1. Data Controller
FoodGrade is developed and operated by Lars Engen ("we", "us", or "FoodGrade"). For any questions about privacy, contact us at: privacy@foodgrade.io
2. Data We Collect
We collect the following information about you:
- Email address — used for sign-in and account communication (stored in Supabase Auth)
- Product scan history — which food products you have scanned (stored in our database)
- Ratings and reviews — text and scores you write (stored in our database)
- Taste profile — calculated automatically from your ratings (stored in our database)
- Activity log — actions in the app used to generate your activity feed
- Anonymous usage statistics — aggregated events without personal identification
3. Legal Basis
We process your personal data on the basis of your contract with us (GDPR art. 6(1)(b)) when you create an account, and on the basis of legitimate interest (art. 6(1)(f)) for anonymous usage statistics. You consent to the processing of taste profile data by using the app.
4. Third-Party Providers
We share data with the following third parties:
- Supabase Inc. — database storage and authentication. Data is stored in the EU (Frankfurt). Supabase is subject to EU Standard Contractual Clauses (SCC).
- Open Food Facts — open food database. We send only barcodes — no personal data.
- OpenRouter Inc. — AI analysis. We send only product data (name, ingredients) — no personal information.
We never sell your personal data to third parties.
5. Retention
We retain your personal data for as long as you have an active account. Anonymous usage statistics are anonymised after 24 months. When you delete your account, all associated personal data is deleted within 30 days.
6. Your Rights (GDPR)
You have the following rights:
- Right of access (art. 15) — you may request a copy of the data we hold about you
- Right to rectification (art. 16) — you may correct inaccurate information in your profile
- Right to erasure (art. 17) — you may delete your account, which results in deletion of your personal data
- Right to restriction (art. 18) — you may request a temporary restriction on processing
- Right to data portability (art. 20) — you may request an export of your data via the admin panel
To exercise your rights, send an email to privacy@foodgrade.io, delete your account directly in the app, or use our web-based account deletion page.
7. Complaints
If you believe we are processing your personal data in breach of GDPR, you have the right to lodge a complaint with the relevant supervisory authority. In Norway: Datatilsynet (datatilsynet.no).
8. Changes to This Policy
We may update this privacy policy as needed. Material changes will be communicated via push notification or email. The date of the latest update is shown at the top of this page.