SBIRÙ PRIVACY POLICY

This is a translation provided for your convenience. In case of any discrepancy between this translation and the Italian original, the Italian version shall prevail. Read the Italian original.

1. DATA CONTROLLER

The data controller is Kevin, who operates Sbirù as a personal project.

Contact email for privacy matters: sbiru2026@yahoo.com

For any question regarding this Policy or the processing of your personal data, you can write to the email address above.

2. WHAT SBIRÙ IS FOR

To use Sbirù, including its basic functions, you need to create a free account (see section 3.1): the App cannot be used anonymously. With the free account you can:

• scan the barcode of a food, cosmetic or pet product to get a health score based on ingredients, nutritional values and additives;
• search for products by name;
• receive suggestions for alternative products with a better score, including through Amazon affiliate links;
• contribute to the database by uploading photos/labels of products not yet in the database, a feature that awards a public "badge" and Sbirù+ trial days.

The optional Sbirù+ subscription (see section 3.2), whose prices and conditions will be defined and communicated to users when available, unlocks additional features, including:

• saving a personal "fitness" profile to receive personalized scores and alerts on sugars, fats and other nutrients calculated based on your current weight and target weight;
• saving one or more "pet" profiles to receive personalized scores for pet food;
• choosing specific nutrients to monitor in scanned products.

This descriptive section helps you understand why we collect certain data; the details of each purpose are explained further below.

3. WHAT DATA WE COLLECT

3.1 Data you provide when creating an account (mandatory)

To use any feature of Sbirù, including basic scanning and product search, you need to create an account: the App cannot be used anonymously. The basic account is free; some additional features require the optional Sbirù+ subscription (see section 3.2). To create the account we collect:

• email address;
• first and last name;
• password (never stored in plain text: it is transformed with the scrypt cryptographic function and a random salt unique to each user, so not even we can retrieve the original password);
• account creation date;
• a session token, valid for 30 days, that keeps you logged in.

3.2 Sbirù+ subscription data and payment data

To manage the free trial period and the Sbirù+ subscription (premium features, also available for payment at the price of €11.99/year with automatic renewal: see the Terms of Use, section 5) we retain: the trial start date, the date until which the subscription is active, any bonus days earned by contributing to the product database, and the subscription status (trial, active, expired, in automatic renewal).

If you purchase the paid subscription, payment is processed entirely by an external payment service provider (indicated in the App at the time of purchase): we do not receive or store your card or payment method data on our servers, which remains handled by the provider under its own privacy policy. From the payment provider we only receive confirmation that payment has been made, a transaction identifier and the subscription status, data which we use exclusively to activate and manage your subscription and for any tax or accounting obligations.

3.3 Preferences on nutrients to monitor

If you have an active Sbirù+ subscription, you can choose to be alerted about the presence of specific nutrients (e.g. salt, sugars, saturated fat) in scanned products. This list of preferences is associated with your account.

3.4 Fitness profile and personal nutrition plan (optional)

If you activate the fitness profile to receive personalized scores, you can provide: sex (or "prefer not to say"), age, current weight, height, target weight, goal (lose weight / maintain weight / gain muscle mass) and physical activity level. Your current weight and target weight are also used to generate personalized alerts when you scan a product with a notable content of sugars, fats or other nutrients relative to your goal. This is data relating to health and physical characteristics: we process it only with your explicit consent, given by voluntarily activating this feature, and you can delete it at any time from your profile settings.

3.5 Pet profile (optional)

If you add a profile for a pet, you can provide: the pet's name, species (dog/cat/other), breed, age, target weight, activity level, any known allergies (free-text field) and additional notes. This data concerns your pet, not you, but we treat it with the same care as personal data when it is associated with your account.

3.6 Content you upload to contribute to the database

If a product is not in the database, you can contribute by uploading a photo of the packaging and/or the ingredient list, or by entering the ingredient text manually. Images are processed to be compressed/resized and to extract text via optical character recognition (OCR), performed locally on the server or through a third-party OCR service (see section 5). Uploaded photos and text are visible to our moderation team for approval and may become part of the public product database after review. Do not upload images containing your own or third parties' personal data (e.g. recognizable people, documents, receipts with payment data): such images would still be processed like any other uploaded content and could be rejected during moderation.

3.7 "Community" activity and public visibility

If you contribute new products, the number of contributions you have made generates a level "badge". Contributors' public name and badge may appear on a leaderboard visible to other users of the App. If you do not want your name to appear on the leaderboard, do not use the contribution feature, or contact us to discuss showing an alternative name.

3.8 Diagnostic and error data

To identify and fix malfunctions, the App automatically sends our server a report when an unexpected technical error occurs in the browser. The report may include: error message, stack trace, URL of the page where the error occurred, code line/column, and the browser's "user agent" string (browser/operating system type and version). This data is used exclusively for technical maintenance purposes.

3.9 Automatically collected data

When you use Sbirù, our server automatically receives your IP address, which is necessary for the internet to function. We use it for two limited purposes: (a) approximately determining your country/language in order to show you the App in the correct language on first use, and (b) applying limits on the number of requests to prevent abuse and automated attacks (rate limiting). We do not keep a permanent, searchable log of IP addresses linked to your identity, except as strictly necessary for technical security and for the minimum time required for that purpose.

3.10 Data stored locally on your device

Some information stays only in your browser, via the "local storage" feature, and is not sent to our servers except when it needs to be synced with an account: history of scanned products, number of scans performed, preferred language, whether you have already seen the onboarding screens, any personal nutrition plan (current weight and target weight) used to generate alerts on scanned products, and a local copy of fitness/pet profiles for faster access. You can delete this data at any time by clearing your browser's browsing data for the Sbirù site.

3.11 Camera

To scan barcodes, the App requests access to your device's camera through the browser. The image captured by the camera is processed locally in the browser solely to recognize the framed barcode: we do not record or transmit camera video to our servers, except when you voluntarily choose to take and upload a photo to contribute to the database (see section 3.6).

3.12 Automated processing and health score

Barcode recognition, extraction of the ingredient text (OCR) and the calculation of products' health scores are automated processes, based on algorithms and, in part, on artificial-intelligence recognition technologies. These processes do not produce any decision with legal or similarly significant effects on you within the meaning of Art. 22 GDPR: scores and alerts remain information provided for purely informational purposes (see also the Terms of Use, section 3), which you can always verify independently, and they do not automatically determine any decision concerning you — for example, they are never used to deny you access to the Service.

4. PURPOSES AND LEGAL BASES FOR PROCESSING (GDPR)

We process your data for the following purposes and legal bases:

• Creating and managing your account (mandatory to use the App), providing the scanning and product-scoring service, authenticating you and keeping the session active: performance of the contract with you (Art. 6(1)(b) GDPR).
• Managing the free trial, the Sbirù+ subscription and any payment and automatic renewal: performance of the contract (Art. 6(1)(b)) and, for the accounting and tax obligations connected with billing, legal obligation (Art. 6(1)(c) GDPR).
• Providing personalized scores and alerts based on the fitness profile or pet profile: explicit consent (Art. 6(1)(a) and, for health-related data, Art. 9(2)(a) GDPR), which you can withdraw at any time by deleting the relevant data from your profile.
• Enabling contributions to the database and their moderation: performance of the contract and legitimate interest in maintaining data accuracy (Art. 6(1)(b) and (f)).
• Showing public leaderboards of contributors: implicit consent given by activating the contribution feature, with the option not to use it.
• Identifying and fixing technical errors (diagnostic data): legitimate interest in keeping the Service working and secure (Art. 6(1)(f)).
• Preventing abuse through IP-based rate limiting: legitimate interest in the security of the Service (Art. 6(1)(f)).
• Complying with legal obligations where applicable: Art. 6(1)(c) GDPR.

We do not use your data for behavioral advertising, nor do we sell it to third parties for marketing purposes.

Reports and support emails: if you write to us (for example to report an error on a product or to exercise one of your rights) we process your email address and the content of your message only to reply and handle the request, on the basis of our legitimate interest in handling reports and, where applicable, a legal obligation (Art. 6.1.f and 6.1.c GDPR). We keep the correspondence for as long as necessary and to protect our rights.

Acceptance record: when you create your account we keep the date, the version of the Terms and of this Privacy Policy you accepted and the method of acceptance (ticked box or sign-in with Google/Facebook), so that we can demonstrate your consent and protect our rights (Art. 6.1.b and 6.1.f GDPR). We do not keep your IP address for this purpose. This record is kept even after the account is deleted, for as long as necessary to protect our rights.

5. SHARING DATA WITH THIRD PARTIES

To operate Sbirù we rely on some external providers, who act as processors on our behalf or as independent controllers for data you yourself choose to send them:

• Supabase (database and authentication): hosts the database of accounts, fitness/pet profiles, preferences and sessions. See Supabase's privacy policy for details on their processing.
• Open Food Facts, Open Beauty Facts, Open Pet Food Facts: open databases from which we retrieve product information (ingredients, nutritional values, brands). Requests to these services concern the product searched for and do not require or transmit your personal data.
• USDA FoodData Central: a US public database used to enrich products' nutritional information; here too, no personal data of the user is transmitted.
• Amazon (Product Advertising API / affiliate program): when we suggest an alternative product, the link may be an Amazon affiliate link. If you click on such a link you will be redirected to the Amazon website, which will process your data according to its own privacy policy; we only receive a possible commission, not your purchase data.
• Payment service provider (indicated in the App at the time of purchasing the paid Sbirù+ subscription): processes the transaction and your card or payment method data, which does not pass through or get stored on our servers (see section 3.2).
• Third-party optical character recognition (OCR) service (OCR.space): when you upload a photo of a label to contribute to the database, the image may be sent to this external service to extract the text. Do not upload images containing personal data unrelated to the product.
• Resend (email delivery): used to send you service emails (for example account confirmation); it receives your email address and the content of the message. We also use it to send you the password recovery link.
• UPCitemdb (barcode database): when a product is not found in the other databases, the barcode may be sent to this service to retrieve the product name and brand; no personal data of the user is transmitted.
• Our hosting and technical infrastructure provider, necessary to deliver the Service.

We do not share your data with advertisers and we do not use advertising tracking tools (e.g. Google Analytics, Meta Pixel) inside the App. The App uses some Google services: Google Fonts (fonts.googleapis.com / fonts.gstatic.com), Google reCAPTCHA (protecting registration from bots) and "Sign in with Google" (if you choose to use it). These requests involve sending your IP address and technical device data to Google, in accordance with standard web practice and Google's privacy policy. If you choose "Sign in with Google", we receive your name, email address and Google account identifier from Google.

We may disclose your data to competent authorities if required by law, to protect our rights or the safety of users.

Payments through Google Play: for Sbirù+ purchases on Android the payment provider is Google Play (Google). Your card or payment method details are processed by Google under its own privacy policy and do not pass through our servers; we only receive confirmation of the purchase and the subscription status.

6. INTERNATIONAL DATA TRANSFERS

Some of the providers listed in section 5 (e.g. Supabase, Amazon, OCR.space) may process data on servers located outside the European Union, including in the United States. In such cases, the transfer takes place on the basis of the appropriate safeguards provided for by the GDPR made available by these providers, such as the European Commission's Standard Contractual Clauses or equivalent mechanisms recognized by applicable law.

7. DATA RETENTION

We retain your data for as long as necessary to provide the Service:

• account data remains until you request account deletion or until the account is inactive for a prolonged period (normally 24 months of inactivity);
• fitness profile and pet profile data remains until you delete it yourself or delete the account;
• sessions automatically expire after 30 days;
• diagnostic error data is retained for as long as necessary for technical diagnosis and is then deleted or aggregated anonymously;
• content uploaded to contribute to the product database (photos, text) may be retained even after account deletion, in a form anonymous with respect to you, since it becomes part of a shared product database no longer traceable to your identity once the link with the account is removed.

Upon account deletion, your identifying personal data (email, first name, last name, password, linked profiles) is deleted from our database, except for what is retained for legal obligations or for the purposes described above relating to contributions already published in the shared database.

8. DATA SECURITY

We adopt technical and organizational measures to protect your data, including: password hashing with scrypt and a random salt unique to each user (the plain-text password is never stored); HTTP security headers via the Helmet library; rate limiting to prevent automated attacks; sessions with an expiration time. No system is 100% secure: in the event of a data breach that poses a risk to your rights, we will inform you as required by applicable law.

9. CHILDREN

Sbirù is not directed at children and is not designed to knowingly collect personal data from children under 16 (or the minimum age required by the law of your country). If you are a parent or guardian and believe that a minor has provided us with personal data without your consent, contact us to request its deletion. Between the ages of 16 and 18, Sbirù may only be used with the consent and under the supervision of a parent or guardian (see the Terms of Use).

10. COOKIES AND SIMILAR TECHNOLOGIES

Sbirù mainly uses the browser's "local storage" feature (not traditional cookies) to store preferences and data on your device, as described in section 3.10. If we introduce third-party cookies in the future (for example for payment or analytics services), we will update this Policy and, where required by law, ask for your consent via a dedicated banner.

Google reCAPTCHA, when active on registration, may set or read Google cookies and identifiers for security and abuse-prevention purposes, in accordance with Google's policy. These tools only serve to protect the Service and not to show you advertising.

11. YOUR RIGHTS

If you are located in the European Union or the United Kingdom, under the GDPR you have the right to:

• request access to the personal data we process about you;
• request rectification if it is inaccurate or incomplete;
• request its erasure ("right to be forgotten"), subject to legal exceptions;
• request restriction of processing in certain cases;
• request portability in a structured, machine-readable format;
• object to processing based on legitimate interest;
• withdraw at any time a previously given consent (for example for the fitness or pet profile), without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or the supervisory authority of your country of residence.

You can exercise these rights directly from the App, where available (for example by deleting the account or individual profiles from the settings), or by writing to sbiru2026@yahoo.com.

12. CHANGES TO THIS POLICY

We may periodically update this Policy, for example when we add new features or new third-party providers. The "last updated" date at the top of the document indicates the latest version. In the event of material changes, we will notify you through the App or by email, when possible.

13. CONTACT

For any question about this Policy or the processing of your personal data, write to: sbiru2026@yahoo.com

Kevin — Sbirù