Privacy Policy

AllergenBuilder Privacy Policy

Effective Date: June 26, 2026

1. Introduction

This Privacy Policy describes how AllergenBuilder ("we," "us," or "our") collects, uses, and handles information when you use our service. AllergenBuilder is a software tool for restaurant operators and food service businesses ("you" or "Operator"). This policy applies to all users of the Service.

2. Information We Collect

Account information: When you create an account, we collect your email address and, optionally, your name. We store a securely hashed version of your password — we are never able to read your password in plaintext.

Content you upload: To generate allergen disclosures, you may upload recipe card images and delivery invoice images. These files are stored on our servers and transmitted to our processing infrastructure.

Derived data: We store the results of processing your uploads, including dish names, ingredient lists, allergen classifications, supplier product matches, and menu structures, in a database associated with your account.

Session data: We use a session cookie to keep you logged in (see Section 5). We also store temporary processing data on our servers while you are actively working on a menu scan.

3. How We Use Your Information

We use the information we collect solely to provide the Service to you. Specifically, we use it to:

(a) Authenticate your account and maintain your session;

(b) Process your uploaded recipe cards and invoices to generate allergen disclosures;

(c) Store your menus, recipe cards, and allergen data so you can access them across sessions;

(d) Respond to support inquiries you send to allergenbuilder@gmail.com.

We do not sell your data. We do not use your uploaded recipe or ingredient content to train AI or machine learning models. We do not use your data for advertising purposes.

4. Third-Party Data Processors

Amazon Web Services (AWS): Uploaded images and extracted ingredient text are transmitted to AWS for automated processing as part of generating allergen disclosures. AWS acts as a data processor on our behalf and is subject to its own data processing terms. By using the Service, you consent to this processing.

Third-party supplier sources: To assist in identifying allergens, the Service retrieves ingredient and allergen data from publicly accessible third-party supplier websites. No personal data about you or your account is shared with any supplier in this process.

5. Cookie Notice

AllergenBuilder uses a single functional session cookie to maintain your login state. This cookie is set when you log in or create an account, has a 30-day lifetime, and is used only to keep you signed in — not for analytics, advertising, or tracking.

We do not use any third-party cookies, analytics cookies, or advertising cookies. If you disable cookies, you will not be able to use the Service.

6. Data Retention

We retain your account information and associated menus, recipe cards, and allergen data for as long as your account is active. Uploaded image files and derived allergen data are retained for the same period. If you request deletion of your account, we will delete your personal data and associated content from our systems.

Temporary processing data generated during active sessions is stored on our servers and associated with your account. It is removed when your account is deleted.

7. Your Rights (California Residents — CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

(a) Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, and how we use and share it.

(b) Right to Deletion: You may request that we delete your personal information, subject to certain exceptions.

(c) Right to Correct: You may request that we correct inaccurate personal information we hold about you.

(d) Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

We do not sell personal information and do not share it for cross-context behavioral advertising.

To submit a request, contact us at allergenbuilder@gmail.com. We will respond within 45 days; if we need additional time, we will notify you and may extend the response period by up to an additional 45 days.

8. Security

We take reasonable measures to protect your information, including storing passwords using industry-standard hashing. Data is stored on servers with standard security controls.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee the absolute security of your data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. Your continued use of the Service after the effective date of any change constitutes acceptance of the updated policy.

10. Contact

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at allergenbuilder@gmail.com.