Check4Eat Privacy Policy

1. Who We Are

The Service is operated under the name Check4Eat.

• Jurisdiction: Greece
• Contact: [email protected]

For privacy requests, please contact us using the email address above.

2. Information We Collect

Check4Eat does not require you to create an account or provide your name, email address, telephone number, or social-media identity to use the Service.

2.1 Device ID

When you first launch the application, Check4Eat generates a unique pseudonymous Device ID.

The Device ID is a randomly generated identifier. It does not itself contain your name, email address, telephone number, or other directly identifying information.

However, because the Device ID allows us to associate information with the same pseudonymous installation over time, it is treated as personal data where applicable under data-protection law.

The Device ID may be used to associate server-side information such as: barcode scans; searches; product interactions; and timestamps associated with those activities.

We do not use the Device ID to identify you by your real-world name.

2.2 Scan, Search, and Product Interaction Data

Depending on how you use the Service, we may process: barcodes scanned; search queries; products viewed; interaction timestamps; and technical information necessary to process those requests.

This information is associated with your pseudonymous Device ID where necessary to provide synchronization and related functionality.

2.3 Dietary and Allergen Preferences

Check4Eat provides optional dietary and allergen settings, including features such as Gluten-Free, Vegan, Vegetarian, Dairy-Free, Low-FODMAP, Palm Oil Free, Nuts, Soy, Milk, Eggs, Sesame, Gluten, warnings concerning ultra-processed foods, and user-selected sugar thresholds.

These preferences are processed locally on your device and are not transmitted to or stored on Check4Eat's servers as part of your Device ID profile. The preferences are used on your device to filter or flag products according to the rules you have selected.

Some dietary or allergen selections may reveal information about a person's health, allergies, intolerances, or medical circumstances. Because these settings remain on your device, Check4Eat does not create a server-side health profile from them. You should nevertheless treat these settings as sensitive personal information.

2.4 Community Submissions

You may voluntarily submit product information to help complete or improve the Check4Eat database. Community Submissions may include: photographs of product packaging; ingredient information; barcode information; product names; other product-related information; and technical information associated with the upload.

Submitted material may be reviewed before being accepted into the Check4Eat database. Approved Community Submissions may be displayed publicly to other users and may become part of the Check4Eat product database. Photos and text you submit may be read automatically by software, including the third-party language models described in section 8, before a moderator reviews them.

Do not upload photographs containing your face, other identifiable people, private documents, addresses, or other personal or sensitive information.

2.5 Technical and Security Information

When you use the Service, our infrastructure may process technical information necessary for operation, security, and abuse prevention, including: IP address; HTTP request information; device type or model; operating-system version; application version; language or locale settings; timestamps; error and server logs; and other standard technical information transmitted during a network request.

Security and network traffic may be processed through infrastructure providers such as Cloudflare.

2.6 Website Data

The Check4Eat website may use essential cookies and technical logs required to operate and secure the website. If optional website analytics such as Google Analytics are introduced, they will only be activated in accordance with applicable consent requirements and our cookie notice. This Privacy Policy will be updated when our website analytics practices materially change.

2.7 Notifications (optional)

If you turn on notifications, we keep your phone's notification address together with your Device ID and the app's language, only to send you notifications. Turning notifications off, or resetting your Device ID, deletes it. Messages are delivered through the Expo service and Apple's or Google's notification services.

3. How We Use Information

We use personal and technical information only for purposes connected with operating, securing, improving, and providing the Service. These purposes include: providing barcode scanning and product-search functionality; displaying product information and scores; synchronizing applicable server-side information; processing and maintaining Community Submissions; maintaining and improving the product database; preventing abuse, fraud, scraping, and malicious activity; protecting the Service against attacks and excessive traffic; troubleshooting technical problems; maintaining Service availability; complying with legal obligations; and defending or exercising legal rights where necessary.

We do not use your dietary or allergen preferences for advertising or profiling because those preferences remain on your device.

4. Legal Bases for Processing

Where the GDPR or similar legislation applies, we rely on the following legal bases as applicable to the particular processing activity.

Service functionality

We process the Device ID and server-side service data where necessary to provide functionality that you request, such as providing scan-related functionality. Legal basis: performance of a contract, Article 6(1)(b) GDPR, where the processing is necessary for the requested Service.

Security and abuse prevention

We process technical information, including IP addresses and network information, to protect the Service against malicious traffic, fraud, scraping, attacks, and abuse. Legal basis: legitimate interests, Article 6(1)(f) GDPR, including maintaining the security, integrity, and availability of the Service.

Community Submissions

We process Community Submissions to review, validate, store, display, maintain, and develop the Check4Eat product database. Legal basis: legitimate interests, Article 6(1)(f) GDPR, including maintaining and improving a useful product-information database. Where a different legal basis is required by applicable law, we will rely on that basis.

Website analytics

If optional analytics are enabled on the website, they will be processed on the basis of consent where consent is legally required.

5. No Server-Side Dietary or Allergen Profile

An important feature of Check4Eat's privacy design is that dietary and allergen preferences remain on your device. For example, selecting “Gluten-Free” or “Nuts” does not cause Check4Eat to store a corresponding server-side profile under your Device ID.

This means that Check4Eat does not intentionally build a server-side profile such as Device ID > Nut allergy or Device ID > Celiac disease from the dietary settings.

6. Automated Product Scoring

Check4Eat may automatically calculate product scores and classifications using product and ingredient information. These may include components such as Nutrition, Additive Assessment, Processing Level, Eco Component, and an overall product score.

These calculations concern food products and their available product data, rather than an assessment of your personality, character, creditworthiness, employment, eligibility, or other personal characteristics.

Dietary and allergen warnings are based on deterministic rules selected by the user and processed locally on the device. The Service does not make legally binding or similarly significant decisions about you based solely on automated processing.

7. Product Data and Third-Party Sources

Check4Eat may use information from sources including: Open Food Facts; public product information; retailer or manufacturer information; community submissions; and other publicly available or licensed sources. Check4Eat may import and process third-party product information in its own database. Third-party data remains subject to the rights, licences, and terms applicable to the respective source.

Open Food Facts

Where Check4Eat retrieves or synchronizes information from Open Food Facts, the relevant product-data requests and/or data synchronization are performed through Check4Eat infrastructure. Check4Eat does not intentionally transmit your personal IP address or Device ID to Open Food Facts as part of an individual barcode lookup. Check4Eat may maintain its own copy or derivative database of product information obtained from Open Food Facts and may subsequently contribute improvements or information to Open Food Facts where appropriate and permitted by the applicable licences and terms.

8. Service Providers and Infrastructure

Check4Eat uses third-party infrastructure providers where necessary to operate the Service.

Contabo

Our backend servers and databases may be hosted using infrastructure provided by Contabo, including infrastructure located in the European Union.

Cloudflare

Cloudflare may process network traffic and IP addresses when providing DNS, CDN, TLS, security, DDoS protection, and related infrastructure services. Cloudflare processing may involve its global network.

AI language models and OCR

When you submit a product photo or correction, our server may use optical character recognition and language models to read the label text and to translate ingredient lists between English and Greek. These may run on our own infrastructure or be provided by third-party AI model providers. The requests are made by our server, not by the app, and contain only the photo or text, not your Device ID or other identifiers. Please do not submit photographs containing personal information (see section 2.4).

No advertising or mobile analytics SDKs

At the time of this Policy, the Check4Eat mobile application does not intentionally include third-party advertising SDKs or mobile analytics SDKs such as Firebase Analytics or Facebook SDK. If this changes, this Privacy Policy and the applicable app-store privacy disclosures will be updated.

9. International Transfers

Check4Eat's primary application and database infrastructure may be located within the European Union. Some service providers, particularly global network-security providers and AI model providers, may process information from locations outside the European Economic Area.

Where personal data is transferred outside the EEA and a transfer mechanism is required, Check4Eat will use an applicable mechanism under Chapter V GDPR, which may include an adequacy decision, Standard Contractual Clauses, or another legally available safeguard.

10. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, subject to legal obligations and legitimate operational requirements.

Device ID data

Server-side information associated with your Device ID may be retained while the Device ID remains active. A Device ID that has not been used for 24 months is treated as inactive, and the server-side information associated with it is deleted.

Device ID reset

You may generate a new Device ID through the application's Device ID reset function. When you reset your Device ID: the application stops using the previous Device ID; the new Device ID is not linked to the previous Device ID; the previous server-side Device ID record is marked for deletion; and associated server-side personal data is scheduled for permanent deletion during the applicable deletion process. Our current deletion process is designed to complete within 30 days.

Technical backups may continue to contain deleted information for up to the applicable 30-day backup-retention cycle. Such backup copies are not restored except where necessary for legitimate technical or legal purposes and are permanently overwritten according to the backup cycle.

Resetting a Device ID does not necessarily delete Community Submissions that have already been approved and incorporated into the public product database. Those submissions may continue to exist independently of the contributor's Device ID.

Security logs

IP addresses and related security logs are normally deleted, anonymized, or otherwise rendered non-personal within 30 days, unless a longer period is necessary for security, legal, or fraud-prevention purposes.

Community Submissions

Approved Community Submissions may be retained indefinitely as part of the public Check4Eat product database.

11. Deletion and Your Privacy Rights

Depending on your location and applicable law, you may have rights including: the right to access your personal data; the right to request correction of inaccurate personal data; the right to request deletion; the right to restrict processing; the right to object to certain processing; the right to withdraw consent where processing is based on consent; the right to data portability where applicable; and the right to lodge a complaint with a competent supervisory authority.

Requests involving a Device ID

Because Check4Eat does not require an email address or user account, the Device ID may be necessary for us to identify the relevant server-side record. You may contact us at [email protected]. Please provide your active Device ID where possible. We may request additional information where reasonably necessary to verify that a request relates to the relevant data.

Community Submissions

Deletion of a Device ID does not necessarily require deletion of Community Submissions that have already become part of the public product database. Where appropriate and legally required, we may remove or anonymize personal information associated with a Community Submission while retaining the underlying product information.

12. Consent

Where Check4Eat relies on consent under applicable law, consent may be withdrawn at any time. Withdrawal of consent does not affect processing that occurred before withdrawal.

Because dietary and allergen preferences are processed locally on your device, you can stop using those preferences by changing or clearing the relevant settings in the application.

13. California and Other U.S. Privacy Rights

Check4Eat does not sell personal information or intentionally share personal information for cross-context behavioral advertising. Depending on whether a particular U.S. privacy law applies to Check4Eat and to your circumstances, you may have additional rights concerning access, deletion, correction, or other uses of personal information. Where such laws apply, Check4Eat will provide the rights and disclosures required by the applicable law.

California residents may contact [email protected] for privacy requests.

14. Children's Privacy

The Service is intended for users aged 16 or older. We do not knowingly design the Service for children under 16. If you believe that a child under the applicable minimum age has provided personal information to Check4Eat, please contact us so that we can investigate and take appropriate action.

15. Security

We use reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, loss, misuse, or disclosure. These measures may include: TLS encryption for data transmitted between the application and our servers; Cloudflare security and DDoS protection; access controls for backend systems; restricted database access; server security controls; rate limiting; monitoring for malicious traffic; and controlled backup and deletion processes.

No internet-based service can guarantee absolute security.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date and, where appropriate, provide additional notice through the Service or website. If a change requires consent under applicable law, we will obtain that consent where required.

17. Supervisory Authority

If you are located in the European Economic Area, you generally have the right to lodge a complaint with the data-protection supervisory authority in your country. The Greek supervisory authority is the Hellenic Data Protection Authority.

18. Contact

For privacy questions, requests, or regulatory inquiries:

• Email: [email protected]
• Service: Check4Eat
• Jurisdiction: Greece