Privacy Policy

1. Who We Are

Decode Label is a product operated by Ingranova Technologies Private Limited ("we", "us", "our"), a company registered in India. We provide a Decode Label-powered ingredient safety platform that helps consumers understand the ingredients in food, cosmetic, and supplement products.

We act as the Data Fiduciary under India's Digital Personal Data Protection (DPDP) Act 2023 in respect of all personal data we process.

Contact: privacy@decodelabel.com

2. Data We Collect

2.1 Account Data

When you create an account, we collect your name, email address, and (optionally) phone number. If you sign in via Google, Facebook, Microsoft, or LinkedIn, we receive basic profile data from that provider (name, email, profile picture). We never receive your social media password.

2.2 Health Profile Data

If you choose to set up a personalised health profile, we collect the health conditions, allergies, and dietary preferences you voluntarily provide (e.g., "diabetic", "gluten intolerant", "vegan"). This is sensitive personal data under the DPDP Act and is only collected with your explicit consent.

2.3 Product Scan & Submission Data

When you scan or submit a product, we process: the product name, brand, ingredient list, and any product images you upload. Ingredient data you contribute is stored in our shared database and may be seen by other users once approved by our moderation team.

2.4 Usage Data

We automatically collect standard server logs including your IP address, browser type, pages visited, and timestamps. We use this data for security, debugging, and analytics. We do not sell this data or use it for advertising profiling.

2.5 Payment Data

Subscription payments are processed by Razorpay. We do not store your full card number, CVV, or UPI PIN. Razorpay provides us with a transaction reference and payment status only.

3. How We Use Your Data

• To provide the ingredient safety scoring service and personalised alerts
• To process your account registration and authenticate you
• To process subscription payments via Razorpay
• To send transactional emails (product approval/rejection, account security)
• To improve the accuracy of the Decode Label safety models using aggregated, anonymised data
• To comply with legal obligations, including DPDP Act 2023 and FSSAI regulations

We will never sell your personal data, use it for behavioural advertising, or share it with data brokers.

4. Health & Sensitive Data

Health profile data (medical conditions, allergies, dietary preferences) is classified as sensitive personal data under India's DPDP Act 2023. We handle it with the following safeguards:

• Explicit consent: We only collect health data when you voluntarily set up a health profile. You are shown a clear consent notice before providing this data.
• Encryption at rest: Health profile data is encrypted using AES-256 before storage.
• Access control: Only your account can view your health profile. Our support team cannot read it without your explicit authorisation.
• No Decode Label training on identifiable health data: We use only anonymised, aggregated data to improve our models.
• Deletion on request: You can delete your health profile at any time from your account settings, or by emailing privacy@decodelabel.com.

5. Sharing with Third Parties

We share data with the following categories of third parties, only as necessary to provide our service:

Third Party	Purpose	Data Shared
Google Gemini	Ingredient safety analysis	Ingredient names (no personal data)
Google Cloud Vision	OCR / image text extraction	Product label images
Razorpay	Payment processing	Name, email, payment amount
AWS / Cloudflare R2	Image storage	Product images you upload

All third-party processors are contractually required to protect your data and may not use it for their own purposes beyond the service they provide us.

6. Data Retention

• Account data: Retained while your account is active. Soft-deleted immediately on account deletion, permanently purged within 30 days.
• Health profile: Deleted immediately when you remove it, or when you delete your account.
• Scan history: Retained for 2 years, then anonymised and retained for analytics.
• Product submissions: Retained indefinitely as part of the public ingredient database (your name is not publicly linked to submissions after account deletion).
• Payment records: Retained for 7 years as required by Indian accounting law.

7. Your Rights under the DPDP Act 2023

As a Data Principal under India's Digital Personal Data Protection Act 2023, you have the following rights:

• Right to access: Request a copy of all personal data we hold about you.
• Right to correction: Request correction of inaccurate personal data.
• Right to erasure: Request deletion of your personal data (subject to legal retention obligations).
• Right to grievance redressal: File a complaint with our Data Protection Officer at privacy@decodelabel.com. We will respond within 30 days.
• Right to nominate: Nominate another person to exercise rights on your behalf in case of incapacity or death.
• Right to withdraw consent: Withdraw consent for processing of your sensitive personal data at any time without affecting prior processing.

To exercise any of these rights, email privacy@decodelabel.com with the subject line "DPDP Rights Request". We will verify your identity and respond within 30 days.

8. Children's Privacy

Decode Label is not directed to children under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@decodelabel.com and we will delete it promptly.

9. Security

We implement industry-standard security measures including AES-256 encryption at rest, TLS 1.3 in transit, access controls, and regular security audits. However, no internet transmission is 100% secure. In the event of a data breach affecting your rights, we will notify you and the relevant authority (CERT-In) as required by applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the website at least 14 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, concerns, or rights requests:

Data Protection Officer
Ingranova Technologies Private Limited
Email: privacy@decodelabel.com
Response time: Within 30 business days