Privacy policy

The controller is DATAFLOW, informacijske in podatkovne rešitve, d.o.o., Krpanova ulica 3, 6310 Izola - Isola, Slovenia, company registration number 7447035000. For privacy questions, write to info@biteunboxed.com.

We process a random technical identity and session data, private scan history, submissions and corrections, voluntarily added prices and stores, suggestions, and packaging photos. Infrastructure providers may also receive your IP address, access time, device type and technical logs.

We do not request GPS location, contacts or photos of people. Photos should not contain faces, receipts, addresses or other personal data.

We use data to search for and display products, manage submissions, prevent duplicates and abuse, carry out admin review, respond to privacy requests and maintain security. The legal bases are performance of the service at your request, our legitimate interest in security and improving the service, and consent for the public publication of photos.

Photos are re-encoded and stripped of metadata before upload. They remain private until an admin decision. The front photo, ingredients photo and nutrition table photo become public only if the user explicitly allows this when submitting and the admin approves them.

After approval, the private originals are removed and the public copy remains until permission is withdrawn. For rejected or withdrawn submissions, private photos are removed when the submission is deleted or when the request is processed.

AI reading is triggered explicitly by the user or the admin. The AI provider receives only the photos or text needed to prepare a draft. AI does not determine the score on its own, and the draft is not automatically approved or published. We do not guess data that could not be read.

• Supabase – database, technical identity, server functions and storage;
• OpenAI – only requested AI processing of photos or text;
• Open Food Facts – lookup of external product data;
• Google Mobile Ads – disabled in the current release.

Some providers may process data outside the European Economic Area. In such cases, the provider’s applicable safeguards and contractual terms are used, such as an adequacy decision or standard contractual clauses where required.

We keep private scan history, pending or rejected submissions, private photos, technical logs and AI jobs for no longer than 30 days, after which they are deleted or anonymised. Backups are kept for no longer than 30 days.

Publicly approved product data, permitted public photos, community prices and a non-personal audit trail are part of the public database and are not automatically deleted after 30 days. They are removed when permission is withdrawn, upon a justified request, or when no longer needed.

You may request access, rectification, erasure, restriction of processing, data portability and object to processing, and you may withdraw permission for public photos at any time. Withdrawal does not affect the lawfulness of past processing. If you believe the processing is unlawful, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia.

Open Food Facts data and photos are labelled with their source in the app. Imports remain marked as unverified and do not overwrite an already verified product. The Open Food Facts database is available under the ODbL licence, database contents under the DbCL, and photos generally under CC BY-SA; individual images may also be subject to copyright, trademarks and additional terms.

To delete your private history, submissions and private photos, you can submit a request in the app or by email. A request made in the app is linked to your current technical identity. To withdraw a public photo, include the product EAN and describe the photo in your message.

Contact: info@biteunboxed.com. Before deletion we may ask for information strictly necessary to reliably link the request to the correct record.