UnPeel — Who processes your data
Effective date: 23 October 2026
This page lists every company that receives personal data from UnPeel, what it receives, where it processes it, and the safeguard for any transfer outside the European Economic Area (EEA). It completes our Privacy Policy.
The controller is Kerd, MB, company code 308115541, Sodų g. 1, Rūdaičių k., LT-97230 Kretingos r., Lithuania. Questions: support@kerd.lt.
Two kinds of recipient appear below:
- a processor handles data only on our instructions, under a data processing agreement (Art. 28 GDPR);
- an independent controller decides for itself how it uses the data, under its own privacy policy.
1. Recipients
| Company | Role | What it does for us | What it receives | Where | Transfer safeguard |
|---|---|---|---|---|---|
| Supabase Inc. | Processor | Database, sign-in, file storage, server functions | All the data described in our Privacy Policy that we store, including short-lived server logs with IP addresses | Hosted in the European Union (Ireland, AWS eu-west-1). Support access may come from the United States. | Standard Contractual Clauses for access from outside the EEA |
| OpenAI (OpenAI Ireland Ltd; OpenAI, L.L.C.) | Processor | Extracts the ingredient list and describes the product; rates ingredients our catalogue does not know; drafts short sentences | Label text, the extracted ingredient list and product type, unknown ingredient names, the product name and a summary of findings. No name, email, account id, scan id or IP address. The calls come from our server. | United States | Standard Contractual Clauses; EU–US Data Privacy Framework where OpenAI is certified |
| Google AdMob and Google's consent tool (User Messaging Platform) — Google Ireland Ltd, Google LLC | Independent controller for personalised ads; processor for other ad processing | Shows rewarded ads, records your ad consent, confirms completed ads to our server | Advertising ID (only with your consent), IP address, device data, ad interactions, our random user id on rewarded ads, the keywords health, food, nutrition | EU and United States | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Google Sign-In — Google Ireland Ltd, Google LLC | Independent controller | Lets you sign in with your Google account | The sign-in event. Google sends us your email, name and profile picture link. | EU and United States | Google's own safeguards as controller |
| Google ML Kit — Google LLC | Processor | Reads text and barcodes on your device | Usage and diagnostic data about the ML Kit software. No images and no label text. | United States | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Google Play and Google Play Billing — Google Ireland Ltd, Google LLC | Independent controller | Distributes the app, sells Premium and takes payment | Your purchase and payment details | EU and United States | Google's own safeguards as controller |
| Google Workspace — Google Ireland Ltd, Google LLC | Processor | Our email (support@kerd.lt, info@kerd.lt) | Emails you send us | EU and United States | Standard Contractual Clauses |
| RevenueCat, Inc. | Processor | Checks and restores Premium subscriptions | Our random user id for you, purchase and receipt data, device data | United States | Standard Contractual Clauses |
| Vercel Inc. | Processor | Hosts the website https://unpeel.net and counts page views without cookies | Website visitors' IP address, browser type and pages visited | United States and global network | EU–US Data Privacy Framework; Standard Contractual Clauses |
We do not use any other advertising or analytics company, and no crash-reporting service.
2. Public data sources
We look up public databases to build our ingredient catalogue and to identify products. These lookups are made by our server and contain only ingredient names, chemical names, barcodes or brand names — never anything about you, and never your IP address. They are listed here for transparency and to credit the data.
| Source | What we use it for | Licence |
|---|---|---|
| Open Food Facts | Product names, brands and barcodes; ingredient and additive data | Database: Open Database License (ODbL) 1.0. Contents: Database Contents License 1.0. |
| PubChem (U.S. National Library of Medicine) | Chemical identifiers and substance information | Public domain |
| Europe PMC (EMBL-EBI) | Published research about ingredients | Metadata free to reuse; each article under its own licence |
| Wikidata | Which company owns a brand | CC0 1.0 (public domain) |
Open Food Facts attribution. UnPeel uses data from Open Food Facts (https://world.openfoodfacts.org), made available under the Open Database License (https://opendatacommons.org/licenses/odbl/1-0/). Individual contents are under the Database Contents License (https://opendatacommons.org/licenses/dbcl/1-0/).
The app also lists its data sources in Profile → Data sources & licences.
3. Changes
When we add or replace a company on this list, we update this page and the Privacy Policy. If the change materially affects you, we tell you in the app or by email before it takes effect.