Privacy Policy

Last updated: 20 October 2026

1. What this policy covers

This policy explains how we process personal data when you visit labeless.com and when you use the Labeless mobile app. It applies alongside the privacy information shown on the App Store and Google Play listings.

2. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Bytes & Pixels GmbH
Gröbenzeller Str. 40, 80997 München, Deutschland
Represented by: Benjamin Robert Bachhuber
E-mail: kontakt@bytes-and-pixels.de
Phone: 089-15002979

For questions about data protection, including requests to exercise your rights, write to kontakt@bytes-and-pixels.de.

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the site, the hosting provider automatically processes technical information (IP address, browser type, operating system, referrer URL, time of access) in server log files to deliver the website and ensure its stability and security (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with Vercel. Log data is deleted or anonymised after a short period.

4. Analytics and marketing on this website

This website currently uses no analytics or marketing tracking tools and sets no cookies beyond those technically required to deliver the pages.

5. Data we process in the Labeless app

Labeless helps you understand food and cosmetics: you scan a product's barcode or take a photo of its packaging, and the app explains its ingredients, additives and allergens and how well it fits your diet or your skin. To do that, the App processes the following data, each for the stated purpose and on the stated legal basis:

  • Account data (e-mail address and name, or your Apple, Google or Facebook sign-in; until you sign in, an anonymous user ID) — to create your account, sign you in and keep your data in sync between devices. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).
  • Profile and preferences (diet, skin type, skin concerns, age range, gender, ingredients you avoid, routine and lifestyle answers from the quiz) — to personalise scores, product matches, alerts, routines and recommendations. Legal basis: Art. 6 (1) (b) GDPR; for health-related answers Art. 9 (2) (a) GDPR (explicit consent).
  • Scans and product photos (barcodes, photos of packaging and ingredient lists, your scan history and saved products) — to identify the product, read its ingredients and show you the result and your history. Legal basis: Art. 6 (1) (b) GDPR.
  • Face photos for the skin analysis and the skin journal — to analyse visible skin features such as pores, fine lines and spots and to show how your skin changes over time; we do not use them to identify you. Legal basis: Art. 9 (2) (a) GDPR (explicit consent).
  • Messages to the AI assistant — to answer your questions and show you your chat history. Legal basis: Art. 6 (1) (b) GDPR.
  • Community content (posts, comments, likes, shared products, username, profile picture, and reports you file about others) — to show your contributions to other users and to moderate the community. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (f) GDPR (our legitimate interest in a safe community) for moderation.
  • Purchase data (subscription status, store receipts, and for web purchases your billing details, payment method and order history) — to unlock Labeless Plus, process payments, handle refunds and prevent misuse of free trials. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for invoices we are required to keep.
  • Usage data (screens you open, features you use, experiments you are part of, and screen recordings of app sessions), linked to a pseudonymous ID — to understand how the App is used, test improvements and find problems in the user interface. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in improving the App); you can object at any time by writing to us.
  • Device and diagnostic data (device model, operating system, app version, language, time zone, crash reports and error logs) — to deliver the App, find and fix errors and keep it stable. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a working app).
  • Advertising identifiers (IDFA on iOS, Google advertising ID on Android) and attribution data — to show ads in the free version and to measure which of our ad campaigns brought you to Labeless. Legal basis: Art. 6 (1) (a) GDPR (consent; on iOS through Apple's tracking permission).
  • E-mail address and push notification token — to send service messages, reminders, offers and the push notifications you switch on. Legal basis: Art. 6 (1) (b) GDPR for service messages, Art. 6 (1) (a) GDPR for marketing messages and push notifications.
  • Support correspondence (your message and contact details) — to answer your request. Legal basis: Art. 6 (1) (b) and (f) GDPR.

Where processing is based on your consent, you may withdraw it at any time with effect for the future; withdrawal does not affect the lawfulness of processing carried out beforehand. Where data is needed to provide a feature, not providing it means that feature cannot work.

6. Sensitive data (Art. 9 GDPR)

Labeless processes information about your health that you choose to give us: allergies and intolerances, skin conditions and concerns, whether you are pregnant or breastfeeding, hormonal changes, and photos of your face that you take for a skin analysis or your skin journal. Under Art. 9 GDPR this is a special category of personal data, so we process it only on the basis of your explicit consent (Art. 9 (2) (a) GDPR), which you give when you start using the relevant feature and can withdraw at any time by deleting the data or your account.

We do not use this data for advertising, we do not sell it, and we do not share it with advertising networks or data brokers. It is shared only with the service providers listed below, which act as our processors under Art. 28 GDPR and are bound to use it solely to run the service, and only when that is necessary for a feature you use.

Anything you export or share yourself — for example a report you send to your doctor — leaves our control once you send it. Please share such exports only with people you trust.

7. The quiz and checkout at app.labeless.com

You can take the Labeless quiz and buy a subscription on the web at app.labeless.com before you install the App. The quiz processes the same profile, preference and, if you choose to take one, face photo data described above, plus your e-mail address and name and the city you enter for local conditions such as UV index and air quality. Payments are processed by Stripe; we never see your full card details.

On these pages we use PostHog for pseudonymous analytics, and the Meta Pixel with the Meta Conversions API and the X (Twitter) pixel with its conversions API to measure our advertising. These tools read and set cookies and similar identifiers in your browser, and the conversions APIs send events such as page views, quiz completion and purchases from our server, with your e-mail address in hashed form where available, your IP address and browser information so the networks can match them to their ads.

8. Advertising and attribution partners

The free version of the App shows ads delivered by Google AdMob (Google Ireland Ltd.). We use Adjust (Adjust GmbH, Berlin) and the Meta SDK (Meta Platforms Ireland Ltd.) to measure which campaigns lead to installs and purchases. For these purposes we share your advertising identifier, device data and in-app events, including purchases, with these partners. Meta, Google and X act as independent controllers or jointly with us for this processing, and their own privacy policies apply.

On iOS, the App shares your advertising identifier only if you allow tracking in Apple's prompt; you can change this at any time under Settings → Privacy & Security → Tracking. On Android you can reset or delete your advertising ID in the system settings under Google → Ads. We do not sell your personal data, and we never share your health data, face photos or skin journal with advertising partners.

9. Automated analysis and AI

Product scans, face photos for the skin analysis and your chat messages are sent to OpenAI to read ingredient lists, analyse visible skin features and answer your questions. OpenAI processes this data on our behalf and does not use it to train its models. New community posts and comments, including attached images, are checked automatically by our moderation service, which uses an AI model to hide or delete content that breaks our rules; our team is notified of every decision and can reverse it.

These analyses do not make decisions that produce legal effects for you or similarly significantly affect you within the meaning of Art. 22 GDPR.

10. Service providers

We use the following providers to operate the App. They process data on our behalf as processors under Art. 28 GDPR, on the basis of a data processing agreement, and only on our instructions:

  • Apple App Store and Google Play (Apple Distribution International Ltd., Ireland and Google Ireland Ltd., Ireland) — distribution of the App and processing of in-app purchases.
  • Google Firebase (Google Ireland Ltd., Ireland) — sign-in, the database and file storage for your profile, scans, photos, chats and community content, push notifications, remote configuration, crash reports and app analytics.
  • Heroku (Salesforce, Inc., USA) — hosting of our backend servers.
  • Supabase (Supabase, Inc., USA) — hosting of our product catalogue and app configuration.
  • OpenAI (OpenAI Ireland Ltd., Ireland and OpenAI, L.L.C., USA) — AI analysis of product photos and face photos, and answers from the AI assistant.
  • Algolia (Algolia SAS, France) — product search.
  • RevenueCat (RevenueCat, Inc., USA) — management and validation of subscriptions.
  • Helium (Helium, USA) — delivery of the subscription screens and their A/B tests.
  • Stripe (Stripe Payments Europe Ltd., Ireland) — payment processing for subscriptions bought on the web, including PayPal payments.
  • Statsig (Statsig, Inc., USA) — feature flags and A/B tests.
  • PostHog (PostHog, Inc., EU Cloud) — pseudonymous product analytics, session recordings and error tracking.
  • Sentry and Dash0 (Functional Software, Inc., USA and Dash0, Inc., USA) — error and performance monitoring of our backend.
  • Customer.io (Peaberry Software, Inc., USA) — e-mails, push notifications and in-app messages.
  • Slack (Slack Technologies, LLC, USA) — internal alerts to our team about flagged community content, including the author's username and an excerpt.
  • Vercel (Vercel Inc., USA) — hosting of labeless.com and the web quiz at app.labeless.com.

Apple and Google additionally act as independent controllers for the store and payment data they collect when you download the App or make a purchase; their own privacy policies apply to that processing.

11. Transfers outside the EU

Some of the providers named above are based outside the European Economic Area, or process data there. In those cases the transfer is safeguarded by the European Commission’s standard contractual clauses, by the provider’s certification under the EU-US Data Privacy Framework, or by your explicit consent (Art. 44 ff. GDPR). Despite these safeguards, we cannot rule out that authorities in those countries access data.

12. How long we keep data

We keep your account, profile, scans, photos, skin journal, chats and community content for as long as you have an account. When you ask us to delete your account, we erase this data within 30 days. Purchase records are kept for as long as tax and commercial law requires, and support correspondence for up to two years after your request is closed.

Website server log data is kept only briefly for security purposes. Beyond that we keep personal data only as long as it is needed for the purpose it was collected for, or as long as statutory retention periods require — invoices and accounting records, for instance, must be kept for up to ten years under German tax and commercial law.

13. Deleting your data

You can delete your data at any time: open Settings → Delete account in the App to sign out and remove your account from your device, then write to help@labeless.com from the e-mail address of your account and we erase everything stored about you on our servers, including your profile, scans, photos, skin journal, chats and community posts. You can also ask us to do it by writing to help@labeless.com — we confirm deletion within 30 days.

Deletion removes your data from our live systems. Encrypted backups are overwritten on their normal rotation, and data we must keep for legal reasons — invoices, for instance — is blocked from further use instead of deleted until the retention period ends.

14. Children

The App is not directed at children under 18 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will delete it. Where we rely on consent, users under 16 in the EU need the consent of a parent or guardian (Art. 8 GDPR).

15. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future. To exercise your rights, contact kontakt@bytes-and-pixels.de.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany. You may also contact the authority where you live.

16. Changes to this policy

We may update this privacy policy to reflect legal or technical changes. The current version is always available at https://labeless.com/privacy.