Privacy Policy

CanIEatIt.com is operated by RTechnologies B.V., registered in the Netherlands under KvK number 34241441. RTechnologies B.V. is the data controller for personal data processed through this service.

For privacy questions or to exercise your rights, contact: privacy@canieatit.com

Account data: name, email address, hashed password.

Profile data: age group, pregnancy status, allergies, medical conditions, dietary restrictions. Health-related profile data constitutes special category data under GDPR Article 9. We process this data solely to provide personalized food safety checks, based on your explicit consent given at signup.

Usage data: food inputs, check results, timestamps, session IDs.

Anonymous session data: check count per day (for rate limiting), stored against a randomly generated session ID — not linked to any person unless you create an account.

Technical data: IP address (processed by our hosting and database infrastructure providers, not stored by us), browser type, device type.

• To provide and personalize food safety checks;
• To maintain your account and check history;
• To enforce free-tier limits (5 checks per day);
• To send transactional emails (account confirmation, password reset) via our email provider;
• To analyse usage patterns and improve the service (only with your cookie consent for analytics).

• Contract performance (Art. 6.1.b): account management and delivering the check service.
• Explicit consent (Art. 9.2.a): processing health-related profile data (allergies, medical conditions, pregnancy status).
• Legitimate interest (Art. 6.1.f): fraud prevention, security, and rate limiting.
• Legal obligation (Art. 6.1.c): when required by Dutch law.

We do not sell your data. We share data only with the following processors:

• Supabase — database and authentication infrastructure (EU region).
• Lovable / Vercel — hosting infrastructure.
• Google — OAuth login, only if you choose "Continue with Google".
• Stripe — payment processing for Premium subscriptions.
• Google Analytics 4 via Google Tag Manager — usage analytics, only with your cookie consent. Data may be processed in the US under EU Standard Contractual Clauses.
• Anthropic / Google — AI model providers processing your food input and anonymised profile data to generate check results. Inputs are not used for model training per provider agreements.

• Account and profile data: retained until account deletion.
• Check history: retained for 24 months, then automatically deleted.
• Anonymous session data: reset daily; deleted after 30 days of inactivity.

You can request deletion of all your data at any time (see Your Rights below).

As an EU resident you have the right to:

• access your personal data;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• export your data in a machine-readable format;
• withdraw consent for health data processing (closes your account);
• object to processing based on legitimate interest;
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

To exercise these rights, email privacy@canieatit.com. We respond within 30 days.

CanIEatIt.com uses three categories of cookies and local storage:

• Essential — login, session management, and language preferences (ciei_session_id, ciei_lang, authentication tokens). Always active.
• Analytics — Google Analytics 4 via Google Tag Manager. Only set with your consent. Data may be processed in the US under EU Standard Contractual Clauses.
• Functional — remembers your food check profile between sessions (ciei_check_profile, localStorage).

You can change your preferences at any time: Open cookie settings.

This service is not directed at children under 13. We do not knowingly collect personal data from children. Profile data for infants and young children may be entered by a parent or guardian.

We will notify registered users by email of material changes to this policy. Last updated: June 2025.