Privacy Policy

1. Who We Are — Data Controller

The data controller responsible for your personal data is:

NomNomVegan Oy
Business ID: [add your Y-tunnus here]
Registered address: Finland
Email: [email protected]
Website: nomnomvegan.com

NomNomVegan Oy operates the NomNomVegan mobile application and website (collectively, the "Service"). We are committed to protecting your privacy and handling your personal data transparently, lawfully, and in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Finnish Data Protection Act (1050/2018), and all other applicable data protection legislation.

If you have any questions, requests, or concerns about how we process your personal data, please contact us at the email address above. We aim to respond to all enquiries within 30 days.

2. Personal Data We Collect

We collect personal data that you provide directly to us, data generated through your use of the Service, and limited technical data collected automatically. We apply data minimisation and only collect what is necessary for the purposes described in this policy.

2.1 Account and Registration Data

• Email address — provided via your Google Account through Firebase Authentication. Used for account identification and optional service communications.
• Display alias (username) — a public nickname you choose when registering. This is visible to other users on the community feed and leaderboard.
• Country and locale — optional country code and language preference you set. Used to serve localised product information and regional community content.
• Firebase UID — a unique identifier assigned by Firebase Authentication. Used internally to link your account across the Service.
• Referral code — if you were referred by another user, we record the referral code to apply scan credit rewards.

2.2 Scan and Usage Data

• Scan history — barcodes you scan, the resulting verdict (vegan / not vegan / uncertain), confidence score, and timestamp. This is associated with your account and stored to provide your personal scan history.
• Product ratings — numerical ratings (1–5) you give to individual products.
• Daily usage counts — the number of scans you perform each day, to enforce and display your daily quota.
• Extra scan balance — any additional scans earned through referrals or contributions.

2.3 Contribution and Feedback Data

• Product contributions — product names, barcodes, claimed vegan status, non-vegan ingredients, and localised names you submit. These become part of the community database and may be publicly visible.
• Product photos — images you upload when contributing a product or submitting feedback. Photos are stored in Cloudflare R2 (EU jurisdiction) and may be publicly displayed within the app.
• Feedback votes — thumbs-up or thumbs-down votes you cast on products, along with an optional written reason. These improve product accuracy and affect trust scores.
• Correction submissions — when you report a verdict as incorrect, we store the correction details including any non-vegan ingredient lists and supporting photos you provide.

2.4 Reputation and Contribution Statistics

• Reputation score and contributor level — a numeric score and level label (newcomer / regular / trusted / super contributor) reflecting your contribution history and community trust. Your level is visible to other users in the community feed.
• Contribution statistics — counts of total, approved, and rejected contributions; feedback counts; and scanning streak data.

2.5 Subscription and Payment Data

• Subscription status — whether you hold an active Pro subscription, and the subscription product ID.
• Purchase token — a token issued by Google Play, stored to verify and track your subscription lifecycle. We do not store payment card details; all billing is handled exclusively by Google Play.
• Subscription events — renewal, cancellation, and expiry events received from Google Play via webhook.

2.6 Shared Content

• Shared scans — if you use our share feature, we create a publicly accessible share page containing your alias, the product, and the verdict. The share link contains a UUID and can be accessed by anyone who holds the link.

2.7 Technical and Log Data

• IP address — logged by our server infrastructure (nginx) for security, rate limiting, and abuse prevention. Cloudflare sits in front of our servers and applies additional proxying; we receive the real client IP after Cloudflare unwrapping.
• API request logs — endpoint called, HTTP status code, and timestamp. Retained for operational monitoring, security incident investigation, and debugging.
• Error reports — application errors and stack traces sent to Sentry (see Section 5). These may include device and OS version information.

3. Legal Basis for Processing

We process your personal data only where we have a valid legal basis under GDPR Article 6. The applicable bases for each processing activity are described below.

Where we rely on legitimate interests (Art. 6(1)(f)), we have conducted a balancing test and concluded that our interests do not override your fundamental rights and freedoms, given the nature of the data processed, your reasonable expectations as a user of a community-driven service, and the safeguards we apply. You have the right to object to processing based on legitimate interests at any time (see Section 9).

4. How We Use Your Data

We use your personal data strictly for the purposes for which it was collected. Specifically:

4.1 Providing and Improving the Service

• Creating and managing your account
• Returning vegan/not-vegan verdicts when you scan a barcode
• Storing and displaying your personal scan history
• Calculating and displaying your personal statistics and streak
• Enforcing and displaying your daily scan quota
• Processing your product contributions and placing them in the moderation queue
• Calculating product trust scores based on weighted community feedback
• Sending in-app notifications about contribution approvals, rejections, and level-ups
• Generating and serving publicly accessible share pages when you share a scan

4.2 Community Features

• Displaying your alias on the community feed when you scan a product
• Operating the contributor leaderboard (global and regional)
• Displaying your public profile page at nomnomvegan.com/profile/{alias}
• Calculating and displaying your reputation level and pioneer scan count

4.3 Safety, Security, and Legal Compliance

• Detecting and preventing abuse, fraud, and unauthorised access
• Applying rate limits to protect the Service from misuse
• Maintaining an audit log of administrative actions
• Responding to and investigating user reports of harmful content
• Complying with applicable laws and responding to valid legal process

4.4 Subscription Management

• Activating and maintaining your Pro subscription status
• Processing renewal, cancellation, and expiry events from Google Play
• Applying the subscriber reputation boost and removing daily scan limits

4.5 What We Do Not Do

• We do not sell your personal data to third parties.
• We do not use your data for targeted advertising or ad profiling.
• We do not share your data with marketing companies.
• We do not use your data for purposes incompatible with those stated in this policy without obtaining your consent.

5. Third-Party Services and Recipients

We use a limited number of carefully selected third-party sub-processors to operate the Service. Each is bound by a data processing agreement or standard contractual clauses where applicable.

We may disclose your personal data to competent authorities, courts, or law enforcement agencies if required by applicable law, court order, or governmental regulation, or if we reasonably believe disclosure is necessary to protect the rights, property, or safety of NomNomVegan Oy, our users, or the public.

In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred as part of the transaction, subject to the same protections described in this policy.

6. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA), specifically in the United States. These transfers occur because Firebase Authentication and Google Play are operated by Google LLC (USA), and Sentry is operated by Functional Software, Inc. (USA).

Where personal data is transferred outside the EEA, we rely on the following safeguards to ensure an adequate level of protection:

• Standard Contractual Clauses (SCCs) — approved by the European Commission under GDPR Article 46(2)(c). Our agreements with Google and Sentry incorporate the EU SCCs.
• EU-US Data Privacy Framework — Google participates in the EU-US Data Privacy Framework as an additional transfer mechanism.

Our primary data storage (PostgreSQL database, Cloudflare R2 photos) is hosted within the EEA (Germany and EU Amsterdam region respectively). We have deliberately chosen EU-hosted infrastructure for primary data storage to minimise the volume of cross-border transfers.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following retention periods apply:

When you delete your account through the app (Settings → Delete my data), we initiate erasure of your account data, scan history, and personal statistics within 30 days. Approved product contributions may be retained in anonymised or pseudonymised form as part of the community database, as they represent a collective resource. We will inform you of this when you submit a deletion request.

8. Security Measures

We take the security of your personal data seriously and have implemented a range of technical and organisational measures consistent with the nature of the data and the risks involved:

8.1 Technical Measures

• Encryption in transit — all data exchanged between the app and our servers is encrypted using TLS 1.2 or higher. HTTPS is enforced with HTTP Strict Transport Security (HSTS).
• Authentication security — user authentication is handled by Firebase Authentication; we verify Firebase JWTs on every authenticated request and never store raw credentials.
• Database isolation — the PostgreSQL database is accessible only within the internal Docker network; no database port is exposed to the internet.
• Redis isolation — our Redis cache requires password authentication and is accessible only within the internal Docker network.
• Rate limiting — API endpoints are rate-limited at both the nginx and application layer to prevent abuse.
• Intrusion prevention — fail2ban is active on the VPS, blocking IP addresses after repeated failed SSH or HTTP attempts.
• Content Security Policy — HTML pages served by the API include Content-Security-Policy headers.
• Input validation — all user-submitted data is validated and sanitised before processing or storage.

8.2 Organisational Measures

• Access to the production server is limited to authorised personnel via SSH key authentication.
• No root passwords are used; SSH key pairs are required.
• Third-party services are evaluated for security and privacy compliance before integration.
• We conduct periodic reviews of access controls and security configuration.

8.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) within 72 hours of becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to your rights, we will also notify you without undue delay, as required by GDPR Article 34.

9. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights. We will respond to all requests within one month. For complex or numerous requests, we may extend this to three months with notice to you.

9.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data along with information about how it is processed. You can request a data export directly from the app (Settings → Request my data).

9.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected without undue delay. You can update your alias, country, and locale directly from the app settings. For other corrections, contact us at [email protected].

9.3 Right to Erasure — "Right to Be Forgotten" (Article 17)

You have the right to request erasure of your personal data where one of the conditions in Article 17 applies (e.g. data no longer necessary for the purpose collected, withdrawal of consent, or objection to processing with no overriding legitimate grounds). You can submit a deletion request from the app (Settings → Delete my data). Note the retention exceptions described in Section 7.

9.4 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict the processing of your data in certain circumstances, such as while we verify the accuracy of data you have contested, or while we assess an objection you have raised.

9.5 Right to Data Portability (Article 20)

Where processing is based on your consent or on a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON), and to transmit it to another controller. Use the in-app data export feature or contact us.

9.6 Right to Object (Article 21)

You have the right to object to processing of your personal data based on our legitimate interests (Article 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, or if the processing is necessary for the establishment, exercise, or defence of legal claims. To object, contact us at [email protected].

9.7 Right Not to Be Subject to Solely Automated Decision-Making (Article 22)

We do not make decisions with significant legal or similarly significant effects based solely on automated processing, without human involvement. See Section 12 for more detail.

9.8 Right to Withdraw Consent

Where we rely on your consent for processing, you have the right to withdraw it at any time without affecting the lawfulness of processing before withdrawal. As described in Section 3, we rely primarily on contract and legitimate interests as our legal basis, not consent.

9.9 Right to Lodge a Complaint

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu):

Office of the Data Protection Ombudsman
PO Box 800, FI-00531 Helsinki, Finland
tietosuoja.fi
[email protected]

We kindly ask that you contact us first, as we would like the opportunity to address your concern before you escalate to a supervisory authority.

10. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. Users in the European Union and European Economic Area should be at least 16 years of age, or have verified parental or guardian consent, to use the Service, in accordance with GDPR Article 8.

If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us at [email protected] and we will take steps to delete such data promptly.

11. Cookies and Tracking

The NomNomVegan Android app does not use browser cookies, as it is a native mobile application. The app uses:

• Encrypted local storage (Android EncryptedSharedPreferences) — to store your Firebase authentication token securely on your device. This data never leaves your device except as part of API requests.
• Local scan counter — a local count of daily scans stored on device, supplementing server-side quota tracking.

The NomNomVegan website (nomnomvegan.com) does not use analytics cookies, advertising cookies, or tracking pixels. We make a single API request to our own server to load community statistics. Google Fonts is loaded from Google's CDN, which may result in Google receiving your IP address as part of the font file request.

Our admin panel uses an HTTP-only, Secure, SameSite=Lax session cookie for authenticated admin sessions only. This cookie is not set for regular users.

12. Automated Decision-Making and Profiling

We use limited automated processing to operate the Service:

• Trust score recalculation — an automated Celery task periodically recalculates product verdict confidence scores based on weighted user feedback. This affects product information displayed to all users but does not produce legal or similarly significant effects on individuals.
• Quota enforcement — daily scan quotas are enforced automatically in real time. If you exceed your daily limit, further scans return HTTP 429 until the next calendar day.
• Contributor level promotion — your contributor level automatically advances from "newcomer" to "regular" at 100 approved contributions, and from "regular" to "trusted" at 200 approved contributions. The "super contributor" level is always granted manually by a human administrator.
• Rate limiting and temporary blocks — our rate limiter (slowapi + Redis) may temporarily block your access if you send an unusually high volume of requests in a short time. These are short-duration blocks applied to protect service availability.

None of these automated processes constitute solely automated decision-making that produces legal effects or similarly significant effects on you within the meaning of GDPR Article 22. If you believe an automated decision has affected you unfairly, contact us and we will review it manually.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Send an in-app notification to registered users for changes that significantly affect their rights or the way we process their data;
• In the case of changes that require your consent, present a consent prompt in the app before they take effect.

We encourage you to review this page periodically. Your continued use of the Service after the effective date of changes constitutes acceptance of the updated policy, to the extent permitted by applicable law.

14. Contact Us

If you have any questions, requests, or complaints about this Privacy Policy or the way we process your personal data, please contact us:

NomNomVegan Oy — Data Protection Contact
Email: [email protected]
Website: nomnomvegan.com

We aim to acknowledge all enquiries within 5 business days and provide a substantive response within 30 days. For complex matters, we will inform you if we need up to three months to respond.

You may also use the in-app features under Settings → Privacy & Data to submit GDPR data access and deletion requests directly.