Privacy

Residuals is a retailer deduction recovery service for consumer brands operated by Liam Harvey, a sole proprietor based in Danville, California. In this policy, “we”, “us” and “Residuals” mean that company, and “you” means whoever is reading it — a visitor to this site, someone who requests an audit, or a client.

For questions about anything here, write to privacy@useresiduals.com. A person answers, usually within two business days.

Three categories, and it is worth keeping them separate because they are treated differently.

Information you give us

• Your name, work email, company, revenue band, the retailers you sell into, and anything you write in the notes field.
• Anything else you choose to put in an email to us.

Client documents, if you engage us

• Remittance advice, check detail, EDI 820 and 812 files, invoices, purchase orders, bills of lading, proof of delivery, price files, trade agreements and related records.
• These are your business records. They may incidentally contain names and contact details of your staff or your retailer contacts. We treat the whole set as confidential.

Information collected automatically

• IP address, browser type, pages viewed, referring page, and timestamps — the ordinary server log of any website.
• We keep this to understand traffic, diagnose faults and limit abuse of the audit request form.

We do not ask for, and do not want, payment card numbers, bank credentials, government identifiers or any special category of personal data. Please do not send them.

• To reply to you, and to prepare and deliver the free deduction audit you asked for.
• To identify, document, file and pursue deduction disputes on your behalf if you become a client.
• To invoice you and keep the accounting records the law requires us to keep.
• To keep the site working, secure and free of automated abuse.
• To comply with legal obligations, and to establish or defend legal claims where we have to.

If you are in a jurisdiction that requires a legal basis to be named — the UK or EU, for instance — ours are performance of a contract with you, our legitimate interest in running and securing the business, and compliance with law. Where we rely on consent, you can withdraw it at any time.

A small number of service providers process data on our behalf, under contracts that limit them to that purpose. They are:

Beyond those, your information goes to two other kinds of recipient, and only these two:

• Retailers and distributors. When we file a dispute for you, we submit the supporting documents that dispute requires — to Kroger, Target, Amazon, UNFI or whoever the claim is against. We do this as your agent, at your direction, and only for claims you have engaged us to pursue.
• Where the law requires it. A valid legal demand, or the need to establish or defend a legal claim. If that ever happens we will tell you, unless we are legally forbidden from doing so.

If the business is ever sold or merged, your information may transfer with it. You would be told before that took effect, and the buyer would be bound by this policy or something at least as protective.

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. In the language of the California privacy statutes: we do not “sell” or “share” it.
• We do not rent or trade your contact details, and we will not add you to a marketing sequence because you asked for an audit.
• We do not use your documents or your data to train machine learning models, ours or anyone else’s.
• We do not use your data to help a competitor of yours, or to inform anyone else’s commercial decisions.

• Audit requests that do not become engagements: up to 24 months, then deleted. Ask sooner and we will delete them sooner.
• Client documents: for the life of the engagement plus the period needed to substantiate any claim we filed — a filed dispute can be revisited by a retailer long after it settles, and the evidence is what protects you.
• Invoices and accounting records: as long as tax and company law requires, typically seven years.
• Server logs: routinely rotated, generally within 90 days.

Backups age out on their own cycle, so a deleted record may persist in an encrypted backup for a short period after deletion before it is overwritten.

• Everything is encrypted in transit over HTTPS, and encrypted at rest by our hosting and database providers.
• Audit requests are stored in a database with row-level security enabled and no public access policy — the site’s public key cannot read them.
• Access is limited to the people who need it to do the work, and secrets are held server-side only.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach ever affects your information we will notify you and the relevant regulator within the time the law requires, and tell you what we know rather than what sounds best.

Wherever you live, you can ask us to do any of the following, and we will:

• Tell you what we hold about you.
• Give you a copy of it.
• Correct anything that is wrong.
• Delete it, subject only to disputes still open and records we are legally required to retain.
• Stop emailing you.

Write to privacy@useresiduals.com. We respond within 30 days, usually much sooner, and we will not charge you or make you create an account to ask.

If you are in California

The CCPA as amended by the CPRA gives you rights to know, delete, correct, and to opt out of sale or sharing. As above, we do not sell or share personal information, so there is nothing to opt out of. We will not discriminate against you for exercising any right. You may use an authorised agent, and we may ask them for proof of authority.

If you are in the UK or EU

You additionally have rights to restrict or object to processing and to data portability, and you may complain to your national supervisory authority. We would rather you came to us first so we can fix it.

This site does not use advertising cookies, and it does not track you across other websites. What the site sets is limited to what is needed to serve pages and keep them working. If we later add analytics, we will use a privacy-preserving provider, say so here, and add a consent banner where one is legally required — rather than adding the banner and hoping you click through it.

We are based in the United States and our providers process data in the United States. If you are outside the US, using this site or engaging us means your information is transferred there. Where a transfer mechanism is legally required, we rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

This is a business-to-business service and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has sent us something, tell us and we will delete it.

If we change this policy we will update the date at the top. If a change materially affects how we handle information we already hold about you, we will email you before it takes effect rather than relying on you to notice.

Liam Harvey, Danville, California. privacy@useresiduals.com. If you have asked us something and not heard back within a week, assume the email went astray and chase us — we would rather be chased than ignore you.