App Logo

BiteScore AI

Privacy Policy

Privacy Policy — BiteScore AI

Last Updated: May 31, 2026

1. Introduction

BiteScore AI ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

This policy applies to all users of the BiteScore AI app and website, including guest users.

2. Data We Collect

2.1 Account Data (Registered Users)

  • Email address
  • Name (if provided)
  • Password (stored as a cryptographic hash — never in plain text)
  • Plan type (Free, Pro, or Premium)
  • Account creation date

2.2 Usage Data

  • Food items and labels scanned
  • Scan history and timestamps
  • Features accessed and frequency of use
  • Device type, operating system, and app version
  • IP address and general geographic region (country/state level)

2.3 Guest Users

If you use the Service without creating an account, we collect:

  • Scans performed during the session, associated with an anonymous session identifier
  • Device type and IP address

Guest scan data is not linked to any personal identity. We retain it for a maximum of 30 days for service improvement purposes, after which it is deleted or permanently anonymized.

2.4 Payment Data

Payments are processed by a third-party provider (e.g., Stripe). We do not store your full credit card number, CVV, or bank details. We receive only:

  • Transaction confirmation and amount
  • Billing country
  • Last 4 digits of your card (for your reference)

2.5 Health-Related Data

Food scans may indirectly reflect dietary preferences or health conditions. We treat all scan data as sensitive and apply the same protections we apply to health data. We do not sell, share, or use scan data for advertising profiling.

3. How We Use Your Data

| Purpose | Legal Basis | |---|---| | Providing and improving the Service | Contract performance | | Scan history and personalization | Legitimate interest / consent | | Account management and support | Contract performance | | Security and fraud prevention | Legitimate interest | | Aggregated analytics (anonymized) | Legitimate interest | | Legal compliance | Legal obligation |

We do not use your data for:

  • Selling to third parties
  • Targeted advertising
  • Insurance or employment profiling

4. Data Sharing

We share data only in these limited circumstances:

  • Service providers: Hosting, database, and payment processors who are contractually bound to protect your data (e.g., Supabase, Stripe)
  • AI/analysis services: Food label images or text may be processed by AI providers (e.g., Anthropic, Google) solely to return nutritional results — not stored by them for training without your consent
  • Legal requirements: If required by law, court order, or to protect user safety
  • Business transfer: If BiteScore AI is acquired or merged, users will be notified and data transferred under equivalent protections

5. Data Retention

| Data Type | Retention Period | |---|---| | Account data | Until account deletion, + 30 days | | Scan history (registered users) | Until account deletion | | Guest scan data | 30 days, then deleted/anonymized | | Payment records | 7 years (legal/tax obligation) | | Server logs | 90 days |

6. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your account and associated data
  • Export your data in a portable format
  • Opt out of non-essential data processing
  • Withdraw consent at any time

California residents (CCPA): You have the right to know what data we collect, the right to delete it, and the right to opt out of sale (we do not sell data).

EU/UK residents (GDPR): You have the rights listed above plus the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at: {SUPPORT_EMAIL}

We will respond within 30 days.

7. Data Security

We implement industry-standard safeguards including:

  • Encryption in transit (TLS/HTTPS)
  • Encryption at rest for sensitive fields
  • Access controls and authentication requirements for internal systems
  • Regular security reviews

No system is 100% secure. If a data breach occurs that affects your personal data, we will notify you within 72 hours of becoming aware, as required by applicable law.

8. Children's Privacy

BiteScore AI is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

9. Third-Party Links

The Service may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies.

10. Changes to This Policy

We will notify you of material changes via email or in-app notification at least 30 days before they take effect. The "Last Updated" date at the top reflects the most recent revision.

11. Contact Us

For privacy questions, data requests, or concerns:

Email: {SUPPORT_EMAIL}

Address: [Your Company Address]