UMAMI PRIVACY POLICY
Effective Date: June 12, 2026
1. Introduction and Scope
This Privacy Policy (“Policy”) describes how Fieldbook Studio, LLC, doing business as Umami (“Umami,” “we,” “us,” or “our”), collects, uses, retains, and discloses information in connection with our consumer market intelligence platform and related services (the “Services”). This Policy
applies to information we collect from: (a) visitors to our websites, including www.madebyumami.com and any other site we operate (collectively, the “Sites”); (b) users who access our customer portal or other Services interfaces (each, a “User”); and (c) information derived from publicly displayed consumer reviews and other publicly available materials we analyze to provide the Services (“Source Data”).
This Policy does not apply to information our customers process using their own systems, or to information that any third-party retailer or review platform may collect about you separately. We are not affiliated with, endorsed by, or licensed by any retailer or review platform whose publicly displayed content we may analyze.
2. Information We Collect
2.1 Information You Provide Directly
When you visit our Sites, register for our Services, or communicate with us, we may collect:
• Contact information (name, business email, company name, job title) you provide when creating an account, requesting a demo, or contacting us;
• Account credentials and authentication information;
• Billing and payment information (which is processed by our third-party payment processor; we do not retain full payment card numbers);
• Customer Data you upload through the Services (subject to the prohibitions on personal data and sensitive information in your Master Services Agreement); and
• Any other information you choose to provide in support requests, surveys, or communications with us.
2.2 Information We Collect Automatically
When you use the Sites or the Services, we automatically collect:
• Device and usage information (browser type, operating system, IP address, device identifiers);
• Log data (pages viewed, features used, timestamps, referring URLs); and
• Cookies and similar technologies (see Section 7).
2.3 Information Derived from Public Sources
Umami operates a proprietary review-capture tool called "Clippr," a Chrome browser extension used by Umami personnel to manually capture screenshots of publicly displayed product detail pages and search results pages on third-party retailer websites. Clippr operates only on pages that
are publicly accessible without login, does not bypass any access control, and is initiated by a human user through deliberate prompts. Umami does not use automated crawlers, headless browsers, or scraping bots in connection with the Services.
Screenshots captured by Clippr are uploaded to a secure storage environment, processed through optical character recognition (OCR), and normalized into structured records using third-party large language model technology. As part of this normalization process, the following ingest-stage controls apply:
• Reviewer display names are removed from each record at the normalization stage. Display names are never retained in cleartext form in our production database.
• A one-way cryptographic hash of the original reviewer display name is generated and stored solely for the purpose of de-duplicating multiple captures of the same review. The hash is not reversible, is not used to identify any individual, and is not included in any Umami deliverable, dashboard, export, or report provided to customers or third parties.
• Other potentially identifying fields (such as reviewer profile photo URLs, reviewer location strings, or reviewer-attributed metadata) are stripped at the ingest stage and not retained.
• Retained content is limited to: the text of the review; the title of the review; the date of the review (normalized to an absolute date); the OCR-derived star rating; the product description, ingredient statement, price, and product image associated with the review; and the de-duplication hash described above.
As a result of these controls, Umami does not retain personal information that identifies any individual reviewer, and Umami Deliverables do not contain any reviewer-identifying information. Umami reserves the right to modify the ingest pipeline at any time, provided that any such modification will be reflected in an update to this Policy.
3. How We Use Information
We use the information described in Section 2 to:
• Provide, operate, maintain, and improve the Services;
• Generate analytic insights, aggregate metrics, sentiment summaries, category and brand health reports, and innovation concept reports (collectively, "Umami Deliverables") for our customers;
• Process payments, manage accounts, and provide customer support;
• Communicate with you about the Services, including updates and security notices;
• Detect, investigate, and prevent fraud, abuse, and security incidents; and
• Comply with our legal obligations.
We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act and Cal. Civ. Code § 1798.140. Because reviewer display names and other reviewer identifiers are removed at the ingest stage as described in Section 2.3, our Umami Deliverables do not contain personal information about any individual reviewer. We do not engage in profiling or automated decision-making that produces legal or similarly significant effects regarding any individual.
4. How We Share Information
We share information only as described in this Policy:
• Service providers and subprocessors. We share information with vendors that provide infrastructure, OCR, normalization, analytics, customer support, and similar services on our behalf. Our current material subprocessors include:
◦ Supabase (database and object storage)
◦ Google Cloud Vision (optical character recognition)
◦ OpenAI and Anthropic (text normalization; configured to opt out of training on inputs to the extent commercially available)
◦ Stripe or comparable payment processor (billing)
• Each subprocessor is bound by contractual obligations to protect the information consistentwith this Policy.
• Customers. We provide Umami Deliverables to our customers, which contain aggregate analytic insights and do not contain personal information about individual reviewers.
• Legal and compliance. We may disclose information if required by law, regulation, subpoena, or court order, or to protect the rights, property, or safety of Umami, our customers, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of all or substantially all of our assets, information may be transferred to the successor entity. We will notify affected customers of any such transfer.
• With your consent. We may share information for any other purpose with your consent.
5. Data Retention
We retain personal information about Users and Site visitors for as long as needed to provide the Services and for a reasonable period thereafter for legitimate business purposes (including audit, compliance, and dispute resolution). Information derived from Source Data, after the ingest-stage
controls described in Section 2.3, is retained as analytic content for as long as it remains useful for providing the Services. The one-way de-duplication hash described in Section 2.3 is retained for the same period and is not associated with any other identifier.
6. Your Choices and Rights
6.1 Users and Site Visitors
If you have an account with us or are a Site visitor in a jurisdiction that grants applicable rights, you may:
• Access, correct, or request deletion of personal information we hold about you;
• Withdraw consent where we rely on consent as a legal basis;
• Opt out of marketing communications by following the unsubscribe link in any marketing
email; and
• Lodge a complaint with the appropriate data protection authority.
To exercise these rights, contact us at the address in Section 11. We will respond within the timeframe required by applicable law.
6.2 Reviewers and Third Parties
We do not retain personal information about individual reviewers on third-party retailer or review platforms (see Section 2.3). If you believe you have been identified in an Umami Deliverable or that information about you is being processed by us in a manner inconsistent with this Policy,
please contact us at the address in Section 11 and we will investigate and respond promptly. If your review has been removed from the third-party platform on which it was originally posted, you may also request that we remove any analytic record derived from that review; we will use reasonable
efforts to honor such requests.
6.3 California Residents
California residents have the right under the California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100 et seq.) and the California Privacy Rights Act to: know what personal information we collect; request access, correction, or deletion of personal information; opt out of any "sale" or
"sharing" of personal information; and not be discriminated against for exercising these rights. As described in this Policy, we do not sell or share personal information. Because we do not retain reviewer-identifying information in our database, requests from California residents concerning
review content will generally be referred to the originating platform; we will honor requests with respect to any information about you we do retain (for example, account information or website usage information).
6.4 Other States with Comprehensive Privacy Laws
Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, and other states with comprehensive consumer privacy laws have rights similar to those described above. To exercise those rights, contact us at the address in Section 11.
7. Cookies and Similar Technologies
We use cookies and similar technologies on our Sites to operate the Sites, remember your preferences, analyze usage, and (where applicable consent has been provided) measure marketing effectiveness. You can control cookies through your browser settings; disabling cookies may affect Site functionality.
8. Security
We implement administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
9. International Transfers
We are based in the United States and process information in the United States. If you access the Services from outside the United States, you understand and consent to the transfer of your information to the United States, which may have different data protection laws than your
jurisdiction. We do not currently market the Services to residents of the European Economic Area, the United Kingdom, or other jurisdictions outside the United States. If you believe you have engaged with the Services from one of those jurisdictions, please contact us so we may evaluate your request appropriately.
10. Changes to This Policy
We may update this Policy from time to time. For material changes that materially diminish your rights or materially expand your obligations, we will provide at least thirty (30) days’ advance notice to customers via email or in-product notice, and you may terminate your Master Services Agreement without penalty in accordance with Section 11.2 of that agreement. For non-material changes (including clarifications, formatting changes, and changes that do not materially affect your rights or obligations), updates will become effective upon posting. The "Last Updated" date at the top of this Policy reflects the most recent revision.
11. Contact Us
To exercise any right described in this Policy, ask a question, or report a concern, please contact us at:
Fieldbook Studio, LLC dba Umami
Attention: Privacy Officer
[privacy@madebyumami.com]
Umami is not a registered data broker in any state. Umami has determined, based on the ingest-stage controls described in Section 2.3, that it does not knowingly collect or sell the personal information of consumers with whom it does not have a direct relationship. Umami will register as
a data broker in any jurisdiction where required if its data practices change in a manner that meets the applicable statutory definition.