Privacy Policy

Who we are

FoodFact is a service operated by Hanolo(하놀로), a sole proprietorship registered in the Republic of Korea, at Unit 202, 35 Nangok-ro 11-gil, Gwanak-gu, Seoul, Republic of Korea. Hanolo (the “we”/ “us” in this policy) is the data controller for the account and product data you submit. For privacy questions, email support@foodfact.co; further business details are on our Contact page.

Data we collect

We collect:

• Account data — your email address and, if you sign in with Google or Microsoft, the basic profile that provider returns.
• Company profile — optional business details you enter for reports and invoicing (company name, address, tax ID, contact email).
• Product data — the ingredient and product information you submit to generate reports.
• Transaction data — records of purchases and report credits. Card details are handled by our merchant of record, not by us (see below).
• Technical data — limited logs and IP address, used for security, abuse prevention, and rate limiting.

How we use it

To provide the Service (generate and deliver reports), process purchases, secure the platform, communicate about your account, and meet legal obligations. We do not sell your personal data.

Legal basis for processing

Where data protection law requires a legal basis, we rely on: performance of a contract — to create your account and generate the reports you buy; legitimate interests — to secure the platform, prevent abuse, and improve the Service, balanced against your rights; consent, where we ask for it (for example, optional communications); and compliance with a legal obligation — for tax, accounting, and record-keeping.

Processors we share data with

• Polar (Polar Software Inc.) — our merchant of record, which processes payments and handles billing data and receipts.
• Anthropic — the AI provider used to extract structured data from product information you choose to import. Under the applicable commercial API terms, inputs are not used to train AI models; uploaded images are processed in memory and not stored by us. Manual recipe entry never involves an AI provider.
• Resend — sends transactional email (verification, password reset, receipts).
• Our hosting provider — runs the application and database.

These providers act as processors under our instructions and may process data outside your country; where required we rely on appropriate safeguards.

International data transfers

We operate globally, and our processors may process your data outside your country, including outside the United Kingdom and the European Economic Area (EEA). Where we transfer personal data from the UK or the EEA, we rely on an appropriate safeguard — such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.

Security

Formulation data (order recipe snapshots, in-flight checkout snapshots, and uploaded lab certificates) is encrypted at rest with AES-256-GCM. Traffic is encrypted in transit with TLS, access to your orders is scoped to your account, and reports are delivered only as in-account downloads — never by email. The full list of protections is on our Security page.

Retention

We keep data only as long as it serves you:

• Formulation snapshots on orders— until you delete them yourself (each order page has a permanent “delete formulation from server” action) or your account is deleted.
• Checkout snapshots — cleared as soon as payment completes; if a checkout is abandoned, cleared within 14 days.
• Lab certificates — until you request deletion.
• Issuance facts (document ID, integrity hashes, product name, market, dates, versions) and the label declarations determined for the product (ingredient statement, allergens, nutrition table, front-of-pack seals) — retained so the public verification page keeps working, including after you delete the formulation. These are the declarations that appear on the package; they contain no formulation data (no full ingredient amounts, no process).
• Account and transaction records — for as long as your account is active and as needed for legal, tax, and accounting purposes, then deleted or anonymized.

Your rights

Subject to your local law, you may request access, correction, deletion, or export of your personal data, and object to certain processing. You can delete a report’s formulation yourself at any time from its order page; for other requests, email support@foodfact.co. If you are in the UK or the EEA, you also have the right to restrict processing, withdraw consent, and lodge a complaint with your data protection supervisory authority — in the UK, the Information Commissioner’s Office (ICO).

Cookies

We use only the cookies needed to run the site — chiefly your signed session cookie. We do not use advertising cookies.

Changes and contact

We will update the date above when this policy changes. Questions or requests: support@foodfact.co or our Contact page.