Privacy Policy

Last updated: 13 October 2026

This policy explains what personal data EatMatrix collects when you use the EatMatrix iOS app, the website eatmatrix.com and our emails, why we collect it, who helps us process it, how long we keep it and what rights you have. We have written it to describe what our systems actually do.

1. Who is responsible

The controller of your personal data is MAXHUMAN, MB, a small partnership registered in Lithuania, company code 307487994, Z. Sierakausko g. 23-9, LT-03105 Vilnius, Lithuania.

Contact for anything in this policy: hello@eatmatrix.com, phone +370 64849971. We have not appointed a data protection officer because the law does not require one for our processing.

2. The short version

• We do not sell your data and we do not show ads.
• The website sets no cookies and runs no analytics or tracking scripts.
• The app sends the photos you scan to our servers and to Google's Gemini AI to read the label. A random sample of about 1 in 10 scan photos is kept, without any link to your account, to train the app's on-device product detector.
• Allergies and dietary preferences you enter are used only to personalise your results. You can delete them at any time.
• You can delete your account in the app. That deletes your account and the personal data tied to it.

3. What we collect and why

Your account

When you create an account we receive your email address and, if you sign in with Apple or Google, the account identifier and the name and email that provider shares with us (with Apple you can choose to hide your email). We store your subscription status and, for App Store subscriptions, the Apple identifier of your subscription. When you change your profile we log the change together with the IP address and device type it came from, to protect accounts against misuse.

Why and legal basis: to provide your account and subscription (performance of a contract, GDPR Art. 6(1)(b)); the change log is our legitimate interest in account security (Art. 6(1)(f)).

Scans

When you scan a product the app uses your camera, or a photo you choose from your library, to capture the label. The app detects the product on your device, then sends the relevant parts of the photo to our server, which asks Google's Gemini AI to read the ingredients and returns the analysis. It may also look up the product on Open Food Facts, a public food database, by barcode or product name; no personal data is sent there.

For each scan we record a technical event: what kind of scan it was, the product name, the app language, the outcome and your account identifier. Results of product analyses are cached, without any link to you, so the same product is answered faster next time.

Why and legal basis: to deliver the scan you asked for (Art. 6(1)(b)); the event log and cache are our legitimate interest in keeping the service reliable and fast (Art. 6(1)(f)).

Photos kept to improve product detection

A random sample of about 10% of scan photos is stored, together only with the scan type and app language, to train the model that recognises products on your device. These photos are not linked to your account or any identifier. Please do not photograph people or documents with the scanner.

Legal basis: our legitimate interest in improving the accuracy of the app (Art. 6(1)(f)). You can object by emailing us (see section 6). Because the stored photos carry no identifier we cannot single out yours afterwards (GDPR Art. 11); all of them are deleted after 24 months at the latest.

Allergies and dietary preferences

If you choose to, you can tell the app about allergies and dietary preferences (for example vegan or gluten-free). We use them to flag ingredients that matter to you. For this purpose they are included in the scan request our server sends to Gemini. Allergy information can reveal something about your health, which the GDPR treats as a special category of data.

Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)). Entering them is optional. The app asks for this consent before you first save an allergy or preference and records the date you gave it. You withdraw consent by deleting them in the app's account settings.

Purchases

In the app, subscriptions are sold by Apple through the App Store. We use RevenueCat to check which subscription is active; it receives the email address of your account, which the app uses as your subscriber identifier, and the purchase records Apple provides. We never see your card details.

On the website, subscriptions are paid through Stripe. We keep your email address, Stripe customer and checkout identifiers, the plan, amount and payment status. We register the subscription with RevenueCat under your email address, so Premium is active when you sign in to the app with that email, and we send you a confirmation email through Klaviyo with the next steps. Stripe processes your payment details under its own privacy policy.

Legal basis: performance of a contract (Art. 6(1)(b)) and keeping accounting records required by law (Art. 6(1)(c)).

Email updates

If you sign up on the website we store your email address, the page you signed up on and, on an additive page, which additive it was. We use Klaviyo to send a weekly email with our new articles.

Legal basis: your consent (Art. 6(1)(a)). Every email has an unsubscribe link, and unsubscribing withdraws your consent.

Support

If you email us we use your message and address to answer you. Our email runs on Google Workspace.

Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or the contract where your message is about your subscription.

The website

eatmatrix.com sets no cookies and loads no analytics, advertising or social media scripts. Our web server does not keep access logs. Like any website, it necessarily receives your IP address to deliver pages, and images in articles are loaded from Sanity's image service, which also receives your IP address when your browser fetches them. The checkout buttons take you to Stripe's own pages.

No tracking in the app

The app includes no advertising or analytics software and does not track you across other companies' apps or websites.

4. Who processes your data for us

We use the following providers. They process data on our behalf under data processing agreements and may not use it for their own purposes.

• Supabase (database, sign-in and server functions for the app). Servers in the United States.
• Google: Gemini AI to read scanned labels, used under Google's paid API terms, under which Google does not use the content to improve its products; Google Sign-In if you use it; Google Workspace for email.
• Apple: Sign in with Apple and App Store payments.
• RevenueCat (subscription status, linked to your account email), United States.
• Stripe (website payments).
• Klaviyo (purchase confirmation emails and email updates), United States.
• DigitalOcean (hosting of eatmatrix.com), Frankfurt, Germany.
• Sanity (article content and images on the website).

We also share data when the law requires it, for example with tax authorities for accounting records, or to protect our rights in a legal dispute.

Transfers outside the EU

Some providers above process data in the United States. Where they do, the transfer is covered by the EU-US Data Privacy Framework for certified providers or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

5. How long we keep it

• Account, profile, allergies and preferences: until you delete your account or remove them. Deleting your account in the app deletes your account, profile, allergies, dietary preferences, ingredient history, profile change log and website purchase links.
• Scan event log: 12 months, then deleted automatically. After you delete your account the remaining events keep only a random identifier that no longer leads to you.
• Training photos: at most 24 months, then deleted automatically. Because these photos are not linked to your account, deleting your account cannot remove a specific photo; the 24-month limit applies to all of them.
• Cached product analyses: kept while useful; they contain no personal data.
• Purchase records: for as long as Lithuanian accounting law requires.
• Email updates: until you unsubscribe.
• Support emails: as long as needed to answer you and handle any follow-up.

6. Your rights

Under the GDPR you can:

• ask for a copy of your personal data and information about how we use it;
• have inaccurate data corrected;
• have your data deleted (you can delete your account yourself in the app);
• restrict or object to processing based on our legitimate interests, including the training photo sample;
• receive data you gave us in a portable format;
• withdraw consent at any time, without affecting processing that happened before.

Email hello@eatmatrix.com. We answer within one month. You also have the right to complain to a supervisory authority. In Lithuania that is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt); you can also complain in the EU country where you live.

7. Security

Data travels encrypted over HTTPS. Access to the database is limited by per-user access rules, and staff access is restricted to the people who run the service.

8. Children

EatMatrix is not intended for anyone under 16, and we do not knowingly collect their data.

9. Changes

We will update this page when our processing changes and change the date at the top. For significant changes we will tell you in the app or by email.