Privacy Policy

HowPure Mobile Application

Effective Date: May 21, 2026 · Last Updated: May 21, 2026

1. Introduction

Welcome to HowPure. This Privacy Policy explains how MB “BD Consulting” (hereinafter “HowPure”, “we”, “us”, or “our”), a company registered in the Republic of Lithuania, collects, uses, stores, and protects your personal data when you use the HowPure mobile application (the “App”).

We are committed to protecting your privacy and processing your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

Data Controller: MB “BD Consulting”
Contact: [email protected]
Applicable Jurisdictions: European Union / European Economic Area

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Data You Provide Directly

• Account Information: email address, name or username
• Profile Preferences: persona selection, custom ingredients to avoid (e.g., allergens, lifestyle-based restrictions)
• User-Generated Content: product reviews, product submissions to our database

2.2 Data Collected Automatically

• Usage Data: scanned barcodes, search queries, product interaction history
• Device Data: device name, device model, operating system version, App version
• Analytics Data: feature usage patterns, session duration, crash reports (collected via Amplitude and Sentry)

2.3 Data We Do Not Collect

We do not collect precise geolocation data, financial or payment card information (payments are processed by Apple App Store, Google Play Store, and RevenueCat), or any biometric data.

3. How We Use Your Data

We process your personal data for the following purposes and on the following legal bases:

• Account Management — Creating and maintaining your account, authenticating access. Legal basis: Performance of contract (Art. 6(1)(b)).
• Core App Functionality — Product scanning, ingredient analysis, safety ratings, personalized warnings. Legal basis: Performance of contract (Art. 6(1)(b)).
• Personalization — Matching products to your ingredient preferences, persona, and restrictions. Legal basis: Performance of contract (Art. 6(1)(b)).
• Product Recommendations — Suggesting alternative products (generic in Pure, personalized in Pure+). Legal basis: Legitimate interest (Art. 6(1)(f)).
• Analytics & Improvement — Understanding usage patterns, improving features, fixing bugs. Legal basis: Legitimate interest (Art. 6(1)(f)).
• Database Improvement — Processing user-submitted products and reviews to expand our database. Legal basis: Legitimate interest (Art. 6(1)(f)).
• Communication — Responding to support requests, sending service notifications. Legal basis: Performance of contract (Art. 6(1)(b)).
• Marketing — Sending promotional content about HowPure features and updates. Legal basis: Consent (Art. 6(1)(a)).

4. Subscription Tiers and Data Processing

HowPure offers two subscription tiers: Pure (free) and Pure+ (paid). The data we collect is identical across both tiers; what differs is the depth of personalization processing applied to your data.

• Pure (Free): Unlimited product scanning, full ingredient breakdown and safety scores, generic alternative product suggestions (not personalized to your profile), product history limited to your most recent 25 scans or searches.
• Pure+ (Paid): All Pure features plus: product search by name or brand, ingredient alerts personalized to your profile (allergens, sensitivities, lifestyle preferences), alternative product recommendations filtered to your profile, and unlimited product history with search.

Both tiers collect the same categories of personal data. The difference lies in the depth of personalization processing applied to your data.

5. Data Sharing and Third-Party Processors

We do not sell, trade, or rent your personal data to third parties. We share data only with the following categories of service providers who process data on our behalf:

• DigitalOcean — Cloud hosting and data storage. Data processed: All App data. Location: Frankfurt, Germany (EU).
• Firebase (Google) — Authentication, push notifications. Data processed: Account data, device tokens. Location: EU region.
• Amplitude — Product analytics. Data processed: Usage and event data (pseudonymized). Location: EU/US (SCCs apply).
• Sentry — Error monitoring and crash reporting. Data processed: Device data, crash logs. Location: EU/US (SCCs apply).
• RevenueCat — Subscription management. Data processed: Purchase data, subscription status. Location: US (SCCs apply).

All third-party processors are bound by Data Processing Agreements (DPAs) in accordance with Article 28 of the GDPR. Where data is transferred outside the EU/EEA, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

6. Data Storage and Security

Your personal data is stored on servers located in Frankfurt, Germany, within the European Union. We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication for internal systems
• Regular security assessments and updates
• Minimization of data collection to what is strictly necessary

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Account Data: Retained for the duration of your account. When you request account deletion, your account is immediately deactivated and access to the App is suspended. Your personal data is retained for a 30-day grace period during which you may contact our support team at [email protected] to restore your account. After 30 days, all personal data is permanently and irreversibly deleted.
• Usage Data and Analytics: Retained in pseudonymized form for up to 24 months for analytics purposes, then deleted.
• User-Submitted Content: Product submissions and reviews are anonymized (all personally identifiable information removed) upon account deletion. Anonymized content is retained to maintain the integrity and quality of the HowPure product database.
• Device and Crash Data: Retained for up to 12 months for debugging and improvement purposes.

8. Your Rights Under the GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): You may request deletion of your personal data. Upon such request, your account is immediately deactivated and access to the App is suspended. Your personal data is retained for a 30-day grace period during which you may contact our support team to restore your account. After 30 days, all personal data is permanently and irreversibly deleted. User-submitted content (products, reviews) is anonymized at that point rather than deleted, to maintain the integrity of the HowPure product database.
• Right to Restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.
• Right to Data Portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): You may object to processing based on legitimate interests, including for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, www.ada.lt).

9. Children’s Privacy

HowPure is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without parental consent, we will take steps to delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at [email protected].

10. International Data Transfers

Your primary data is stored within the EU (Frankfurt, Germany). Some of our third-party processors may process data outside the EU/EEA. In such cases, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): Approved by the European Commission under Article 46(2)(c) GDPR, in place with Amplitude, Sentry, and RevenueCat.
• Adequacy Decisions: Where available, we rely on adequacy decisions by the European Commission.
• EU-U.S. Data Privacy Framework: Where applicable and certified by the relevant provider.

11. Analytics and Tracking Technologies

The HowPure App does not use browser cookies. We use mobile SDKs to operate the App and to understand how it is used. These technologies are grouped by purpose and legal basis below.

11.1 Essential Technologies (Required for the App to Function)

These technologies are necessary to provide the App’s core functionality. They cannot be disabled while you are using the App, and we rely on legitimate interest under Article 6(1)(f) GDPR to operate them.

• Firebase (Google): Used for authentication (magic-link sign-in, account verification) and push notification delivery.
• Sentry: Used for crash reporting and error monitoring. Sentry collects device data and error logs to help us identify, diagnose, and fix issues. Data is pseudonymized.

11.2 Analytics for Improvement

We use Amplitude to understand how features are used, identify friction points, and improve the App over time. This processing is based on our legitimate interest in improving the product (Article 6(1)(f) GDPR), balanced against your right to opt out at any time.

• Amplitude: Product analytics and feature usage tracking. Amplitude assigns a pseudonymized user identifier. Event data does not include your name, email, or other directly identifying information.

You can opt out of Amplitude analytics tracking at any time by going to Settings → Privacy → Analytics and toggling “Allow analytics tracking” off. Opting out does not affect the App’s core functionality.

11.3 What We Do Not Do

• We do not use advertising trackers.
• We do not share analytics data with advertisers or data brokers.
• We do not sell your data.
• We do not use third-party tracking SDKs other than those listed above.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will notify you of material changes by:

• Posting the updated policy within the App
• Sending a notification via email or push notification for significant changes
• Updating the “Last Updated” date at the top of this policy

We encourage you to review this policy periodically. Continued use of the App after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

Data Controller: MB “BD Consulting”
Registered address: Fabijoniškių g. 92-54, Vilnius
Email: [email protected]

For complaints regarding data protection, you may also contact the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija):

Website: www.ada.lt
Email: [email protected]