Privacy Policy

CanIEatIt.com is operated by RTechnologies B.V., registered in the Netherlands under KvK number 34241441. RTechnologies B.V. is the data controller for personal data processed through this service.

For privacy questions or to exercise your rights, contact: privacy@canieatit.com

Account data: name, email address, hashed password, subscription status.

Health-related data stays on your device: age group, pregnancy status, allergies, medical conditions, medication groups, dietary restrictions and your check history are stored only in your browser. We do not store them on our servers or link them to your account.

During a check: the food you enter and the restriction codes you selected are sent to our server without your account, session ID or IP address attached, forwarded to our AI provider to generate the factual answer, and returned to you. We do not store or log the content of checks.

Quota data: a daily check counter per account or random session ID. Before a check you receive a single-use anonymous pass, so the counter cannot be linked to what you checked.

Technical data: IP address (processed briefly by our hosting provider to deliver requests, not stored by us and not passed to the AI provider), browser type, device type.

Profiles, medication choices and history do not sync across devices. You can make an encrypted backup, restore it, or delete everything in Settings; clearing your browser data also deletes it. Other people using the same browser may see it. Data stored on our servers before this change has been removed from active application tables; provider backups may keep historical copies until their normal expiry.

• To provide and personalize food safety checks;
• To maintain your account and subscription (check history stays on your device);
• To enforce free-tier limits (5 checks per day);
• To send transactional emails (account confirmation, password reset) via our email provider;
• To analyse usage patterns and improve the service (only with your cookie consent for analytics).

• Contract performance (Art. 6.1.b): account management and delivering the check service.
• Explicit consent (Art. 9.2.a): processing health-related profile data (allergies, medical conditions, pregnancy status).
• Legitimate interest (Art. 6.1.f): fraud prevention, security, and rate limiting.
• Legal obligation (Art. 6.1.c): when required by Dutch law.

We do not sell your data. We share data only with the following processors:

• Supabase — database and authentication infrastructure (EU region).
• Lovable / Vercel — hosting infrastructure.
• Google — OAuth login, only if you choose "Continue with Google".
• Stripe — payment processing for Premium subscriptions.
• Google Analytics 4 via Google Tag Manager — usage analytics, only with your cookie consent. Data may be processed in the US under EU Standard Contractual Clauses.
• Anthropic / Google — AI model providers processing your food input and anonymised profile data to generate check results. Inputs are not used for model training per provider agreements.

• Account and profile data: retained until account deletion.
• Check history: retained for 24 months, then automatically deleted.
• Anonymous session data: reset daily; deleted after 30 days of inactivity.

You can request deletion of all your data at any time (see Your Rights below).

As an EU resident you have the right to:

• access your personal data;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• export your data in a machine-readable format;
• withdraw consent for health data processing (closes your account);
• object to processing based on legitimate interest;
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

To exercise these rights, email privacy@canieatit.com. We respond within 30 days.

CanIEatIt.com uses three categories of cookies and local storage:

• Essential — login, session management, and language preferences (ciei_session_id, ciei_lang, authentication tokens). Always active.
• Analytics — Google Analytics 4 via Google Tag Manager. Only set with your consent. Data may be processed in the US under EU Standard Contractual Clauses.
• Functional — remembers your food check profile between sessions (ciei_profiles_v1, ciei_history_v1, localStorage — profiles and history on this device only).

You can change your preferences at any time: Open cookie settings.

This service is not directed at children under 13. We do not knowingly collect personal data from children. Profile data for infants and young children may be entered by a parent or guardian.

We will notify registered users by email of material changes to this policy. Last updated: 24 October 2026.