Privacy Policy

1. Introduction

Welcome to PlantsPack. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform.

This policy applies to all users of PlantsPack, regardless of location. For users in the European Union, we comply with the General Data Protection Regulation (GDPR).

2. Information We Collect

2.1 Information You Provide

When you create an account and use PlantsPack, we collect:

• Account Information: Username, email address, password (encrypted), name, and profile picture
• Profile Information: Bio, preferences, and any other information you choose to add
• Content: Posts, comments, images, videos, recipes, events, and other content you create or share
• Location Data: If you choose to share your location or add vegan places, we collect city, country, and coordinate data
• Places Data: When you add or review vegan places, we collect the place name, address, coordinates, category, images, and reviews
• Payment Information: For voluntary supporter donations, processed securely through Stripe (we do not store full payment details)

2.2 Automatically Collected Information

When you use PlantsPack, we automatically collect:

• Usage Data: How you interact with the platform, features you use, and time spent
• Device Information: Browser type, operating system, and device identifiers
• IP Address: For security and analytics purposes
• Cookies: Small data files stored on your device (see Cookie Policy below)

3. How We Use Your Information

We use your information to:

• Provide Services: Create and maintain your account, enable posting and social features
• Personalize Experience: Show relevant content and connections based on your interests
• Communication: Send transactional emails (account confirmations, notifications you've enabled, password resets) and respond to inquiries
• Security: Protect against fraud, abuse, and unauthorized access
• Moderation: Enforce Community Guidelines and Terms of Service
• Analytics: Understand how users interact with PlantsPack to improve our services
• Legal Compliance: Comply with legal obligations and respond to lawful requests

3.1 Marketing Communications (Optional)

If you opt in — either by ticking the newsletter checkbox at signup or by enabling the preference in your account settings — we may send you a periodic newsletter covering new vegan places, top-rated spots, and platform updates. We send these emails on the basis of your explicit consent under GDPR Article 6(1)(a).

You can withdraw consent at any time by (a) toggling the newsletter preference off in your account settings, (b) clicking the unsubscribe link included in every newsletter, or (c) emailing hello@plantspack.com. Withdrawal takes effect immediately and does not affect transactional emails you receive for account activity (confirmations, notifications you've enabled, password resets, claim responses) — those continue regardless of your newsletter preference because they are necessary for operating your account.

We never pre-tick the newsletter checkbox, never bundle it into Terms acceptance, and never share your email address with third-party marketers. We keep a record of when and how you consented (required for GDPR audit) and preserve unsubscribe history indefinitely so we can prove we respected your choice.

4. Legal Basis for Processing (GDPR)

For EU users, we process your data based on:

• Contract: To provide services you've requested
• Consent: When you've given explicit permission (e.g., location sharing)
• Legitimate Interests: To improve our services, ensure security, and prevent abuse
• Legal Obligation: To comply with applicable laws

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Other Users: Your public profile and posts are visible to other users as per your privacy settings
• Service Providers: Third-party services that help us operate (e.g., Supabase for database, Stripe for payments)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In the event of a merger or acquisition

6. Data Retention

We retain your data for as long as:

• Your account is active
• Needed to provide services
• Required by law

When you delete your account, we remove or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., preventing abuse).

7. Your Privacy Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Portability: Request your data in a machine-readable format
• Objection: Object to certain processing of your data
• Withdraw Consent: Withdraw consent for data processing where applicable
• Complaint: Lodge a complaint with your data protection authority

To exercise these rights, contact us at hello@plantspack.com or through your account settings.

8. Data Security

We implement industry-standard security measures to protect your data:

• Encryption of data in transit (HTTPS) and at rest
• Secure password hashing
• Regular security audits
• Access controls and authentication
• Monitoring for suspicious activity

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but take all reasonable precautions to protect your information.

9. Cookies and Tracking

PlantsPack uses cookies to:

• Essential Cookies: Required for authentication and basic functionality
• Analytics Cookies: Help us understand how users interact with our platform
• Preference Cookies: Remember your settings and preferences

You can manage cookie preferences in your browser settings or through our cookie consent banner.

10. Third-Party Services

PlantsPack integrates with third-party services:

• Supabase: Database and authentication services
• Stripe: Payment processing for voluntary supporter donations
• Vercel: Hosting and deployment
• OpenStreetMap: Map data and geocoding for vegan places
• OpenAI: Content moderation assistance
• Resend: Transactional email delivery

These services have their own privacy policies. We encourage you to review them.

11. Children's Privacy

PlantsPack is not intended for users under 16 years of age. We do not knowingly collect information from children. If you believe a child has provided us with personal data, please contact us immediately.

12. International Data Transfers

Your data may be processed in countries outside your residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or platform notification. Your continued use of PlantsPack after changes constitutes acceptance of the updated policy.

14. Mobile Applications (iOS and Android)

In addition to the website, PlantsPack is available as a mobile application on iOS (Apple App Store, bundle identifier com.plantspack.app) and Android (Google Play, package plantspack.app). Everything in this Privacy Policy applies to the mobile apps. The sections below describe the additional, mobile-specific data handling required by Apple App Store and Google Play disclosure rules.

14.1 Device Permissions We Request

The mobile app asks for the following operating-system permissions only when you use the feature that needs them. You can decline any of them and continue using the rest of the app.

• Location (When-In-Use only): Used to centre the map on your current position and to show vegan places near you. We never collect location in the background, we do not build a location history, and we do not sell or share precise location data with third parties for advertising. Location is processed in memory to query nearby places and is not retained.
• Camera: Used by the barcode scanner, ingredient-label scanner, menu scanner, and to take a photo when you suggest a new place. Photos taken in scanners are used only for the scan itself.
• Photo Library: Used so you can pick an existing photo to scan or to attach to a place suggestion. We access only the images you select; we do not scan or index your library.
• Push Notifications: Optional. Used to send notifications you have explicitly subscribed to (for example, updates in cities you follow). You can turn push notifications off at any time in your device settings or in the app.

The Android app explicitly blocks the advertising ID (AD_ID) permission. We do not collect an advertising identifier on either platform, and we do not use device identifiers for advertising or cross-app tracking.

14.2 Photos You Scan (AI Scanners)

When you use the ingredient scanner, menu scanner, or barcode scanner, the image you capture is sent over an encrypted connection to our servers and forwarded to a third-party AI provider (OpenAI) which extracts and classifies the text. Images are not stored on our servers after the scan response is returned, are not used to train any AI model, and are not associated with your account in a way that lets us re-identify what you scanned. OpenAI processes the request under its API data-usage terms (no training, retained briefly for abuse monitoring). If you do not want to use a third-party AI provider, do not use the scanner tools — every other feature works without them.

14.3 Sign in with Apple

The iOS app supports Sign in with Apple. When you use it, Apple shares with us a stable user identifier and either your real email address or a private relay email address (your choice at sign-in). We use this identifier solely to create and authenticate your PlantsPack account. We do not receive any other information from your Apple ID.

14.4 Data Collection Summary (Apple App Privacy / Google Data Safety)

For Apple App Store “App Privacy” and Google Play “Data Safety” disclosures, the following categories apply to PlantsPack:

• Contact Info — Email Address: Collected, linked to identity, used for account functionality and (if you opt in) the newsletter. Not used for tracking.
• Identifiers — User ID: Collected, linked to identity, used for account functionality and analytics. Not used for tracking.
• User Content — Photos, Reviews, Place Suggestions, Posts: Collected, linked to identity, used for app functionality. You choose what to submit.
• Location — Precise / Coarse: Collected only while the app is open and only after you grant permission. Used for app functionality (showing nearby places). Not linked to identity unless you save a place or write a review. Not used for tracking.
• Usage Data — Product Interaction: Collected, linked to identity, used for analytics and to improve the app. Not used for tracking.
• Diagnostics — Crash and Performance Data: Collected, not linked to identity, used to fix bugs.

We do not collect: financial information (subscriptions are web-only, handled by Stripe), health or fitness data, sensitive demographic data, contacts, search history outside the app, browsing history, audio recordings, or your advertising identifier. We do not use your data for third-party advertising or cross-app tracking, and we do not share your data with data brokers.

14.5 Account Deletion (In-App)

Per Apple App Store guideline 5.1.1(v) and Google Play account-deletion policy, you can delete your PlantsPack account and associated personal data directly from the app:

• Open the app and go to Profile → Account → Delete account, or
• Visit plantspack.com/data-deletion-confirmation from any browser (no app install required), or
• Email hello@plantspack.com with “Delete my account” in the subject line.

Deletion removes or anonymises your account, profile, saved places, followed cities, reviews, comments, and posts within 30 days. We retain a minimal record of the deletion itself (account ID and timestamp) to honour the request if you re-register and for legal audit purposes, and we may retain content unrelated to your identity (for example, a place you suggested that has since been independently verified) in anonymised form.

14.6 Children

The mobile apps are rated for users aged 13 and over on Google Play and 12+ on the Apple App Store, however account creation requires you to be at least 16 years old, consistent with Section 11 of this policy. We do not knowingly collect data from children under that age. The apps are not directed at children, do not include behavioural advertising, and do not participate in Apple’s Kids Category or Google Play’s Designed for Families programme.

14.7 Mobile-Specific Third Parties

The mobile apps additionally interact with:

• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM): route push notifications you have opted into. Your device token is shared with Apple/Google for delivery only.
• OpenFreeMap and the underlying OpenStreetMap tile servers: serve the base map tiles. Your IP address is visible to the tile server when tiles are requested; this is standard for any map-based app and the tile server does not receive your account identity.
• Expo Application Services (EAS): delivers over-the-air JavaScript updates for the app. EAS receives the app version and platform, not personal data.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us. PlantsPack is operated by Cleareds, a company registered in Belgium.

• Data Controller: Cleareds (Belgium)
• Email: hello@plantspack.com
• Contact Form: Contact Us

For GDPR-related inquiries or to exercise your data rights, please include "GDPR Request" in your subject line.