Privacy Policy

Introduction

At SoyPre LLC, your privacy is paramount. We believe you should have full control over your personal data. This Privacy Policy explains what information we collect through our mobile application, how we use it, and the rights you have regarding your data.

Key Principles: We collect only what's necessary, we never sell your data, and we're transparent about our practices.

Information We Collect

Account Information

• Sign in with Apple or Google: We receive the email address and name your provider shares with us (Apple may give us a private relay address instead of your real one). SoyPre has no passwords, so we never see or store one
• Guest accounts: If you continue as a guest we create an anonymous account with no email address and no name. If you sign in later, your history moves to your account
• Display Name (Optional): If you choose to personalize your profile
• Membership: If you become a member, Apple or Google processes the payment and we never see your card details. Our subscription management provider tells us whether your membership is active and which support level you chose

Dietary Preferences & Scans

• Food Preferences (Premium): The diets, avoidances and allergens you choose in the app. This can reveal health information, so we use it only to check your scans against it
• Product Scans: The barcode of each product you scan, when you scanned it, and the country your request came from. This is your scan history, and it is what lets us warn you about recalls
• Products You Send In: If you add a missing product, the details you type and the photos of its label that you take. A person reviews them before the product is added
• Notification Token: If you allow notifications, a token that identifies your phone to Apple’s (iPhone) or Google’s (Android) notification service, so we can send safety alerts

Usage Data

• App Interactions: Counts of a few named actions, such as an install, a sign-up or a first scan
• Performance Data: Crash reports, loading times, errors (anonymized)
• Device Information: OS version, app version, device model (for compatibility)

Camera Access

The app uses the camera to scan product barcodes. What the camera sees while scanning is processed on your device and is not stored or sent to our servers. The one exception is the photos you take on purpose when you send in a missing product: those are uploaded for review. SoyPre never reads your photo library.

What We DON'T Collect

• ❌ We don't use advertising or marketing trackers in the app. On our website, the Google Ads tag runs only if you accept the Marketing cookies (see Cookies & Tracking). The few diagnostic and analytics tools we do run are listed under Service Providers
• ❌ We don't track your location. We only see the country a request came from
• ❌ We don't access your contacts, photos, or other personal files
• ❌ We don't use advertising IDs or tracking pixels in the app

How We Use Your Information

Essential Services

• Product Analysis: Scoring scanned products and checking them against the food preferences you set
• Better Alternatives: Showing higher-scoring products from the same category
• Safety Alerts (Premium): Matching recalls and regulator warnings against the products in your scan history
• Account Management: Authentication, membership status, account security

Service Improvement

• Bug Fixes: Using anonymized error reports to fix issues
• Feature Development: Understanding which features are most valuable to users
• Database Updates: Adding new products that readers send in (product data only, not user identity)

Communications

• Essential Updates: Security alerts, policy changes, critical app updates
• Safety Notifications (Premium): A push notification when a product you scanned is recalled or flagged. You can switch notifications off at any time in your phone’s settings

Research (Anonymized Only)

We may use aggregated, fully anonymized data for research purposes (e.g., "30% of users filter for vegan products"). This data cannot be traced back to individual users.

Data Sharing & Disclosure

Service Providers (Data Processors)

We use a minimal number of trusted service providers to operate our app. All have GDPR-compliant Data Processing Agreements:

• Cloud Infrastructure: A global edge-network and cloud hosting provider, and a managed database provider (Asia region)
• Sign-In Providers (Apple, Google): They authenticate you when you use Sign in with Apple or Google, under their own privacy policies
• Subscriptions (Apple App Store, Google Play, and a subscription management provider): They process your membership payment and tell us whether it is active. We never receive your card details
• Notifications (the phone platform’s push notification service): Delivers the safety alerts you allow
• Error Monitoring & Diagnostics (EU region): crash reports, performance traces and diagnostic logs from the app and this website, so we can find and fix what breaks. It sends no IP address, no account ID, no e-mail address and no request or response bodies. One identifier does travel with a crash from the mobile app: a random installation ID, generated on your device and not linked to your account - it is what tells us whether a bug hit one person a hundred times or a hundred people once. Deleting the app ends it. Diagnostic data is stored in the European Union.
• Session Recording (our error monitoring provider): a reconstruction of what happened on screen around an error - in the mobile app only; this website takes no recordings. Text and images are masked before the recording leaves your device, so what we see is layout and interaction, not what you typed, scanned or photographed. It records a small sample of sessions and the sessions in which an error occurred.
• Product Analytics (EU region): counts of named actions - an install, a sign-up, a first scan - so we can see where people give up. It records no page content and takes no recordings. Analytics data is stored in the European Union.
• Advertising Measurement (Google Ads, website only): if you accept the Marketing cookies on soypre.com, Google’s tag measures whether you arrived from one of our ads. Google may set cookies and receives your IP address and the pages you view. It loads nothing until you accept, and you can withdraw at any time from the cookie settings link in the footer. Its processing is governed by Google’s own privacy policy.

These providers can only process data according to our instructions and cannot use it for their own purposes.

Legal Obligations

We may disclose your information if required by law, such as in response to a valid court order or government request. We will notify you unless prohibited by law.

Business Transfers

If SoyPre LLC is acquired or merged with another company, your data will remain subject to this Privacy Policy unless you consent to a new policy.

Your Rights (GDPR & CCPA)

You have the following rights regarding your personal data:

Right to Access

Request a copy of all personal data we hold about you in a machine-readable format (JSON or CSV).

Right to Rectification

Correct any inaccurate or incomplete personal data. Your display name can be changed directly in the app, and your food preferences in Profile.

Right to Erasure ("Right to be Forgotten")

Request deletion of your account and all associated personal data. We will comply within 30 days.

Right to Data Portability

Export your data in a structured, commonly used format (e.g., to transfer to another service).

Right to Object

Object to processing of your personal data for specific purposes (e.g., research, marketing).

Right to Restrict Processing

Temporarily limit how we use your data while we resolve a dispute or verify accuracy.

How to Exercise Your Rights

Send requests to privacy@soypre.com or use the Account screen in the app to delete your account yourself. We will respond within 30 days.

Data Protection Officer: For complex privacy matters, contact our DPO at dpo@soypre.com

Data Retention

• Active accounts: we keep your data for as long as your account exists
• Deleting your account: it happens when you press the button, not on a schedule. Your account, your email address, your name, your lists, your preferences and your devices are erased immediately
• Scans you remove from History: removing a scan hides it from your list, on every phone you sign in on. The record stays with your account, which is how a recall of that product can still reach you. It goes the way of the rest of your scan history when you delete your account, as described below
• Products you send in: the details are kept while they wait for review and for 180 days after a decision. The photos are removed from storage 180 days after you upload them
• Legal obligations: some records may be kept longer where the law requires it (financial records, for example)

One thing survives a deletion, and we would rather name it than call it “anonymized data”. When you scan a product we record that the product was scanned, in which country, on which day. Those rows never carry a device or installation identifier, and deleting your account strips your user ID from them, so what is left says“this product was on a shelf in this country on this day” and points at nobody - not at you, not at your phone, and there is nothing left in it to link back to either.

We keep it because it is the only thing that tells us which products actually matter on the shelves our readers stand in front of - which is what decides what the app gets good at. It is never sold, never shared, and never used to build a profile of anyone.

Backups: deleted data is removed from backups within 90 days.

Data Security

We implement industry-standard security measures to protect your data:

• Encryption: AES-256 encryption at rest, TLS 1.3 in transit
• Access Controls: Multi-factor authentication and role-based access for our team
• Pinned Connections: The app talks only to SoyPre servers, over certificate-pinned TLS connections
• Incident Response: Automated error and anomaly alerts, and notice to affected users within 72 hours of a breach

For detailed security practices, see our Security page.

International Data Transfers

Global Infrastructure: We use a globally distributed edge-network provider for computing and our primary database is hosted in Asia. Your data may be processed and stored in multiple jurisdictions.

GDPR Compliance: For EU users, we comply with GDPR requirements through:

• Standard Contractual Clauses (SCCs) with all data processors
• Adequate safeguards for international data transfers
• Full GDPR rights regardless of server location
• Data Processing Agreements with all service providers

Children's Privacy

SoyPre LLC is not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal data from children. If we discover a child's account, we will delete it immediately. If you believe your child has created an account, contact us at privacy@soypre.com.

Cookies & Tracking

Mobile App

The mobile app uses no cookies and no advertising or marketing trackers. It does include three third-party SDKs: an error monitoring SDK, which reports crashes, performance traces, diagnostic logs and masked session recordings; a product analytics SDK, which counts a few named actions; and a subscription SDK, which handles memberships. All three are described under Service Providers above. The first two are never sent your email address, your name or the barcodes you scan.

We do not use advertising SDKs, attribution or install-tracking SDKs, or any social media tracker.

Website (soypre.com)

Our website sets only essential session cookies until you choose otherwise in the cookie banner. Alongside them it runs three tools, all described under Service Providers above: one for counting actions and one for errors, and, only if you accept the Marketing cookies, the Google Ads tag, which may set Google’s advertising cookies. We do not use:

• ❌ Google Analytics, Mixpanel, Amplitude or Microsoft Clarity
• ❌ Advertising cookies or tracking pixels without your consent
• ❌ Social media tracking (Facebook Pixel, Twitter analytics, etc.)
• ❌ Selling or sharing any of it with data brokers

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via:

• In-app notification
• Email to your registered address
• Prominent notice on this page

Continued use of the app after changes constitutes acceptance of the new policy.

Contact Us

For questions, concerns, or to exercise your privacy rights:

• Privacy Inquiries: privacy@soypre.com
• Data Protection Officer: dpo@soypre.com
• General Support: support@soypre.com
• Registered Address: SoyPre LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA

Supervisory Authority: If you're in the EU and believe we haven't addressed your concern, you have the right to lodge a complaint with your local data protection authority.