Privacy Policy

1. Introduction

Zenlo ("we," "our," or "us") operates the Zenlo mobile app and website. This Privacy Policy explains that we collect user data, what we collect, why, who we share it with, and your rights. Contact us at support@zenlo.app with questions.

2. We collect user data

We collect personal data that you give us and data generated when you use Zenlo. If you do not want us to collect this data, do not create an account or use the service.

• Account data: name, email address, Google account identifier, and profile photo URL if Google Sign-In provides them.
• Scan and product data: barcodes you scan, product names, ingredient lists, nutrition facts, and your scan history and favorites.
• Photos you upload: pictures of product packaging (front, ingredients, nutrition). These may include hands, surroundings, or other incidental details.
• Preferences: language, theme, allergen watchlist, and similar settings.
• Usage and device data: app screens viewed, feature use, approximate scan frequency, device type, OS, app version, IP address, and crash/error logs.
• Payment data: handled by Lemon Squeezy (merchant of record). We store subscription status, renewal/end dates, and Lemon Squeezy customer/subscription IDs — not your full card number.

3. Artificial intelligence

Zenlo uses artificial intelligence (AI) and large language models to read labels, research ingredients, generate product summaries and scores, translate display text, and produce a clean catalog cover image from your front photo.

Photos and extracted label text are sent to our AI processors solely to provide this analysis. Models are instructed not to act as a crisis or medical service. If you are in distress, see our AI & Safety page and contact local emergency services.

• We do not use your photos or account data to train public foundation models.
• Anonymized, aggregated product facts (for example an ingredient appearing in a barcode’s public catalog) may be used to improve Zenlo’s analysis quality.

4. Third-party processors

We do not sell your personal information. We share data with processors who help us run Zenlo, under contracts that limit their use of it:

• Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase Hosting / App Hosting, Firebase Analytics, Google Sign-In, Google Cloud / Vertex AI for cover-image generation).
• OpenRouter and its model providers (currently including DeepSeek and other research/vision models) for label reading, ingredient research, summaries, and translation.
• Exa (via OpenRouter web search) to retrieve public scientific and regulatory sources during ingredient research.
• Lemon Squeezy (and its payment partners, including Stripe) for checkout, invoices, receipts, renewal notices, and subscription billing.

5. How we use data

We use this data to:

• Create your account, authenticate you, and provide scanning, analysis, history, and Premium features.
• Process photos into catalog images and ingredient analysis for that barcode, which other users may see when they scan the same product.
• Process payments, renewals, cancellations, and statutory notices through Lemon Squeezy.
• Send in-app renewal reminders and service messages. Billing emails (receipts, renewal notices) are sent by Lemon Squeezy.
• Measure product usage with Firebase Analytics (no email or name in analytics events) and fix crashes.
• Comply with law and protect the service against abuse.

6. Photos, storage, and deletion

Raw photos you upload are stored privately, tagged to your account, and are not world-readable. After we generate catalog assets (a studio-style cover and downscaled label views), we delete the original JPEG uploads.

Catalog images are product data for that barcode (hands and background removed from the cover). They may be shown in the app and on public product pages at zenlo.online.

When you delete your account we immediately delete your Auth user, profile, scan history, favorites, allergen settings, and any remaining raw uploads tagged to you. Shared product catalog records (scores, ingredients, processed images for a barcode) are retained because they serve every user of that product — they are not your personal profile.

7. Retention

Account data is kept while your account is active. After account deletion, personal data is removed from our live systems promptly (typically within 24 hours; backups expire within 30 days). Billing records retained by Lemon Squeezy follow their legal retention duties.

8. Your rights

Depending on where you live (including Israel, the EEA, and the UK) you may request access, correction, deletion, export (portability), and restriction of processing. Use Settings → Export my data or Settings → Delete account, or email support@zenlo.app. We respond within 30 days.

9. Children

Zenlo is not directed to children under 13 (or the higher age required in your country). We do not knowingly collect personal data from children. Contact support@zenlo.app if you believe a child created an account.

10. International transfers

We are based in Israel. Processors listed above may store or process data in the United States, the EEA, or other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses used by Google and Lemon Squeezy).

11. Changes

We will post updates on this page and change the "Last updated" date. Material changes will also be flagged in the app where practical.

12. Contact

Privacy questions: support@zenlo.app. Operator: Zenlo, Israel.