Amla — amlascan.com · Last updated: 11 August 2026
This is a working draft, not a substitute for legal advice. It reflects how the Amla app actually works today (no login required, scan history stored locally on-device). If account features or a per-user backend are introduced, this page must be updated before that ships.
This Privacy Policy explains what personal information Amla collects, why, and the choices and rights you have.
This Privacy Policy explains how The Nirvanist LLP (company number OC460620, registered office 128 City Road, London, EC1V 2NX, United Kingdom), trading as Amla (“Amla,” “we,” “us,” “our”), collects, uses, and protects personal data when you use the Amla app or amlascan.com. We are the data controller for the personal data described in this policy. Amla is a product operated by The Nirvanist LLP, which also operates thenirvanist.com under a separate privacy policy — data collected through Amla is kept separate from data collected through The Nirvanist's other services and is not merged between them.
This policy applies wherever you're located; if you are in the UK or EU, you have specific rights described in Section 8 under the UK GDPR / Data Protection Act 2018 and the EU GDPR respectively.
| Category | Examples | Where it comes from |
|---|---|---|
| Contact data | Email address | Website update sign-up, support enquiries |
| Scan & usage data | Barcodes scanned, scan history, favourites | Stored locally on your device; not currently transmitted to or stored on our servers unless account features are introduced |
| Account data (if introduced) | Login credentials, saved preferences | Created if/when account functionality is added |
| Health-adjacent preference data (premium filters, if used) | Dietary pattern selections (e.g., Jain, gluten-free, diabetic-numbers view) | Set by you within the app, only if you choose to enable these optional filters |
| Communications | Emails or messages you send us | Direct correspondence via support/contact channels |
| Technical & usage data (website) | Pages visited, browser type, approximate location | Automatically via privacy-respecting analytics (see Section 5) |
We do not currently require an account to use core scanning and scoring, and we do not collect health or medical data about you as an individual — dietary filter preferences (if enabled) reflect a chosen viewing mode, not a medical record, and are not shared with any third party.
| Purpose | What we do | Legal basis (UK/EU GDPR) |
|---|---|---|
| Provide core scanning/scoring | Process the barcode you scan against our product database | Performance of a contract / legitimate interest |
| Send product updates (if you opt in) | Deliver major update notifications via email | Consent (opt-in) |
| Respond to enquiries | Customer support | Legitimate interest / contract |
| Improve the app and website | Privacy-respecting analytics | Legitimate interest |
| Comply with law | Regulatory or legal requests | Legal obligation |
The product information and scores shown in Amla (ingredients, nutrition facts, scoring) relate to products, not to you personally, and are sourced primarily from Open Food Facts, a collaborative open database, supplemented by our own research. This is separate from any personal data described above.
Where we use website analytics, we use privacy-respecting tools that do not use cookies and do not track individual visitors across sites. We do not run cookie-based advertising trackers, and no cookie consent banner is required as a result.
We share personal data only with trusted service providers who help us run the Service, under agreements requiring them to protect your data:
| Provider | Purpose |
|---|---|
| Supabase | Database (e.g., update-notification sign-ups) |
| Netlify | Website hosting |
| Open Food Facts | Source of product data (we query/contribute to this open database; we do not send your personal data to it) |
We do not sell your personal data, and we do not share it with third parties for their own independent marketing purposes without your consent.
Where we transfer personal data of UK or EEA residents outside the UK/EEA (for example, to service providers based elsewhere), we rely on appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or transfers to countries recognised as providing adequate protection.
If you are in the UK or EU, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, port your data, withdraw consent, and complain to your local data protection authority (the ICO in the UK). To exercise these rights, contact us at support@amlascan.com. If you're a California resident, you have similar rights under the CCPA/CPRA; we don't sell personal information.
We use technical and organisational measures appropriate to the data we hold, including encrypted connections and reputable, security-vetted processors. No system is 100% secure, but we take reasonable steps to protect your data.
Amla is not directed at children under 13, and we do not knowingly collect personal data from children. If we become aware we have inadvertently done so, we will delete it.
Amla's product scores are calculated automatically by applying published methodologies (see our methodology and Section 4 of our Terms) to product data — this relates to products, not to automated decisions about you as an individual, and does not produce legal or similarly significant effects about you.
We may update this policy as our Service, processors, or the law change. We'll update the “last updated” date above, and for material changes, provide a more prominent notice.
Data Controller: The Nirvanist LLP, trading as Amla, 128 City Road, London, EC1V 2NX, United Kingdom
Privacy queries: support@amlascan.com
Amla