Privacy Policy

1. Introduction

This Privacy Policy explains how Almondly collects, uses, stores, and protects information when you use the Almondly mobile application and related services (collectively, the "Service").

Almondly is operated by Hyde Organics Ltd, a company registered in England and Wales (Company Number: 15766340) (the "Data Controller").

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this Privacy Policy or our data practices, contact our designated privacy contact at: [email protected].

2. Information We Collect

2.1 Information You Provide

• Account registration information, including your email address and optional display name.
• Product images and ingredient list photographs you upload for analysis.
• Communications you send to our support team.
• Subscription and payment information (processed by the applicable app store; we do not directly collect or store payment card details).

2.2 Information Collected Automatically

• Product barcode scan activity and search history within the app.
• Device information, including device type, operating system version, and unique device identifiers.
• Usage analytics, including features accessed, session duration, and interaction patterns.
• Diagnostic and performance data, including crash reports and error logs.

2.3 Postcode Data (Water Quality Feature)

If you choose to use the tap water quality feature, you may enter a UK postcode. This postcode is used solely to match against our water quality dataset and return relevant results for your area. Postcodes are not stored against your account and are not retained after the query is processed.

3. Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

• Contract: Processing your account data and providing the Service is necessary for the performance of our contract with you (Article 6(1)(b)).
• Consent: Where you provide explicit consent, such as opting in to marketing communications or uploading product images for analysis (Article 6(1)(a)). You may withdraw consent at any time.
• Legitimate Interests: We process certain data (such as usage analytics and diagnostic information) for our legitimate interests in improving the Service, ensuring security, and understanding how users interact with the app (Article 6(1)(f)).
• Legal Obligation: We may process data where necessary to comply with applicable legal requirements (Article 6(1)(c)).

4. Camera and Photo Library Access

Almondly may request access to your device camera or photo library to allow you to capture or select images of product packaging or ingredient lists. These images are used solely for ingredient identification and analysis. Camera access is not required to use the app and may be declined; however, certain features such as barcode scanning and image-based ingredient analysis will be unavailable without it.

5. Automated Processing and Decision-Making

Almondly uses automated technologies, including machine learning models and optical character recognition (OCR), to analyse ingredient lists, identify ingredients, and generate product scores. These automated processes form a core part of the Service.

Product scores are generated algorithmically and are provided for general informational and educational purposes only. They do not produce legal effects or similarly significant effects on you within the meaning of Article 22 of UK GDPR.

Automated analysis may occasionally produce inaccurate or incomplete results. We recommend verifying any results that are important to you.

6. How We Use Your Data

• To operate, maintain, and provide the core features of the Almondly app.
• To analyse product ingredients and generate product scores.
• To process and manage your account and any premium subscription.
• To improve the accuracy and functionality of our analysis systems.
• To respond to your support requests and communications.
• To generate anonymised, aggregated insights for research and analytical purposes.
• To detect and prevent fraud, abuse, or security incidents.
• To comply with legal obligations.

6b. Pre-Launch Waitlist

Prior to the launch of the Almondly app, we may collect email addresses from individuals who express interest in the Service via our website. These email addresses are collected with consent and will be used solely to notify you when the Service becomes available. You may withdraw your consent at any time by contacting [email protected]. Waitlist data will not be used for any other purpose without your explicit consent.

7. Marketing Communications

Where you have provided explicit opt-in consent, we may send you marketing communications about Almondly features, updates, or promotions. In accordance with PECR 2003:

• Marketing consent is collected through a clear, unticked opt-in mechanism. We do not use pre-ticked boxes or assume consent.
• Every marketing communication includes a clear and functional unsubscribe mechanism.
• You may withdraw consent at any time via the unsubscribe link in any marketing email or by contacting [email protected].

8. Third-Party Service Providers

We engage trusted third-party service providers including cloud infrastructure, analytics, authentication, payment processing (via Apple App Store and Google Play), and AI/machine learning services. Each provider is contractually required to process your data only on our instructions and in accordance with applicable data protection law.

9. International Data Transfers

Some third-party providers may be located outside the United Kingdom. Where personal data is transferred to a country without an adequacy decision, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (UK IDTA) or the UK Addendum to EU Standard Contractual Clauses. Contact [email protected] for details.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit and at rest, access controls, regular security assessments, and employee training. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security.

11. Security Breach Notification

In the event of a personal data breach posing a risk to your rights and freedoms, Almondly will notify affected users and the Information Commissioner's Office (ICO) as required under Articles 33 and 34 of UK GDPR. Where feasible, notification to the ICO will be made within 72 hours of becoming aware of the breach.

12. Data Retention

• Account data: Retained for the duration of your account and for 12 months following account deletion, unless a longer period is required by law.
• Product scan and analysis data: Retained for the duration of your account.
• Uploaded images: Processed for ingredient extraction and may be retained in anonymised form for system improvement.
• Support communications: Retained for 24 months from the date of resolution.
• Legal compliance data: Retained as required by applicable law.

13. Your Rights Under UK GDPR

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data in certain circumstances.
• Right to Restriction: Request restriction of processing in certain circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing.

To exercise any of these rights, contact [email protected]. We will respond within one month. You also have the right to lodge a complaint with the ICO at ico.org.uk.

13.1 Account Deletion

You may delete your account at any time through app settings or by contacting [email protected]. Data will be deleted or anonymised in accordance with Section 12, subject to any legal obligations.

14. Anonymised and Aggregated Data

We may create anonymised and aggregated datasets derived from usage of the Service. Such data does not identify any individual and is not considered personal data under UK GDPR. We may use it for research, analytics, and system improvement without restriction.

15. Tracking Technologies and Analytics

The Almondly app may use SDKs and analytics tools to collect usage data. We do not use tracking technologies for serving third-party advertisements within the app. Where required, we will obtain your consent before activating non-essential analytics or tracking technologies.

16. Children's Privacy

The Service is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If we become aware that we have done so inadvertently, we will delete that data as soon as reasonably practicable. Contact [email protected] if you believe a child under 16 has provided us with personal data.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the app and, where appropriate, by email. Your continued use of the Service following the posting of changes constitutes your acceptance of those changes.

18. Contact Us

Hyde Organics Ltd
Company Number: 15766340
Email: [email protected]