UnPeel — Privacy Policy

Effective date: 23 October 2026

This policy explains what personal data we process when you use the UnPeel app for Android and the website https://unpeel.net, why we process it, who receives it, how long we keep it, and what your rights are. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Google Play User Data policy.

1. Who we are

UnPeel is a brand of Kerd, MB. Kerd, MB is the controller of your personal data: it decides why and how your data is processed and is responsible for it.

Full company details are at /legal/company.

2. The short version

• To analyse a product, we process the photo you take of its label, the text read from it, and the result we produce.
• The product-level result of each successful scan goes into a shared product index that other signed-in users can search, browse and compare. It never contains your photo, the text read from your photo, your location, your account, your name or your email. See §4.3.
• Our server sends the label text to OpenAI to extract the ingredients and describe the product. It never sends your name, email, account id or IP address.
• If you tell us about allergies or a diet, that is health data. We process it only with your explicit consent, only on your device for alerts, and we never send it to the AI provider or use it for ads.
• The app shows rewarded ads from Google AdMob. Ads are personalised only if you consent.
• We keep records of our AI calls and error logs to run and improve the service. When you delete a scan or your account, we remove the link between those records and you.
• You can delete your account in the app at any time, and you can ask for deletion by email without the app: /legal/data-rights.
• We do not sell your personal data.

3. Your right to object

You have the right to object, at any time, to processing of your personal data that we base on our legitimate interests (Art. 6(1)(f) GDPR), on grounds relating to your particular situation. Section 5 lists every such processing. When you object, we stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

We do not use your data for direct marketing. If we ever do, you can object to it at any time and we will stop, without any need to give a reason.

To object, write to support@kerd.lt. Section 13 explains how we handle requests.

4. What we process and why

For each kind of data, the tables say where it comes from, what we use it for, the legal basis under Art. 6 GDPR (and Art. 9 for health data), and how long we keep it.

4.1 Your account and profile

4.2 Consent and acknowledgement records

4.3 Your scans

How we get your country. The app reads the region setting of your phone. It makes no network request for this and does not look at your IP address. We do not record a city or any more precise location, and the app never asks for location permission.

Please photograph only product labels. If a photo shows people, documents or anything personal, it is stored with the scan and its text is processed like label text. Ask us to delete the scan to remove it (§11).

The shared product index. When a scan succeeds, its product-level result becomes part of a shared index that other signed-in UnPeel users can search, browse, rank and compare.

• What the index contains: the product name, product type, score, verdict, the analysis (including the ingredient list as analysed), the barcode number, and the date of the scan.
• What it never contains: your photo, the full text read from your photo, your country, your account id, your name, your email, your dietary restrictions, or anything else that says who scanned the product.
• Why: so that users can compare products and find alternatives. Legal basis: Art. 6(1)(f) — our interest, and other users' interest, in a shared product database. The data is about the product, not about you.
• How long: as long as your scan exists. Deleting the scan, or your account, removes it from the index.
• One limit you should know: the index shows the date of each scan. For a product that very few people scan, someone who knows that you scanned it on that day could guess the entry came from you. The entry itself says nothing about you.
• If you object: write to us and we will remove your scans from the index, or delete the scans you name (§11).

The analysis cache. To answer repeat scans quickly and at lower cost, we keep a shared copy of an analysis, found by a one-way hash (a fingerprint) of the label. The shared copy holds no label text, no photo and nothing about you. It is kept indefinitely and is not deleted with your account. We may also keep a private copy of a result for your own re-scans; only you can use it, and it is deleted with your account. Legal basis: Art. 6(1)(f) — our interest in speed, lower cost, and giving the same result for the same label.

4.4 Records of AI calls and how our ingredient catalogue learns

Records of AI calls. Each time our server asks the AI model for something, we keep the exact request and reply, the number of tokens, the time it took, and a reference to the scan it belongs to. The request contains the label text.

• Why: to check the quality of the model's output, to control cost, to recompute results without paying for new AI calls, and to improve our ingredient catalogue.
• Legal basis: Art. 6(1)(f) — our interest in a correct, affordable and improving service.
• How long: indefinitely. When you delete the scan, or your account, we remove the scan reference from these records. After that, a record is not linked to you or to any account.

Ingredient catalogue learning. When an ingredient on your label has no exact match in our catalogue, our server sends the ingredient name — never anything about you — to the AI model to rate it. The result is written to our shared ingredient catalogue, so the ingredient is recognised the next time, for everyone. The name as printed on your label may become an alternative name (an alias) in that catalogue. A record of each such rating run keeps the scan reference until you delete the scan or your account, and then loses it. Legal basis: Art. 6(1)(f). The catalogue itself contains ingredient names and ratings, not personal data.

4.5 Dietary restrictions and allergies — health data

If you set dietary restrictions or allergies, that may reveal information about your health, for example a nut allergy or a medical diet. This is special-category data under Art. 9(1) GDPR.

• Legal basis: your explicit consent under Art. 9(2)(a) GDPR (and Art. 6(1)(a)). You give it in a separate step in the app, before anything is saved.
• Purpose: to flag ingredients you asked to be warned about, in your own scans.
• Where it is used: the matching happens only on your device. We store your selections on our servers so they are there when you sign in on another device.
• What we never do with it: send it to the AI provider, use it for ads, share it with advertisers, or use it for anything other than your own alerts.
• Optional: the app works without it.
• Withdrawing consent: at any time, in Profile → Dietary Restrictions → Withdraw permission & delete my health data, or by email to support@kerd.lt. Withdrawing deletes the stored restrictions. It does not affect processing that happened before.
• Kept: until you withdraw consent, remove the restrictions, or delete your account.

4.6 Scan allowance, credits and ad rewards

4.7 App events

The app records its own events on our server: event name, durations, how much of a label was covered by our catalogue, product type, failure reasons, the outcome of an ad (for example loaded, no ad available, closed early, completed), and your country. These are linked to your account. We do not use any third-party analytics SDK.

• Purpose: find and fix failures, and understand how the app is used.
• Legal basis: Art. 6(1)(f) — our interest in a reliable service.
• Kept: life of the account.

4.8 Error logs

When something fails, we log the model name, the request that failed (which may include label text), the error message and code, technical context, and your user id.

• Purpose: diagnose failures and prevent abuse.
• Legal basis: Art. 6(1)(f) — our interest in a working, secure service.
• Kept: your user id is removed after 90 days. If you delete your account before that, the logs still linked to you are deleted. Logs without a user id are kept to find recurring faults, and are not linked to you.

4.9 Correction reports

If you report that a company record shown in the app is wrong, we store the reason, the text you write, and your user id.

• Purpose: correct the record. Legal basis: Art. 6(1)(f) — our interest in accurate information about companies.
• Kept: until the report is handled and after that as a record of the correction. If you delete your account, the report stays but the link to you is removed.

4.10 Subscriptions and payments

Premium is sold through Google Play. Google processes your payment as an independent controller under its own privacy policy. We never receive your card or bank details.

• We use RevenueCat to check and restore subscriptions. RevenueCat receives our random user id for you, your purchase and receipt data, and basic device data.
• We store your subscription tier, the product you bought, and when it renews or ends.
• Purpose: give you the Premium features you paid for. Legal basis: Art. 6(1)(b).
• Accounting records: where accounting law requires us to keep a record of a transaction, we keep it for 10 years. Legal basis: Art. 6(1)(c).
• Kept: subscription status for the life of the account.

4.11 Support emails

If you email us, we process your email address, your message and our reply. Our email runs on Google Workspace.

• Purpose: answer you, and keep a record in case of a dispute.
• Legal basis: Art. 6(1)(b) where it concerns your use of the service; otherwise Art. 6(1)(f).
• Kept: as long as needed to handle your request, then up to 3 years to deal with possible claims.

4.12 What we do not collect

• We do not store your IP address. Our hosting provider (Supabase) keeps short-lived technical logs that include IP addresses, as our processor, for security.
• No precise location, no GPS, no location permission.
• No contacts, no microphone, no access to your photo library (the gallery works through the Android photo picker, which gives the app only the photo you choose).
• No sale of personal data.

5. Our legitimate interests

Where we rely on Art. 6(1)(f), these are the interests, and you can object to each of them (§3):

We balanced each interest against your rights. The data involved is mostly technical or about products, and it is kept separate from your identity where we can do that.

6. How the AI is used, and automated results

What the AI does. Text reading and barcode reading happen on your device, using Google ML Kit. Our server then sends the label text to OpenAI, which extracts the ingredient list and says what the product is: its category and how it is used. A second request, with the ingredient list and the category, returns allergen, pregnancy, child-safety and vegan alerts and estimated nutrition values. The score, the ingredient findings and the regulatory notes are worked out in our code, from our ingredient catalogue and rules. OpenAI also rates ingredients our catalogue does not know yet (§4.4) and drafts short descriptive sentences.

What is sent to OpenAI: the label text, the extracted ingredient list and product type, ingredient names our catalogue does not know, and the product name with a summary of the findings.

What is never sent to OpenAI: your name, email, account id, scan id, IP address, country, or dietary restrictions. The call comes from our server, not your phone.

OpenAI processes this data as our processor. Under its API terms, OpenAI does not use data sent through its API to train its models.

Automated results (Art. 22 GDPR). The score and verdict are produced automatically. They are information about a product. They make no decision about you: they have no legal effect on you and do not similarly significantly affect you, and we do not use them to decide your access to anything, your price, or any benefit. If you want a person to review a result, write to support@kerd.lt.

AI transparency. The app tells you, on each result, that the analysis uses AI (Art. 50 of the EU AI Act, Regulation (EU) 2024/1689).

7. Advertising

The free tier is paid for by rewarded ads from Google AdMob.

• Consent first. In the EEA, the UK and Switzerland, the app shows Google's consent form (Google User Messaging Platform, a certified consent tool) before the ads software starts. Refusing is as easy as accepting.
• If you consent, Google may use your device's advertising ID and ad interactions to show personalised ads. For that, Google is an independent controller under its own privacy policy.
• If you do not consent, Google shows non-personalised or limited ads, which do not use your advertising ID for profiling. A non-personalised ad earns a scan exactly like a personalised one.
• In both cases Google receives technical data needed to deliver an ad and prevent fraud, such as your IP address, device type and whether the ad was watched.
• Contextual keywords. Every ad request carries the same three words: health, food, nutrition. They are the same for every user and never come from your scans or restrictions.
• How a reward is checked. The app attaches our random user id for you to a rewarded-ad request. When you finish the ad, Google's server sends a signed message to our server with that id, a transaction id and the reward amount. Our server checks the signature and credits your account. Google does not receive your name, email, scans or dietary data from us. Legal basis for the user id: Art. 6(1)(b) — it is how the scan you asked for is paid for, so it is sent whether or not you consent to personalised ads.
• Change your choice at any time in Profile → Privacy & ad settings.

We do not detect or work around ad blockers. If no ad can be shown, the app tells you why.

8. Who receives your data

We use the following providers. The full list, with what each receives, where, and the transfer safeguard, is at /legal/subprocessors.

Other users see the product-level results in the shared product index (§4.3), never your photo, label text, country or identity.

We may also disclose data when the law requires it, for example to comply with a valid order of a court or authority, or when needed to establish, exercise or defend legal claims. If Kerd, MB or the UnPeel business is transferred to another company, your data may transfer with it; we will tell you before that happens.

9. Transfers outside the EEA

Our database is hosted in the European Union (Ireland, AWS eu-west-1). Some providers process data in the United States, and Supabase support staff may access data from there. For each such transfer we rely on:

• the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914); and
• where the provider is certified, the EU–US Data Privacy Framework adequacy decision of 10 July 2023.

The safeguard for each provider is listed at /legal/subprocessors. You can ask us for a copy of the safeguards at support@kerd.lt.

10. How long we keep data

11. Deleting your data

You can delete your whole account in Profile → Delete account, or ask us by email, without the app. A scan that failed can be deleted in History; to delete any other single scan, email us and name the product and the date. Step-by-step instructions, and a full list of what is deleted and what is kept, are at /legal/data-rights (also at /delete-account).

In short: deleting your account deletes your profile, scans, photos, label texts, results, favourites, dietary data, consent records, allowance and ad reward records, app events, the error logs still linked to you, your private cache copies, and your record at RevenueCat. Your scans leave the shared product index. Records of AI calls and older error logs stay, without any link to you. Backups are overwritten within 30 days.

Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play first.

12. Our website (https://unpeel.net)

This section covers visits to our website. It does not need an account.

• Hosting. The website is hosted by Vercel Inc., our processor. When you visit, Vercel's servers process your IP address, browser type (user agent), the page you asked for and the time, to deliver the page and protect the site against abuse. Vercel keeps these logs for a limited time under its own settings. We do not use them to identify visitors. Legal basis: Art. 6(1)(f).
• Statistics. We use Vercel Web Analytics, which counts page views in aggregate. It sets no cookies, stores nothing on your device, and does not track you across other websites. To tell visits apart, it uses a short-lived hash of the request that is discarded within 24 hours. We see only totals. Legal basis: Art. 6(1)(f).
• No cookies. The website sets no cookies.
• Theme setting. If you switch the site between light and dark, your browser saves the key unpeel-theme with the value light or dark in local storage. It is written only when you use the switch, stays in your browser, and is never sent to us. It is needed only to remember the choice you made.
• No sign-ups. The website does not currently collect email addresses. If we open a waitlist, we will update this policy before we collect anything.

13. Your rights

Under the GDPR you have these rights:

How to use them. Many work directly in the app. For anything else, email support@kerd.lt from the address of your account, so we know the request is yours. We answer within one month. For complex requests we may extend this by two more months; if so, we tell you within the first month and explain why. Using your rights is free. We may refuse or charge a reasonable fee only for requests that are clearly unfounded or excessive, and we will explain why.

Complaints. You can complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI) (https://vdai.lrv.lt), or to the data protection authority of the EU country where you live, work, or where you think the problem happened. You can also go to court. We would like the chance to fix the problem first, but you do not have to contact us before you complain.

14. Do you have to give us your data?

No law requires you to give us personal data. But:

• to use the app you need an account, so we need an email address (or a Google sign-in);
• to get an analysis, you have to send us a label;
• dietary data and consent to personalised ads are optional. If you do not give them, the app still works; only dietary alerts are unavailable.

15. Children

UnPeel is for people aged 16 and over. You confirm your age when you sign up. We do not knowingly collect data from anyone younger. If you think a child under 16 is using UnPeel, write to support@kerd.lt and we will delete the account.

16. Security

We protect your data with measures suited to the risk (Art. 32 GDPR), including:

• encryption in transit (TLS) for all traffic, and encryption at rest for stored data;
• database access rules that let each user read only their own records;
• a private photo store: a photo can be opened only by its owner, through a short-lived signed link;
• passwords stored only as salted hashes;
• the AI provider's key kept only on our server; every analysis is requested by our server, which also checks your scan allowance;
• the shared product index built from a fixed list of product-level fields, so no personal field can reach it;
• access to production systems limited to the people who need it.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we notify the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI) within 72 hours (Art. 33 GDPR), and we tell you without undue delay if the risk is high (Art. 34 GDPR).

17. Storage on your device

The app stores on your phone what it needs to work: your sign-in session, and whether you have finished onboarding and the in-app tips. This is strictly necessary for the service you asked for, so it needs no consent (Art. 5(3) of the ePrivacy Directive).

The ads software stores and reads identifiers on your device. That is not strictly necessary, so it happens only as described in §7.

The app opts out of Android's automatic backup, so this data is not copied to your Google account's backup.

18. Accuracy of results

Results are produced automatically and can be wrong. Text reading can misread a label, and the AI can miss or misstate an ingredient. If you have an allergy or intolerance, always read the physical label. UnPeel is not medical advice and not a medical device. See our Terms of Service.

19. Changes to this policy

When we change this policy, we update the effective date at the top. If a change materially affects you — for example a new purpose, a new kind of data, or a new recipient — we tell you in the app or by email before it takes effect. If a change needs your consent, we ask for it again. Earlier versions are available on request from support@kerd.lt.

20. Contact