Last updated: May 2025

1. Data Controller

Thomas Duclain - Lyon, 69000, France
Email: [email protected]

2. Data Collected

2.1 At Account Creation

Email address (via Google Sign-In)
Google display name (optional, editable)
Google profile photo (optional)

2.2 During Use

Scans: scanned barcodes and timestamps
Ratings: scores, reviews, product flags
Profile: dietary preferences, purchase countries, language
Shopping lists: added products and quantities
Meal plans: planned dishes and ingredients

2.3 Technical Data

Browsing data collected via Google Analytics (GA4) - see section 5
Anonymised server logs (error resolution)
Internal usage metrics (signed-in users only): product page views, "alternatives" widget opens, additions to shopping lists, searches performed, filters applied, session heartbeats. Stored on Supabase (EU), linked to your account, used to improve the service and prepare aggregated, anonymised B2B insights.
Sign-up context: platform (web/iOS/Android), country (Cloudflare IP geolocation), browser (user-agent), referring site truncated to the origin. Stored once at account creation, read-only afterwards.
Search filters: when you apply filters (allergens, dietary preferences, religious preferences), the combination is recorded for statistical analysis. These data fall under special categories (health, religious beliefs) and are processed on the basis of your consent to use the service, and are never shared in an identifiable form.

3. Purposes of Processing

Authentication and account management - Legal Basis : Contract performance
Display of public ratings - Legal Basis : Consent (user's choice)
Personalisation (preferences, language) - Legal Basis : Contract performance
Service improvement (analytics) - Legal Basis : Legitimate interest / cookie consent
Security and fraud prevention - Legal Basis : Legitimate interest

4. Data Sharing

Personal data is not sold or transferred to third parties for commercial purposes.

Data may be shared with:

Supabase Inc. - storage and authentication. Data hosted in the EU region (Paris, AWS eu-west-3). See their privacy policy.
Google LLC - OAuth authentication and analytics (GA4). See their privacy policy.

Launch notification & newsletter

If you sign up on the "Get notified" page, we collect your email address, your phone type (Android/iPhone) and your display language, based on your consent. They are used to notify you once when the app is released (in your language) and, only if you tick the optional box, to send you the YumiQ newsletter. Data is deleted after the launch email unless you opted in to the newsletter; every email contains an unsubscribe link, and you can also write to the contact address given in the legal notice.

5. Cookies and Trackers

YumiQ uses cookies via Axeptio (consent management) and Google Analytics (GA4) via Google Tag Manager. These tools are only activated after your explicit consent. You can change your preferences at any time by clicking the "Manage cookies" button at the bottom of the page.

For more details on the cookies used, see our cookie policy.

6. Retention Period

User account and associated data - Duration : Until account deletion
Public ratings (if anonymised) - Duration : Lifetime of the service
GA4 analytics data - Duration : 14 months (GA4 setting)
Server logs - Duration : 30 days

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

Access: obtain a copy of your data
Rectification: correct inaccurate data
Erasure: delete your account and data
Portability: receive your data in a structured format
Objection: object to processing based on legitimate interest
Restriction: request the suspension of processing

To exercise your rights: [email protected]
Response time: up to 30 days.

You may also lodge a complaint with your national supervisory authority (e.g., CNIL in France).

8. International Transfers

Data may be transferred to the United States via Google (authentication, analytics). These transfers are governed by the European Commission's Standard Contractual Clauses (SCCs).

9. Security

Data is transmitted over HTTPS. Database access is restricted and protected by row-level security policies (Row Level Security, Supabase). No payment data is collected or stored by YumiQ.

10. Minors

YumiQ is accessible to all ages. No sensitive data specific to minors is collected. Use by minors is under the responsibility of parents or legal guardians.

11. DPO Contact

No DPO has been appointed (not required for this activity). All GDPR requests: [email protected]