Privacy Policy

Last Updated: [Insert Date]

1. Data Controller

PureScan ("the App," "we," "us," or "our") acts as the Data Controller for the purposes of the General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law No. 6698 ("KVKK"), and the California Consumer Privacy Act (CCPA), with respect to the personal data described in this Privacy Policy. For any inquiries regarding your data, you may contact PureScan Management ("PureScan Yönetimi") at [support@purescan.health].

2. Data We Collect and Purpose of Processing

We collect the minimum data necessary to provide our core functionality of barcode scanning, food content analysis, allergen tracking, and religious dietary (Halal/Kosher) compliance checking. The categories of data collected are as follows:

a) Account Data: When you register via Supabase Auth, we collect your email address for the purposes of account creation, authentication, and account recovery.

b) Sensitive Personal Data (Special Category Data): Within your user profile, you may voluntarily define allergy information and religious/belief-based dietary preferences (e.g., Halal, Kosher). This data falls under the category of "special category data" pursuant to Article 9 of the GDPR and "special categories of personal data" pursuant to Article 6 of the KVKK, as it relates to health and religious belief.

EXPLICIT CONSENT NOTICE: This data is processed solely and exclusively on the basis of your explicit, informed, and freely given consent. This data is never collected as a mandatory requirement to use the App's basic functions; it is provided voluntarily by you to personalize allergen warnings and dietary compatibility results. You may withdraw this consent at any time by deleting the relevant profile fields or your entire account, as described in Section 4 below. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

c) Device Camera Access: The App requests access to your device's camera exclusively for the purpose of barcode scanning and Optical Character Recognition (OCR) of ingredient labels. Camera access is never used for any other purpose, and no photographic or video content is stored on our servers unless explicitly required for OCR text-extraction processing, which is transient and not retained beyond the processing window.

d) Anonymous Usage Analytics: We collect anonymized, aggregated usage data (e.g., feature engagement, crash reports) that does not directly identify you, for the purpose of improving App stability and performance.

e) Local Device Storage: Certain preferences and cached data may be stored locally on your device to improve performance and offline functionality. This data remains under your control and can be cleared via your device settings or by uninstalling the App.

3. Data Storage and Security

All personal data collected through the App is stored and processed on the secure infrastructure of Supabase, which employs industry-standard encryption (in transit and at rest), access controls, and security protocols. Food product and ingredient lookups are cross-referenced via the OpenFoodFacts API. We do not transmit your personal profile data (email, allergy data, or religious dietary preferences) to OpenFoodFacts or any other third party; such queries are limited to anonymized product-identifier lookups (e.g., barcode numbers) where technically feasible.

No Sale or Sharing of Data: We do not sell, rent, trade, or otherwise disclose your personal data to third parties for marketing or commercial purposes. Data is shared only with the infrastructure sub-processors strictly necessary to operate the service (i.e., Supabase), under contractual data-processing terms consistent with GDPR Article 28 and KVKK requirements.

4. Your Rights as a Data Subject

In accordance with GDPR (Articles 15–22), KVKK (Article 11), and CCPA, you have the following rights, which you may exercise at any time:

Right of Access: To request confirmation of and access to the personal data we hold about you.

Right to Rectification: To correct inaccurate or incomplete data directly within your profile settings.

Right to Erasure ("Right to be Forgotten"): You have the unconditional right to permanently delete your account and all associated personal data — including your email, allergy data, and religious dietary preferences — directly within the App, via the "Delete Account" function located in Account Settings. Upon confirmation, all personal data associated with your account will be irreversibly deleted from our active systems within [30 days], except where retention is required by applicable law.

Right to Restrict or Object to Processing: To request the restriction of processing or to object to processing based on legitimate interest.

Right to Data Portability: To receive your personal data in a structured, commonly used, machine-readable format.

Right to Withdraw Consent: Given that special category data is processed on the basis of explicit consent, you may withdraw such consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights beyond the in-app deletion function, you may contact us at [support@purescan.health]. We will respond within the statutory timeframes required by applicable law.

5. Children's Privacy

PureScan is not intended for, and does not knowingly collect personal data from, children under the age of 13 (or the relevant minimum age under applicable local law, including under the Children's Online Privacy Protection Act ("COPPA") in the United States). The App does not contain features specifically directed at children.

If we become aware that we have inadvertently collected personal data from a child under the applicable minimum age without verified parental consent, we will take immediate steps to delete such data from our systems. Parents or legal guardians who believe their child has provided personal data to us without consent should contact us immediately at [support@purescan.health] to request deletion. We reserve the right to terminate any account suspected of belonging to an underage user pending verification.

6. International Data Transfers

Where data is transferred outside of the European Economic Area (EEA) or Turkey, such transfers are conducted in accordance with appropriate safeguards, including Standard Contractual Clauses (SCCs) or other mechanisms recognized under GDPR Chapter V and KVKK Article 9.

7. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Material changes will be communicated via in-app notification or email prior to taking effect. Continued use of the App following such notice constitutes acceptance of the revised policy.