Privacy Policy

This policy explains what information Ellagens collects, how it's used, and your rights - in plain English. Ellagens is operated as a personal project based in the United Kingdom, and this policy is written to comply with UK GDPR and the Data Protection Act 2018. Ellagens is used by people all over the world, and we apply these same protections to everyone who uses the App, wherever you're located.

1. What we collect

Stored on your device (not on our servers):

• Your allergen profile - the allergens you add to your profile are stored in your browser's local storage. We can't access or see your saved profile. When you run a scan, the allergens being checked are included with that request so the result can be tailored to you - they're used only to produce your result and are not stored by us or linked to you.
• App preferences - such as your selected language and whether you've completed onboarding.
• Scan History (Premium only) - if you subscribe to Premium, a record of your past scans (a small image thumbnail, the result text, and which allergens were flagged) is kept in your browser's local storage so you can look back at previous scans. This stays on your device only, capped at your 50 most recent scans, and you can clear it at any time from within the app.
• Other Profiles (Premium only) - if you subscribe to Premium, you can create additional profiles to manage allergies for other people you travel with (such as a partner or child). Their name and allergens are stored in your browser's local storage in the same way as your own - this data is provided by you and stays on your device. Their name is never sent to us; when you scan for them, only the allergens being checked are included with the request, in the same way as for your own scans.

When you use the scan feature:

• Photos or images you choose to scan are sent to our server and passed to an AI service provider for analysis. The AI processes the image to identify ingredients and allergens and returns a result. Images are not stored by us beyond what is needed to process your request.
• When you scan a barcode, the barcode number is sent to Open Food Facts - a public food database - to retrieve product information. No personal data is sent alongside it.

If you choose to sign in (optional - you don't need an account to use the free app):

• Your email address - the only personal detail we collect. It's used to sign you in with a one-time code, to send you that code, and to link Premium to your account so it follows you across devices, if you have it. You can sign in whether or not you're subscribed to Premium, for example to check whether a purchase made on another device applies here too.

When you visit:

• Your IP address - when you open Ellagens, your IP address is used to work out your approximate country, because Ellagens isn't available in some regions yet. It's processed only for that check, kept only briefly, and not linked to you.

Only if you subscribe to Premium:

• Your subscription status - which plan you are on and whether it is active - so we can unlock Premium features for you. This is stored securely by our database provider.
• Payment details - handled entirely by our payment provider, Stripe. Your card number and billing details are entered directly with Stripe and are never seen or stored by Ellagens. If you buy Premium, we also email you a receipt and renewal notices at the email address you gave.

2. What we don't collect

• You don't need an account to use Ellagens for free - signing in is entirely optional, and only needed if you want Premium (or a future purchase) to follow you across devices
• Even if you sign in, the only personal detail we collect is your email
• We do not use advertising trackers or sell your data to third parties
• We do not store your allergen profile on our servers
• We do not use cookies for advertising or cross-site tracking

3. Why we process your data

When you use the scan feature, images are processed under the lawful basis of legitimate interests - specifically, to provide the core service you have actively requested (identifying allergens in your food). You are always in control: no scan happens without you actively taking or uploading a photo.

Automated processing. The result you see - the identified ingredients and any allergen flags - is generated automatically by AI, without a human reviewing it first. Ellagens doesn't make any decision on your behalf; you always make the final call on what to eat based on the result shown, and you can always double-check with the vendor, restaurant, or manufacturer directly.

4. Cookies & analytics

With your consent, Ellagens uses Google Analytics to understand how the App is used - for example, which pages are visited and roughly how many people use the App - so we can improve it. This sets a small cookie in your browser.

You choose whether this happens: on your first visit, you're asked to Accept or Decline. If you decline, no analytics cookie is set and no data is sent to Google. Google Analytics data is aggregated and does not include your name, email, or allergen information, and we do not use it for advertising.

5. Third-party services

We use a small number of trusted service providers to run Ellagens. They only process data on our behalf, to provide the service:

AI service provider - processes scan images to identify ingredients and allergens.

Open Food Facts - a public database used for barcode lookups. Their privacy policy is available at world.openfoodfacts.org/privacy.

Hosting provider - hosts Ellagens and may keep standard server access logs (IP address, request timestamp) as part of normal operations. These logs are not used to identify individuals and are retained only as long as operationally necessary.

Account and database provider - used whenever you choose to sign in (with or without Premium) to store your account email, and also your subscription status if you're on Premium, so we can sign you in and unlock Premium features.

Email delivery provider - sends your sign-in codes and, if you subscribe to Premium, your receipts and renewal notices.

Location-check service - receives your IP address only to return your approximate country (see Section 1).

Stripe - our payment provider, used only if you subscribe to Premium. Stripe securely processes your payment and card details on our behalf; we never receive your full card number. Stripe's privacy policy is available at stripe.com/privacy.

Google Analytics - used only if you consent to analytics cookies, to help us understand how the App is used. Google's privacy policy is available at policies.google.com/privacy.

6. International use

Ellagens is available to use from anywhere in the world. Wherever you're based, we apply the same standards described in this policy to your data - we don't offer a lower level of protection to users outside the UK.

Some of the providers we use to run Ellagens (see Section 5) operate infrastructure in different countries - for example, our database provider hosts data in the EU (Ireland), while our AI and analytics providers may process data in the United States. Where your data is processed outside the country you're in, it's handled under that provider's own safeguards, which are designed to meet UK/EU data protection standards.

If you're in the European Union, you have the right to lodge a complaint with your own national data protection authority, in addition to the UK's ICO. If you're outside the UK and EU, you may also have data protection rights under your own local law, which this policy doesn't remove or replace.

7. Your rights under UK GDPR

We extend the following rights to all users of Ellagens, regardless of where you're located, in addition to what UK GDPR specifically requires:

• Access - request a copy of any personal data we hold about you
• Erasure - request deletion of your data. Because your allergen profile is stored only on your device, you can delete it at any time by clearing your browser's local storage or using the app's reset option
• Portability - receive your data in a portable format
• Object - object to processing where we rely on legitimate interests
• Complain - lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or your own local authority if you're in the EU (see Section 6)

8. Data retention

Images submitted for scanning are not retained by Ellagens beyond the immediate processing of your request. Your allergen profile and preferences are stored on your device until you clear your browser data or reset the app. If you subscribe to Premium, Scan History and Other Profiles are also kept only on your device - capped at your 50 most recent scans - until you clear them or clear your browser data. If you sign in, your email (and, for Premium, your subscription status) is kept for as long as you have an account, and we delete it if you ask us to.

9. Children's privacy

Many people use Ellagens to keep a child safe, so we want to be clear about how children's information is handled.

• Parents and carers can use Ellagens to check food for a child's allergies, including adding a child as an Other Profile (Premium). That information is stored on your device, as described in Section 1.
• Children under 13 should not sign in, create an account or buy Premium. We do not knowingly collect email addresses from children under 13.
• If you are under 18, please use Ellagens with the involvement of a parent or guardian, as set out in our Terms.
• If you believe a child under 13 has given us their email address, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date at the top will always reflect the most recent version. Continued use of the App after changes are posted means you accept the revised policy.

11. Contact

For any privacy-related questions or to exercise your rights, please reach out via the contact details on our About page.