Privacy Policy

Last updated: August 15, 2026

Introduction

GlutenScan is a mobile application that uses artificial intelligence to read visible ingredient label text and flag declared gluten sources, allergen statements, and terms that may need a closer look. This privacy policy explains how we collect, use, store, and protect your personal information when you use our service.

We are committed to protecting your privacy and being transparent about our data practices. This policy describes the minimal data we collect and how it is used to provide label-review services.

Data Controller: Delpha Labs, France
Contact: delphalabs@gmail.com

Legal Basis for Processing

We process your personal data under the following legal bases (as required by GDPR):

  • Contractual necessity: Processing your photos for label review and managing your account are necessary to provide the service you signed up for.
  • Legitimate interest: We use proportionate service-security, reliability, and product-usage information to operate and improve the service where permitted by law.
  • Consent: You consent to data processing when you sign in and use the service.

Data Collection

GlutenScan collects the following types of data:

  • Photos: When you upload a photo of an ingredient label, we process the image using our AI service. Original full-resolution images are not stored on our servers. Only a compressed thumbnail may be saved for your scan history.
  • User Account: If you sign in, Firebase Authentication and the selected sign-in provider process identifiers such as your Firebase user ID, email address, display name, and profile photo URL when available.
  • Scan History: We may store information about your scans, including a compressed thumbnail, extracted label text, detected ingredients, result, favorites, timestamps, and processing metadata.
  • Subscription Data: Purchases are processed by Apple and subscription entitlement data is managed through RevenueCat. We do not receive your complete payment-card details.
  • Device Identifier: Before account creation, the app uses Apple's identifier for vendor to enforce the one-scan anonymous limit and reduce quota abuse.
  • Analytics and Diagnostics: Google Analytics measures website traffic. If mobile analytics or crash reporting is enabled, PostHog may process app usage events and account identifiers, and Sentry may process diagnostics and crash context. The current production configuration and App Store privacy disclosures must identify any enabled service.

What we do NOT collect:

  • Original full-resolution images
  • EXIF metadata from photos (location, camera settings, etc.)
  • IP addresses as an app profile field; infrastructure and service providers may still process network addresses for delivery, security, fraud prevention, and logs
  • Payment card details
  • Health or medical records
  • Personal information beyond what is necessary for the service

Data Usage

We use the data we collect for the following purposes:

  • Label Review: Your photos are sent to an AI service (OpenAI API) to read ingredient labels and flag declared gluten sources or terms that may need a closer look. This is the core functionality of our service.
  • Scan History: We store your scan history so you can access previously scanned products within the app.
  • Service Improvement: We use configured product-usage and diagnostic data to improve reliability and user experience.
  • Account Management: Your email address is used to manage your account, enforce scan quotas, and provide customer support if needed.

Data Storage

Core scan records use Firebase and Google Cloud services, while authentication, AI processing, subscriptions, and any enabled analytics or diagnostics also involve the providers listed below:

  • Location: Firestore and Cloud Functions are configured in a European region. Firebase Authentication and third-party providers may process data in other regions under their applicable transfer safeguards.
  • Thumbnails: Small thumbnail images are stored in Firebase Storage and associated with your account.
  • Scan Data: Scan results, timestamps, and metadata are stored in Firestore.
  • Authentication: User account information is managed by Firebase Authentication.

All data is encrypted in transit and at rest using Firebase's built-in security measures.

Data Retention

  • Scan data and thumbnails are retained until you delete them individually or delete your account.
  • Account data is deleted immediately upon account deletion request.
  • Website analytics, mobile analytics, diagnostics, security logs, and subscription records follow the retention controls of the applicable provider and may not be deleted at exactly the same time as active app data.

In-app account deletion removes active GlutenScan scan records, thumbnails, quota records, and the Firebase Authentication user. Limited records may remain temporarily in provider backups, security logs, fraud-prevention systems, or records that Apple and RevenueCat must retain for purchase administration. Contact us if you also want an analytics deletion request handled where applicable.

Data Sharing

We share data only with the following third-party services that are necessary to provide our functionality:

  • OpenAI: Photos are sent to OpenAI's API for ingredient label reading and label review. OpenAI's API terms state that data submitted via the API is not used for model training. We do not send any personal information beyond the image itself. OpenAI Privacy Policy
  • Google (Firebase & Analytics): Firebase provides authentication, database, storage, and backend infrastructure; Google Analytics measures website traffic. Google Privacy Policy
  • Apple and Google sign-in: Your selected identity provider processes authentication information.
  • RevenueCat: RevenueCat manages subscription products and entitlement status. RevenueCat Privacy Policy
  • PostHog and Sentry: If enabled in the shipped app, these providers process product-usage events or crash diagnostics. Their use will be reflected in the App Store privacy disclosure.

We do not sell your data to third parties. We do not share your personal information with advertisers, data brokers, or any other parties for marketing purposes.

Your Rights

You have the following rights regarding your personal data:

  • Access: You can access all your personal data, including your scan history, through the app.
  • Deletion: You can delete individual scans from your history at any time within the app.
  • Account Deletion: You can delete your account and all associated data at any time.
  • Rectification: You can request correction of any inaccurate personal data.
  • Restriction: You can request that we restrict processing of your data in certain circumstances.
  • Complaint: You have the right to lodge a complaint with a supervisory authority (in France, this is the CNIL — cnil.fr).

To exercise any of these rights, please contact us at delphalabs@gmail.com.

Children's Privacy

GlutenScan is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us at delphalabs@gmail.com and we will promptly delete it.

Security

We take security seriously and implement the following measures to protect your data:

  • Authentication: All user accounts are protected by Firebase Authentication with industry-standard security practices.
  • Secure API Endpoints: All API endpoints use HTTPS encryption to protect data in transit.
  • Data Encryption: All data stored in Firebase is encrypted at rest using Google Cloud's encryption standards.
  • Access Controls: Data access is restricted to authenticated users and scoped to their own account data only.

Medical Disclaimer

GlutenScan is an informational tool and is not a medical device. It should not be used as a substitute for professional medical advice, diagnosis, or treatment. The label-review results are generated by AI and may be incorrect or incomplete. Always consult your doctor or dietitian for medical decisions related to celiac disease or gluten intolerance.

Contact

If you have any questions, concerns, or requests regarding this privacy policy or how we handle your data, please contact us at:

Email: delphalabs@gmail.com

We will respond to your inquiry within 7 business days.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new privacy policy on this page and updating the "Last updated" date.

Your continued use of GlutenScan after any changes to this privacy policy constitutes your acceptance of the updated policy.