Effective date: October 9, 2026
LabelLens ("the app") helps you understand food, supplement, and cosmetics labels. You photograph a label, and we analyze the ingredients and give you a verdict personalized to your health profile.
This policy explains what data we collect, why, who we share it with, and the rights you have. We've written it in plain English on purpose.
Who is responsible for your data (the "controller"): Andrei's Miracle Software, Viilor 13, Pitești, Argeș, Romania Contact: support@andreismiraclesoftware.com
When you sign in (email/password, Google, or Apple via our sign-in provider Auth0), we store: - your email address and whether it's verified, - your sign-in identifier(s), - an optional display name you choose, - when your account was created.
Why: to create and operate your account. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR).
To personalize your results, you can tell us about: - your life stage (menstruating, perimenopause, menopause) and cycle phase, - a PCOS indicator, - allergies, dietary preferences, ingredients you want to watch or avoid, - health conditions you select, skin type (for cosmetics), - symptoms you log (type, severity, date).
This is health data under GDPR (Article 9). We ask for your explicit consent on a dedicated screen before any of it is saved, and we record when you consented and to which version of the disclosure. Our servers refuse to save health-profile data for accounts without an active consent.
You can withdraw consent at any time in the app. Withdrawing deletes your stored health-profile data and turns off personalization. The rest of the app keeps working.
Why: to personalize ingredient analysis to you. Lawful basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
When you scan a label we process: - the photo you take (or pick from your photo library), - an optional product name you type, - the analysis results: verdict, score, ingredient breakdown, plain-English summary, and (if you have a health profile) a personalized assessment.
Photos are stored in secure cloud storage (AWS S3) and are only accessible through short-lived, expiring links.
Photo retention: - Free accounts: label photos are automatically deleted within about 24 hours of upload. - Pro subscribers: label photos are retained while your subscription is active so your scan history can display them, and are deleted shortly after your subscription ends. - Scan results (verdict, score, ingredients, summary) stay in your history until you delete the scan or your account.
Why: this is the core function of the app. Lawful basis: performance of a contract; the personalized part of the analysis relies on your explicit consent (above).
To analyze a label, we send the photo, the product category, and — if you've consented to a health profile — a summary of your profile to Anthropic (the AI provider behind the Claude models), via their API. Anthropic processes this to generate the analysis and, under their commercial API terms, does not use API data to train their models. The analysis result is returned to us and saved to your scan history.
Analytics are disabled by default. If you opt in, we send a small, fixed set of events (app opened, scan started, screen viewed, paywall viewed, paywall outcome) to PostHog, hosted in the EU.
What analytics never includes — we strip or block these before anything is sent: - your email, name, phone number, or sign-in identifiers, - label contents, ingredient names, product names, or scan results, - your health profile — ever, - precise location or IP-based geolocation, - session recordings, screen text, or automatic click capture (all disabled).
You can turn analytics off at any time; we then stop collecting and reset the analytics identity on your device.
Lawful basis: consent (Art. 6(1)(a)).
If the app crashes or an error occurs, a technical report (device model, OS version, app version, stack trace) may be sent to Sentry (EU data ingestion) so we can fix bugs. These reports are not used for profiling or advertising. Lawful basis: legitimate interest in keeping the app working (Art. 6(1)(f)).
If you turn on notifications, we store a push token for your device and deliver notifications via Google Firebase Cloud Messaging and Apple Push Notification service. The token is removed when you log out or delete your account. We only ask for notification permission after explaining why, and only if you agree. Lawful basis: consent.
Pro subscriptions are billed by Apple through your App Store account — we never see your payment card details. We use RevenueCat to manage subscription status. For this we hold: a random account identifier (not your email), your subscription product and billing period, whether your subscription is active, and until when.
Lawful basis: performance of a contract.
We keep per-account scan counters (to enforce free-tier and fair-use limits) and limited administrative audit records (e.g., when our staff manually grants or revokes a subscription entitlement, with the reason). Your IP address is used transiently to rate-limit scan requests; we do not store it. Lawful basis: legitimate interest in running and protecting the service.
If you fill in the form on labellensapp.com we store: your first name, email address, the age range and season you selected, and the version and time of the consent you gave. We deliberately do not record your IP address or browser details with this form.
We use this only to avoid duplicate entries and — because you consented — to occasionally contact you about Label Lens and reading labels. We do not currently send any such emails; the free notebook is delivered inside the app, not by email.
Lawful basis: your consent (the checkbox on the form). Withdraw it any time by emailing support@andreismiraclesoftware.com and asking us to delete your details. Note: deleting your app account does not automatically delete your lead-form entry (they aren't linked) — ask for both if you want both gone. We keep lead-form details until you ask us to delete them.
We share data only with the service providers needed to run LabelLens:
| Provider | What | Where |
|---|---|---|
| Auth0 (Okta) | Sign-in and account authentication | US |
| Amazon Web Services (AWS) | Hosting, database, photo storage (photos stored in the EU; application hosting in the US) | EU + US |
| Anthropic | AI analysis of label photos (with your profile summary, if consented) | US |
| PostHog | Usage analytics (opt-in only) | EU |
| Sentry | Crash and error reports | EU |
| Google (Firebase) | Push notification delivery | US/global |
| Apple | App distribution, in-app subscription billing, push delivery | US/global |
| RevenueCat | Subscription status management | US |
These providers process data on our behalf under data-processing agreements. We do not sell your personal data and we do not share it with advertisers or data brokers.
Some providers process data in the United States. Where data leaves the EU/EEA, we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (for certified providers) and/or Standard Contractual Clauses.
| Data | Retention |
|---|---|
| Account data (email, identity) | Until you delete your account |
| Health profile and symptom logs | Until you withdraw consent or delete your account — whichever comes first |
| Label photos | Free: ~24 hours. Pro: while your subscription is active; deleted shortly after it ends |
| Scan results/history | Until you delete your account |
| Analytics events | Per PostHog retention settings; collected only while you're opted in |
| Push tokens | Until logout or account deletion |
| Subscription entitlement records | Until account deletion |
| Website lead-form details (first name, email, age range, season, consent record) | Until you ask us to delete them (email support@andreismiraclesoftware.com); not linked to your app account, so account deletion does not remove them |
| Administrative audit records (e.g., manual entitlement changes) | Retained after account deletion in de-identified form, as permitted for the establishment, exercise, or defence of legal claims (Art. 17(3)(e)) |
You can delete your account directly in the app: Profile → Delete account. Before you confirm, the app shows you exactly what will be deleted and offers a data export first.
When you delete your account, we permanently erase: your scans and scan images, your health profile, symptom logs and health-consent records, your notebooks, push tokens, notification preferences, usage counters, and subscription entitlement records. Your account record is anonymized (email and profile removed, identifiers irreversibly hashed) and your sign-in account at Auth0 is deleted shortly after. Deletion is irreversible.
What deletion does not do: it does not cancel an active App Store subscription — subscriptions are managed by Apple, and the app reminds you to cancel in your App Store settings first. It also does not delete a website lead-form entry (see "Website lead form" above) — email support@andreismiraclesoftware.com if you want that removed too.
You can also request deletion by emailing support@andreismiraclesoftware.com.
You have the right to: - Access your data — the app has a built-in "Export my data" feature, or ask us; - Rectify inaccurate data (you can edit your profile in the app); - Erase your data (in-app account deletion, or email us); - Withdraw consent at any time (health profile and analytics toggles in the app) — this doesn't affect the lawfulness of processing before withdrawal; - Restrict or object to processing based on legitimate interests; - Data portability — the in-app export gives you your data in a machine-readable format; - Complain to a supervisory authority. If you are in Romania, that is the ANSPDCP (www.dataprotection.ro); you may also complain to the authority in your own EU country.
To exercise any right, use the in-app features or contact support@andreismiraclesoftware.com. We respond within one month.
LabelLens is intended for adults and is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact support@andreismiraclesoftware.com and we will delete it.
Access tokens are stored in the iOS Keychain on your device. Data in transit is encrypted (HTTPS). Photos are accessible only via short-lived signed links. Health-profile writes are blocked server-side without a recorded consent. No system is perfectly secure, but we design for data minimization: analytics (if enabled) are stripped of identifying and health information before anything leaves the app.
LabelLens provides informational analysis of ingredient labels. It is not medical advice, and the app is not a medical device. See our Terms of Service for the full disclaimer.
If we make material changes — especially to how we handle health data — we will notify you in the app and, where required, ask for your consent again (consent records are versioned). The current version is always available at this URL.
Questions? Contact Andrei's Miracle Software at support@andreismiraclesoftware.com.