Legal

Privacy Policy

Plain-language summary of what Labely collects, why, who we share it with, and the choices you have. Last updated May 8, 2026.

This Privacy Policy explains how Labely (“Labely”, “we”, “our” or “us”) handles personal information when you use the Labely mobile app for iOS (distributed via the Apple App Store), the Labely mobile app for Android (distributed via Google Play), and the website at labelyai.com (together, the “Services”). Labely is operated from Romania.

We try to keep this policy short, specific and honest. If anything here is unclear, email support@labelyai.com and we will explain.

1. Quick summary

  • You can try Labely with a 3-day free trial. After the trial, a paid subscription is required for continued use of the Services.
  • Camera frames are processed on your device. We do not upload raw camera images.
  • We do not sell personal information and we do not share it for cross-context behavioral advertising.
  • You can delete your account and associated data from inside the app, or by emailing support@labelyai.com.

2. Information we collect

a. Account information

  • Email address if you choose to create an account, sign in, or contact support.
  • Authentication identifiers issued by our authentication provider (Supabase) so we can keep you signed in (an opaque user ID and session token). We do not store passwords in plain text.

b. Profile and preferences

  • Allergies, dietary preferences (for example vegan, keto, halal), and personal goals you choose to set inside the app.
  • These values are used only to personalize ingredient flags and informational insights for you.

c. Scan and product data

  • Barcodes you scan, the product identifiers they map to, and the ingredient/nutrition results returned for that product.
  • Ingredient text you type or paste in for analysis.
  • Scan history. If you use Labely without an account, your scan history is kept only on your device. If you sign in, your scan history may be synced to our backend (Supabase) so it follows you across devices. You can clear it from inside the app at any time.
  • Camera input. The camera is used to read barcodes. Live camera frames are processed on your device and are not uploaded to us.

d. AI analysis input and output

  • When ingredient analysis requires our servers, we send the product identifier and/or ingredient text (plus your allergy and diet preferences, if you set them) to Google AI / Gemini, which acts as our AI processor under a data-processing agreement.
  • We do not send your raw camera frames, your email address, your name or your account ID to AI processors with the ingredient text.
  • We do not allow AI providers to use your inputs to train their public models.

e. Subscription and purchase data

  • Paid subscriptions are processed entirely by the Apple App Store (on iOS) or Google Play (on Android). Labely does not see or store your full payment card or bank details.
  • We use RevenueCatas our subscription entitlement provider. RevenueCat receives a transaction identifier and store-level subscription status (for example, “in trial”, “active” or “expired”) so we can unlock your features and let you restore purchases across devices.
  • The Apple App Store and Google Play each apply their own privacy policies to purchases.

f. Communications and support

  • When you contact support@labelyai.com or use the contact form on the website, we receive your name, email and the contents of your message so we can reply.

g. Device, app and diagnostic data

  • Device model, mobile operating system (iOS or Android) and version, app version, language and region, anonymized crash reports, and basic in-app event analytics (for example, “scan completed”).
  • These signals help us fix bugs, measure reliability and improve features. We do not link them to advertising profiles.
  • You can disable optional analytics from within the app’s Privacy settings.

h. Website data

  • The labelyai.com website uses a small number of essential cookies and basic, privacy-respecting analytics to count visits and improve the site. The website does not use advertising trackers.

i. Information we do not collect

  • We do not access your contacts, photos library, microphone audio recordings, precise location, health records or advertising identifiers.
  • We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

3. How we use your information

  • To provide scanning, ingredient analysis and informational insights.
  • To personalize results based on the allergies, diet and goals you set.
  • To create and protect your account, including preventing fraud, abuse and security incidents.
  • To deliver, restore and renew subscriptions you purchase.
  • To diagnose problems, measure performance and improve the app.
  • To communicate with you about your account, support requests and important service changes. We do not send marketing email without your consent.
  • To comply with legal obligations.

4. Legal bases (EEA, UK and similar regions)

If you are in the European Economic Area, the United Kingdom or another region with similar laws, we rely on the following legal bases:

  • Performance of a contract — to provide the core Services you ask us for, including running scans and syncing data to your account.
  • Legitimate interests — to keep the Services secure, prevent abuse, debug crashes and measure aggregate usage. We balance these interests against your privacy.
  • Consent — for optional analytics and any future marketing communications. You can withdraw consent at any time.
  • Legal obligation — when we are required to process information by law.

5. Subprocessors and providers

We share personal information only with the categories of recipients below, and only as needed to operate the Services. We do not sell personal information.

  • Supabase — backend, database, authentication and secure storage for accounts and synced scan history.
  • Google AI / Gemini — AI ingredient analysis and plain-language explanations from product data.
  • RevenueCat — subscription entitlement management and cross-device restore.
  • Apple App Store and Google Play — payments and subscription billing under their own terms.
  • Crash reporting and analytics providers that help us diagnose bugs and understand aggregate, non-identifying usage.
  • Email and support tooling that helps us respond to your messages.
  • Legal and safety — we may disclose information when required by valid legal process, to protect users, or to enforce our Terms.
  • Business transfers — if Labely is involved in a merger, acquisition or asset sale, information may be transferred to the successor entity, which must continue to honor this policy or notify you of changes.

All providers act as our processors under written agreements that limit their use of your information to operating the Services for us.

6. Data retention

  • Account data is kept while your account is active and for a short period afterwards to handle backups and disputes.
  • Scan history on your device stays until you clear it or uninstall the app.
  • Synced scan history is kept until you clear it or delete your account.
  • Support emails are kept for up to 24 months so we can follow up on past tickets.
  • Crash and diagnostic logs are kept in aggregated, anonymized form for up to 13 months.
  • We may keep a limited subset of records longer when required for tax, accounting or legal compliance.

7. How to delete your account and data

You can delete your Labely account and the personal data associated with it in two ways:

  1. Inside the app: open Labely → Profile → Settings → Delete account. This removes your account and synced scan history. Local data on your device is removed when you uninstall the app.
  2. By email: write to support@labelyai.com from the email address on your account, with the subject “Delete my account”. We will confirm and complete deletion within 30 days.

Some information may be retained for the limited periods described in section 6 (for example, financial records or anonymized aggregate logs), but it will no longer be linked to your identity.

8. Your choices and rights

  • Access and export — request a copy of the personal data we hold about you.
  • Correction — ask us to fix data that is inaccurate.
  • Deletion — see section 7.
  • Object or restrict — object to or restrict certain processing, including profile-based personalization.
  • Withdraw consent — turn off optional analytics in the app at any time.
  • Camera access— revoke or re-enable in your device’s system settings (iOS Settings or Android app permissions). Without camera access, scanning will not work.
  • Complaint — if you are in the EEA, UK or another region with a privacy regulator, you have the right to lodge a complaint with your local authority. In Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

To exercise any of these rights, email support@labelyai.com. We may need to verify your identity before acting on a request. We respond within 30 days, or sooner where required by law.

9. California privacy rights (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, the right to delete it, the right to correct it, the right to limit use of sensitive information, and the right to opt out of any sale or sharing for cross-context behavioral advertising. Labely does not sell or share personal information for cross-context behavioral advertising. To exercise California rights, email support@labelyai.com. We will not discriminate against you for exercising these rights.

10. Children

Labely is a general-audience product and is not directed to children under 13. Children under 13 may use Labely only with the verifiable consent and supervision of a parent or legal guardian, and only where permitted by local law (some jurisdictions require a higher minimum age — for example, 14, 15 or 16 in parts of the EEA).

We do not knowingly collect personal information from children without appropriate parental or guardian consent. If you are a parent or guardian and believe a child has provided us personal information without your consent, contact support@labelyai.com and we will delete the relevant information. Parents and guardians may also request deletion of a child’s account at the same address.

11. International data transfers

Labely is operated from Romania (European Union). We and our service providers may process information in countries other than the one you live in, including the European Union, the United Kingdom and the United States. Where required by law, we use appropriate transfer safeguards such as the European Commission’s Standard Contractual Clauses.

12. Security

We use industry-standard technical and organizational measures to protect your information, including encryption in transit, access controls and regular review of who can access what. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we ever experience a personal data breach that affects you, we will notify you and the relevant authorities as required by law.

13. Informational use only

Labely is provided for general informational and educational purposes only. It is not a medical device, and the AI-generated ingredient explanations and informational scores are not medical advice. Do not rely on Labely to diagnose, treat, cure or prevent any condition, and do not use it to manage allergies in place of reading the physical packaging and consulting a qualified professional.

14. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will notify you in the app or by email before they take effect. The “last updated” date at the top of this page reflects the latest revision.

15. Contact us

For privacy questions, data requests, account deletion or any other support topic, email support@labelyai.com. You can also use the form on our contact page. Labely is operated from Romania.