Privacy Policy — IngredientIQ

 We NEVER sell your personal data or dietary
          habits

1. Our Commitment to Your Privacy

At IngredientIQ, we believe your family's food choices, your pets' dietary needs, and your skincare routine are deeply personal matters. This Privacy Policy details how we collect, safeguard, and responsibly process information across our mobile application, server backend, and artificial intelligence scanning engines.

2. Information We Collect

To provide accurate toxicity detection and clean alternative product substitutions, we process minimal, practical categories of data:

Account & Credentials: Email address, basic profile attributes, and secure authentication tokens (JWT) when you create an account or sign in via Apple/Google Authentication.
Submitted Image & Camera Scans: Photographs of food ingredients, pet nutritional labels, and cosmetic packaging that you actively snap or upload for real-time AI optical evaluation.
Scan Preferences & Guardrail Alerts: Customized health targets (e.g., tracking Added Sugars, Parabens, PFAS, or artificial food dyes) saved within your profile.
Transaction Verification: Anonymous recurring subscription tokens processed securely via our Level-1 PCI compliant gateways (Stripe, Apple In-App Purchase, Google Play Billing). We never store raw credit card numbers.

3. AI Processing & Image Retention Policy

IngredientIQ integrates enterprise-grade Cloud AI networks (including secure OpenAI architectures) to evaluate text labels against toxicological databases.

No Public AI Model Training: Images transmitted through our enterprise AI pipeline are utilized strictly to execute immediate ingredient transcription and safety analysis for your personal dashboard. Your scan submissions and dietary records are NEVER utilized to train public, open generative models without explicit, opt-in clinical research consent.

4. Data Sharing & Third Parties

We do not broker, lease, or monetize user profiles or dietary behavior to third-party marketing networks or advertising aggregators. Limited data sharing is confined solely to vetted infrastructure subprocessors:

Cloud hosting and encrypted database providers (MongoDB Atlas) guaranteeing zero-knowledge physical storage security.
Payment processors required to validate subscription activity and trial eligibility.
Legal compliance mandates if lawfully directed by verified legal subpoenas or user protection orders.

5. Your Privacy Rights (GDPR & CCPA Compliance)

Whether you reside under European GDPR, California CCPA, or international mobile privacy standards, you maintain absolute sovereign control over your identity:

Right of Access & Export: Download a full structured transcript of your scan history, product evaluations, and profile data from app settings.
Right to Erasure ("Right to be Forgotten"): You can initiate instantaneous account deletion directly inside the mobile application settings, permanently wiping all authentication keys, custom guardrails, and scan histories from our active production databases.
Opt-Out of Telemetry: Disable non-essential analytical performance crash reports at any time.

6. Contact Our Privacy Officer

For official inquiries regarding data requests, infrastructure security reports, or privacy disclosures, contact our legal privacy compliance desk: