Privacy Policy

HaoChi is a project by DM TECH S.r.l., the data controller, with registered office at Via Paolo Segneri 4, 00152 Roma (RM), VAT no. and Tax code 15631691001, REA RM-1603583.

For any privacy-related request you can write to info@haochi.it.

We only collect the data needed to run the service:

• Browsing data: IP address, browser type, pages or services requested and time, logged automatically by our servers for technical and security reasons.
• Account data: first name, last name, email address, preferred language and password, stored in hashed, unreadable form.
• Sign in with Google: if you choose to sign in with Google we receive your Google account identifier, first name, last name, email, profile picture and language.
• Sign in with Facebook: if you choose to sign in with Facebook we receive your Facebook account identifier, first name, last name, email and profile picture.
• Sign in with Apple: if you choose to sign in with Apple we receive your Apple ID identifier and email, which may be the anonymous address created by Apple if you choose "Hide My Email". First and last name reach us only on the first sign-in, if you decide to share them.
• Barcodes: the codes of the products you look up are sent to our servers only to retrieve product information. Lookups are not linked to your account: the service does not receive your identity and does not record who looked up which product. The code only remains in the server's technical logs, together with the IP address, for the time indicated below.
• History and preferences: your scan history and dietary preferences stay on your device. Our servers have no service to receive or sync them; if we introduce one in the future, we will update this policy before enabling it.
• Newsletter: if you subscribe, your email, language, the date and IP address of the request and the date of confirmation, which serve as proof of consent.
• Website usage statistics: only with your consent, through Google Analytics with anonymized IP address. See the Cookie Policy.
• Messages you send us: if you write to us, your email address and the content of the message.

• Providing the service (account, sign-in with Google, Facebook or Apple, product lookup, account emails): performance of a contract, Art. 6(1)(b) GDPR.
• Security and abuse prevention (technical logs, rate limits): legitimate interest, Art. 6(1)(f) GDPR.
• Newsletter: consent, Art. 6(1)(a) GDPR, which you can withdraw at any time.
• Anonymous website statistics: consent, Art. 6(1)(a) GDPR, which you can withdraw at any time.
• Answering your requests and complying with legal obligations: Art. 6(1)(b) and 6(1)(c) GDPR.

We do not sell your data and we do not use it for advertising. We only share it with the providers that help us run the service, appointed as data processors, or with the services you choose:

• Hetzner Online GmbH (Germany): hosts the website, the app backend and the database on servers located in the European Union.
• Email delivery service: the provider we use to send account emails (verification, password recovery, deletion) and the newsletter.
• Google: for Google sign-in and, only with your consent, for Google Analytics.
• Meta Platforms (Facebook): only if you choose to sign in with Facebook.
• Apple: only if you choose to sign in with Apple.
• Open Food Facts: receives only the barcode of the product you look up, with no personal data.

Any in-app purchases, such as premium features, are handled by Apple (App Store) and Google (Google Play) under their own terms. DM TECH S.r.l. does not receive or store your payment card details: it only receives the status of the purchase or subscription, to enable the purchased features.

Our servers are in the European Union. Google, Meta and Apple may also process data in the United States: such transfers rely on the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.

• Account data: as long as the account is active. When you delete it, it is erased immediately; database backup copies are overwritten within 30 days.
• Unverified accounts: if you sign up with email and password but do not confirm your address within 30 days, the account is deleted automatically.
• Newsletter subscription: as long as you stay subscribed. After you unsubscribe we keep your address and the date of unsubscription, as proof of your choice.
• Unconfirmed newsletter subscriptions: if you do not click the confirmation link within 30 days, the request is deleted automatically.
• Technical logs: 14 days.
• Google Analytics data: 14 months.
• Website browsing session: 2 hours of inactivity, unless you choose "Remember me".

You can delete your account and all associated data at any time, in one of these ways:

• from your profile, in the HaoChi app or on the website (profile → "Delete account");
• from the Delete account page, which works without installing the app: enter your email and we send you a link to confirm;
• by writing to info@haochi.it from the email address linked to the account.

At any time you can ask us to access, correct or delete your data, restrict its processing, receive it in a portable format or object to its processing. You can also withdraw any consent you gave, without affecting processing already carried out.

To exercise these rights write to info@haochi.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country.

The service is not intended for children under 14 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. If we make significant changes we will let you know through the website or the app; the date of the last update is shown at the top of the page.