Privacy policy

Effective 28 September 2026. Pick Trusted One provides product discovery, comparison and affiliate referrals. Public browsing and merchant links do not require an account or analytics consent. We do not collect payment details, take orders, or need your phone number, date of birth or government ID.

Optional analytics start only after you choose Allow analytics. A random identifier in the first-party HttpOnly pw_session cookie lasts up to 30 days. Records include visited paths, visible product-card impressions, product views, searches, category selections and intentional affiliate clicks. Product, merchant, placement, campaign, source, medium and a Reel identifier may be recorded. These are pseudonymous records, not a claim that visitors are unidentifiable. Referrers are reduced to hostnames; campaign parameters are bounded labels. Please do not put personal information into searches or campaign links.

Necessary browser storage remembers your analytics choice and products you explicitly add to your local cart or comparison. The cart contains product IDs, cannot charge you and creates no Amazon order. Optional campaign labels last for the browser tab session. Clear the cart or your browser site data to remove device-local selections. Declining analytics does not prevent affiliate attribution by the merchant after you choose to visit it.

Use the Analytics control to change your choice. Withdrawal immediately stops new optional events in this browser, clears campaign context and asks the server to revoke the session and clear its cookie. If the network request fails, the browser remains opted out and displays a retry control. Previous records are not automatically erased by withdrawal; use the contact route for an access, correction or deletion request.

Operator-run retention maintenance removes raw searches older than 90 days, optional page/shopping events older than 180 days, and unreferenced sessions and experiment assignments older than 180 days. No automatic schedule is configured, so records can remain until maintenance runs. Clicks linked to affiliate reconciliation, commission reports, audit/security records and legally necessary records are preserved for an operator retention review. Requests and legal holds may require different handling. We do not promise immediate erasure of records needed for accounting, fraud prevention or legal obligations.

The application uses a daily IP-derived hash for short-lived rate limiting. This is an abuse-control identifier, not anonymous data. Hosting providers receive network/device information, including IP addresses, and may keep operational logs. Our application error logs use request identifiers and status codes without deliberately including request bodies or credentials. Hosting/database processing uses OpenAI Sites and Cloudflare; provider log retention and processing locations are not controlled by this page.

Administrator sign-in is handled by the hosting authentication service. Verified user identifiers and role checks protect administration; audit records identify authorized changes. Merchant reports are imported for commission reconciliation, not to collect customer payment details. An external product image, when displayed, is loaded from its image host, which receives a network request. Merchant destinations operate under their own privacy notices.

The @picktrustedone Instagram account uses ManyChat cloud replies. Instagram and ManyChat process messages and relevant account or interaction identifiers under their own privacy notices and permissions. The current default reply asks which product you mean; a product-link reply requires a separately reviewed product and Reel mapping. This website does not receive Instagram message text or sender identifiers from ManyChat. Saved website mappings contain public post IDs and product/campaign identifiers; an admin preview sends no DM. Optional AI interpretation is disabled in production, and the current website workflow sends no shopping brief to an AI provider. Do not send private order details or other sensitive information in an Instagram message.

Contact and issue links open your email application. Sending email shares your address and message with the support mailbox and email providers; the site does not silently submit a complaint form. The operator must review correspondence retention, deleting material no longer needed after resolution except for a necessary legal or security record. Do not send passwords, OTPs, banking details, identity documents or private order histories.

For a data request, include a relevant page and approximate visit time, and explain the request. We may need limited information to locate and verify the record; a name or email alone cannot reliably identify a random browsing session. We do not knowingly solicit children’s data or run child-targeted behavioural profiling. Processing children’s data or introducing health/payment/identity data requires a separate review.

Access controls, origin checks, rate limiting and encrypted HTTPS connections help protect data; no service can promise absolute security. Indian DPDP legislation has staged commencement. This notice describes current practices and does not claim DPDP certification or that every future obligation is already implemented. Applicable statutory rights remain available.