Your inquiry data has a defined route and a defined end.

Effective date and scope

This policy took effect on September 29, 2026 and was last updated on September 29, 2026. It applies to sharpshopper.org, its grocery department catalogue, inquiry forms and support message route. The catalogue is inquiry-only. It has no account, password, payment capture or card-data function.

Who operates this site

Sharpshopper, trading at sharpshopper.org, operates this site. The postal address is 1100 SHARP AVENUE, EPHRATA, PA 17522, EPHRATA, PA, United States. That is the controller contact for this policy.

What we receive

The inquiry form writes your name, phone, email, address, kind of enquiry, message, requested specification and consent tick. Automatically with it, the system records the IP address, browser user-agent string, referring URL, the moment the form was rendered and the moment it was sent.

Support chat keeps the conversation and a token in your browser so you can return to it. The browser stores the consent choice under site_consent_v2. Advertising click identifiers can include gclid, msclkid and fbclid. Technical requests create ordinary server and access log data.

Why each category is used

Contact details and the inquiry text let the store contact answer a department question and understand the requested product form. The specification helps distinguish a pack, bottle, roll pack or case without guessing a stock item. Chat data routes a support question and restores its conversation.

IP address, user agent, referrer and timestamps protect the form, diagnose delivery and record when consent and an inquiry occurred. Consent storage remembers your choice. Advertising identifiers and related measurement help Google Ads, Microsoft Advertising and Meta Ads measure paid traffic and campaign responses.

Legal bases

We use the details you submit to respond to an inquiry on your request and to take steps toward a possible transaction. That is contract-related necessity before an order exists. We use security and delivery records on legitimate interest in operating a safe, accountable website. Optional advertising and analytics storage, consent signals and associated measurement use consent. You can withdraw that consent without changing the lawfulness of earlier use.

Paid advertising and identifiers

Google Ads, Microsoft Advertising and Meta Ads send traffic here today. gclid is the Google Ads click identifier, msclkid is the Microsoft Advertising click identifier and fbclid is the Meta Ads click identifier where a campaign runs there. These identifiers are not a hidden substitute for consent. They help identify a campaign visit and its measured outcome.

Consent Mode v2

Google consent mode starts with ad_storage, ad_user_data, ad_personalization and analytics_storage denied until the visitor allows optional storage. When the visitor declines or withdraws, all four signals are set back to denied immediately. Denied storage does not mean that no tag or limited signal ever runs. It means optional storage and the related consent signals are not authorised.

Recipients and processors

Google Ireland Ltd / Google LLC receives Google Ads campaign signals and the consent signals. Microsoft Ireland Operations Ltd receives Microsoft Advertising information and uses its own Microsoft privacy statement at privacy.microsoft.com: https://privacy.microsoft.com/privacystatement. Meta Platforms Ireland Ltd receives Meta Ads information where a campaign runs there. The hosting provider serves this site and stores the enquiry database. The mail provider carries notification to the operator's inbox. These recipients are named by function because the site needs each route to operate.

International transfers

Some recipients or infrastructure may process information outside the country where it was collected, including through Google, Microsoft, Meta, hosting or mail operations. Where a transfer occurs, it is made under the recipient's applicable safeguards, contractual protections or another lawful transfer mechanism. The relevant platform privacy notices explain their own international handling.

Retention periods

Enquiries and their email copies are kept for 18 months. Chat transcripts are kept for 12 months. Server and access logs are kept for 60 days. The record of a consent choice is kept for 12 months. A deletion request can remove data earlier where no legal or security reason requires it to remain.

Security

The site limits collection to the fields needed for an inquiry, separates honeypot fields from the visible form, uses transport security, restricts database and mail access and retains logs for a short period. No system connected to the internet is risk-free. Do not send card numbers, passwords or sensitive information in an inquiry or chat.

GDPR rights

For visitors reaching the site from Europe, gdpr rights include access, rectification, erasure, restriction, portability, objection and withdrawing consent. Send a request to [email protected] or to 1100 SHARP AVENUE, EPHRATA, PA 17522, EPHRATA, PA, United States. We answer a data request within 5 days and may ask for proportionate information to identify the requester.

US state privacy rights

US state privacy law applies, including California's ccpa and CPRA, plus other state laws in force. Depending on your state, you may request access, correction or deletion and may opt out of sale or sharing. This site does not take payment data or maintain an account. Contact us to exercise the right that applies to your request.

Global Privacy Control

We honour global privacy control and the Sec-GPC header as an opt-out without asking again. The signal is treated as a request not to allow optional advertising sharing. Necessary operation of the inquiry and support routes remains available.

Children

This site is not for children and is directed to people asking about grocery outlet selection. We do not knowingly take data from children. If a parent or guardian believes a child sent information, contact [email protected] so the record can be reviewed.

Complaints

You may complain to your state Attorney General. A California resident may complain to the California Privacy Protection Agency in California. Visitors from Europe may also complain to their data protection authority. Contacting us first is useful but is not a condition of making a complaint.

Making a data request

Email [email protected] or write to 1100 SHARP AVENUE, EPHRATA, PA 17522, EPHRATA, PA, United States. State whether you want access, correction, deletion, restriction, portability, objection or consent withdrawal. We answer within 5 days. We use proportionate identity checks and do not require a phone or address for a data request unless needed to distinguish records.

Changes to this policy

A changed policy is announced by updating the effective date and version on this page. The page is the current notice. A material change is not silently backdated.

Contact

A human contact route is [email protected] or (717) 733-9555. Postal contact is 1100 SHARP AVENUE, EPHRATA, PA 17522, EPHRATA, PA, United States.