Privacy Policy

1. Who is responsible

The controller is Xprofit OÜ, registry code 14662029, VAT number EE102244366, Pae tn 21, 11415 Tallinn, Estonia (brand ScanPal).
Contact for privacy questions: support@scanpal.app.
We have not appointed a data protection officer.

2. Why we use your data and on what legal basis

Purpose	Data	Legal basis
Create and run your account and sign-in (e-mail link, Telegram)	e-mail address, Telegram ID, name and username, session data	Contract (Art. 6(1)(b) GDPR)
Scanning, history, favourites, pantry, settings	barcodes, scan history, favourites, pantry items, preferences	Contract (Art. 6(1)(b) GDPR)
AI features you request (photo analysis, freshness, product analysis, receipt scan, web search, Deep Research)	photos, receipt images, product texts, your queries	Contract (Art. 6(1)(b) GDPR)
Personal warnings, adjusted scores and tips based on your allergies, intolerances, health conditions, health goals, skin profile and religious diet (halal, kosher)	health information; religious diet choice	Your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR)
Payments, AI credits, refunds, withdrawals, complaints	plan, amounts, credit balance and credit events, consent and withdrawal records, messages	Contract (Art. 6(1)(b) GDPR); legal obligations (Art. 6(1)(c) GDPR)
Product contributions and points	product data and photos you submit, points	Contract (Art. 6(1)(b) GDPR)
Security, abuse and fraud prevention, rate limiting, error monitoring	IP address, device and browser data, logs, error reports	Legitimate interest in keeping the Service secure and working (Art. 6(1)(f) GDPR)
News about ScanPal features and offers by e-mail (only if you agreed)	e-mail address	Consent (Art. 6(1)(a) GDPR); withdraw at any time in Settings or with the link in every e-mail
Push notifications you switched on (contribution processed, pantry expiry, report ready)	push subscription	Contract (Art. 6(1)(b) GDPR); switched on only with your permission in the browser
Proving consents and defending legal claims	consent and acknowledgement records	Legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR)
Handling reports about product content (for example wrong allergen information or illegal content) and support requests	your report or message, name and e-mail address if you give them, account ID if you are signed in, IP address	Reports: legal obligation (Art. 6(1)(c) GDPR, Art. 16 Digital Services Act). Support requests: contract (Art. 6(1)(b) GDPR) or, if you have no account, our legitimate interest in answering you (Art. 6(1)(f) GDPR)

An e-mail address or Telegram sign-in is needed to create an account and to buy. Health information is optional; without it you get non-personalised results.

3. Health information and religious diet

Allergies, intolerances, health conditions, health goals and your skin profile are health information. A halal or kosher diet can reveal your religious beliefs. These are special categories of personal data, and we process them only with your explicit consent.
We process them only with your explicit consent, only for the features above, and never for advertising.
For AI tips, the relevant parts are sent to our AI provider OpenAI (section 5).
Tips use only the parts of your profile that matter for the product category; for pet food, for example, only your pet's profile is used.
You can withdraw consent at any time in Settings → Health Profile → Withdraw consent; we then delete this information. Withdrawal does not affect processing before it.

4. Automated processing

Scores, warnings and AI results are produced automatically from product data and, if you consented, your health information.
They are information for you. They do not produce legal or similarly significant effects, and no decision about you (such as access to the Service or prices) is made this way.
You can ask us how a score or warning was produced.

5. Recipients

We use these service providers, who process data on our behalf under data processing agreements unless stated otherwise:

OVH SAS (France): hosting.
Backblaze, Inc. (USA): encrypted backups; data is encrypted with our key before upload.
OpenAI (contracting party for the EEA: OpenAI Ireland Ltd, Ireland; processing may take place in the USA): AI analysis, text recognition, translation of product texts, web search, Deep Research. OpenAI does not use our API data to train its models. Where the API allows it, we switch off storage of requests; otherwise OpenAI may keep them for up to 30 days for abuse monitoring.
Functional Software, Inc. (Sentry, USA; data stored in the EU): error monitoring with personal data removed where possible.
Migadu (Switzerland): e-mail delivery.
Browser push services (for example Google, Apple, Mozilla, Microsoft): to deliver notifications you switched on.

The following act as independent controllers:

Stripe and Link (Stripe's merchant-of-record service): collecting payments, VAT, receipts, fraud prevention and payment disputes. See the privacy policies of Stripe and Link.
Telegram, if you sign in with Telegram. Telegram processes the data you enter in its login window under its own policy, outside the European Economic Area (EEA). If you sign in with Telegram, we may send you messages about ScanPal through our Telegram bot.

Product catalog

Products and photos you contribute become part of the ScanPal product catalog. They are shown to all ScanPal users and to partner services using the same catalog (currently the asu.fit app).
We do not publish your name or e-mail with a contribution.

Product databases

When you look up a product, your browser sends the barcode directly to Open Food Facts, Open Beauty Facts, Open Pet Food Facts, Open Products Facts (France) and UPCitemdb (USA). Product images are loaded directly from the site that hosts them, mostly Open Food Facts, sometimes a shop or another product database. These services receive your IP address.
Our server looks up barcodes and product names at FatSecret, USDA and other databases without your personal data.
About 1.06 million product entries in our catalog come from the open databases Open Food Facts, Open Beauty Facts, Open Pet Food Facts and Open Products Facts (data under the Open Database Licence (ODbL), images under the Creative Commons Attribution-ShareAlike licence (CC BY-SA)) and from USDA FoodData Central (public domain). Some entries are added by users of partner apps that use the same catalog (currently asu.fit); we receive only the product data and photos, without those users' names or e-mail addresses.

We disclose data to authorities only where the law requires it.

6. Transfers outside the EEA

Sentry and Backblaze are certified under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Stripe and Link (Stripe's merchant-of-record service) process payment data as independent controllers and explain their own transfers in their privacy policies.
For OpenAI we use the European Commission's Standard Contractual Clauses (Art. 46 GDPR), which are part of OpenAI's data processing addendum.
Migadu is in Switzerland, which the European Commission has found to provide adequate protection.
You can ask for a copy of the safeguards at support@scanpal.app.

7. How long we keep data

Data	Retention
Account, scan history, favourites, pantry, settings, health information, Deep Research questions and reports	Until you delete them or your account; deleted immediately when you delete the account
Server logs	Overwritten automatically by size-limited log rotation
Backups	Up to 7 days on our server and up to 30 days in encrypted off-site backups
Sessions / “remember me”	90 days after last use / 1 year
AI credit events	180 days
Photo analysis results and image fingerprint	90 days
Original photos of contributed products	Deleted 72 hours after processing (kept during manual review); a small thumbnail stays with the product entry
Data at OpenAI	Up to 30 days
Purchase, order, withdrawal and cancellation records	7 years from the end of the financial year (accounting rules). If you delete your account, we keep them with your e-mail address as evidence, but remove the link to your account, your name, IP address and browser data.
Marketing consent	Until withdrawn
Consent records	3 years after you withdraw the consent or delete your account; after account deletion kept without your e-mail, IP address or browser data
Reports about product content and support requests	2 years after the report or request is closed
Records of AI use (feature, time, credits, search query)	13 months; if you delete your account, the link to your account is removed at once
Error reports (Sentry)	As long as needed to find and fix the error; then deleted automatically at the end of the retention period set in our Sentry account

8. Your rights

You can access your data and download a copy (Settings → Account → Download my data), correct it, delete your account (Settings → Account → Delete account), restrict processing, and receive your data in a machine-readable format. If you delete your account while a Premium subscription is active, the subscription ends at once without a refund for the unused part of the paid period; your 14-day right of withdrawal is not affected, and you can instead cancel the subscription and keep Premium until the period ends.
Where we rely on consent, you can withdraw it at any time.
Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and at any time to the use of your data for direct marketing.
Write to support@scanpal.app; we reply within one month.
You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): Tatari 39, 10134 Tallinn, Estonia; +372 627 4135; info@aki.ee; www.aki.ee. You may also complain to the data protection authority in your country.

9. Security

We use encrypted connections (HTTPS), encrypted off-site backups, access restricted to authorised persons, and rate limiting against abuse. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.

10. Children

ScanPal is intended for users aged 16 and over. If you are under 16, do not create an account or enter health information.

11. Changes

If we make material changes, we tell you in the app or by e-mail before they take effect.