submission, and consent logging)
• Browser type, version, and operating system (User-Agent string)
• Device screen resolution and platform
• Time zone and preferred language
• Referring URL or traffic source
• Date and time of each interaction

C. Legal Consent Records: Every time you agree to our Terms of Service, submit a case, or take a legally significant action, we record a full consent log entry including your IP address, browser fingerprint, timestamp, and the specific version of the Terms you agreed to.

• To create and manage your CPI member account
• To receive, document, timestamp, and track your consumer dispute cases
• To generate official CPI reference numbers
• To send verification codes and password reset codes via email
• To build and maintain our Company Accountability Ledger
• To identify patterns of corporate misconduct for class action consideration
• To enforce our Terms of Service
• To comply with legal obligations

CPI maintains a proprietary Company Accountability Ledger - a database that tracks all companies against whom consumer cases have been filed. This ledger records:

• Company/business name and normalized identifier
• Total number of cases filed against the company
• Case type breakdown
• Number of unique consumers who have filed complaints
• Date of first and most recent case filing
• Class action flag status (triggered automatically at 3+ unique consumers)

Consumer Privacy in the Ledger: Consumer names, email addresses, and personal details are never included in the public-facing Company Accountability Ledger or in the complaint counts shown when a reference number is verified. Within the Ledger, cases are counted by anonymized internal user IDs only.

Internal case record: separately from the Ledger above, CPI keeps an internal, staff-only historical record of each closed case that does include the name of the consumer who filed it, alongside the company, case type, and outcome. This record is never displayed publicly and is not included in any public complaint lookup. See Section 8 for how long records are kept.

• Password Hashing: All passwords are hashed using scrypt (N=16384, r=8, p=1) with a unique random salt per user, and verified in constant time
• Session Security: Sessions use signed, HTTPS-only, HTTP-only cookies with rotating refresh tokens. Staff and administrator sessions expire on a hard four-hour limit; member sessions expire after 30 days of inactivity
• No Plaintext Storage: Passwords are never stored in readable form
• Transport Security: All traffic is served over HTTPS with HSTS enabled
• Credential Encryption: Sensitive operational credentials used by our systems are encrypted at rest using AES-256-GCM with authenticated encryption, so tampering is detected rather than silently accepted

We do NOT sell, rent, or trade your personal information.

• Legal Compliance: In response to valid subpoenas, court orders, or law enforcement requests
• Class Action Proceedings: In anonymized or aggregated form
• Dispute Evidence: Only the CPI Notice and reference number
• Safety: When necessary to protect rights, property, or safety

• Right to Access: Request a copy of the personal data we hold about you
• Right to Correction: Request correction of inaccurate personal data
• Right to Deletion: Request deletion of your account (legal consent logs may be retained)
• Right to Portability: Request your case data in machine-readable format
• CCPA Rights (California): Right to know, to opt out of sale (we do not sell), and non-discrimination
• GDPR Rights (EU/EEA): Right to object, restrict processing, and lodge complaints

Contact us at privacy@consumerprotect.us.

CPI does not use advertising cookies, analytics cookies, or third-party tracking technologies, and we do not sell or share data with advertisers. We set only strictly necessary cookies required to operate the service: a session cookie and a refresh cookie (both HTTP-only, so they cannot be read by scripts), and a security token cookie used to protect against cross-site request forgery. These cookies are essential to keeping you signed in and cannot be disabled while using an account.

CPI minimizes stored data on purpose, both to protect your privacy and to keep our costs low as a nonprofit. Retention works as follows:

• Cases you confirm as resolved: the full case record, including any documents you uploaded, is permanently deleted 14 days after you confirm the resolution. Only a short text-only summary is kept (see below).
• Cases that remain unresolved: retained with full supporting evidence for up to 3 years from the date the case becomes inactive, so the documentation remains available if you need it, then reduced to the same text-only summary.
• Inactive accounts: if you do not sign in for 120 days, your open cases are moved to an archive and stop counting against your active case limit.
• Permanent text-only record: after a case is purged we retain a short record containing the reference number, the company, your name, the case type, the outcome, and the dates. It contains no uploaded documents and no contact details.
• Legal consent logs and Company Ledger entries: retained indefinitely as records of agreement and of complaint volume against a company.

You may request deletion of your account and associated records at any time by contacting privacy@consumerprotect.us. Some records may be retained where we are legally required to do so.

CPI's Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors.

We may update this Privacy Policy from time to time. Material changes will be communicated at least 14 days before the changes take effect.