Amla — amlascan.com · Last updated: August 13, 2026
This Privacy Policy explains what personal information Amla collects, why, and the choices and rights you have.
This Privacy Policy explains how The Nirvanist LLP (company number OC460620, registered office 128 City Road, London, EC1V 2NX, United Kingdom), trading as Amla (“Amla,” “we,” “us,” “our”), collects, uses, and protects personal data when you use the Amla app or amlascan.com. We are the data controller for the personal data described in this policy. Amla is a product operated by The Nirvanist LLP, which also operates www.thenirvanist.com under a separate privacy policy — data collected through Amla is kept separate from data collected through The Nirvanist's other services and is not merged between them.
This policy applies wherever you're located; if you are in the UK or EU, you have specific rights described in Section 8 under the UK GDPR / Data Protection Act 2018 and the EU GDPR respectively.
| Category | Examples | Where it comes from |
|---|---|---|
| Contact data | Email address | Website “notify me” sign-up, support enquiries |
| Scan history | Barcodes scanned, favourites | Stored locally on your device only — not transmitted to or stored on our servers, for any user, free or Pro |
| Contribution photos & extracted data | Photos of a product label, ingredients list, and/or nutrition table, plus the text and figures our system extracts from them | Collected only when you actively choose to contribute a photo to help score an unscored product — applies to every contributor, regardless of account or Pro status. Used to compute the product's score and improve data quality, and retained as part of that product's permanent record. Your IP address is briefly checked at the moment of submission to prevent spam, but is not stored alongside your contribution. |
| Account & Pro membership data | Email address, saved dietary/allergen preferences | Collected only if you choose to create a Pro account — your email identifies your account so your preferences (e.g., allergens, dietary pattern) persist across sessions. Free use of core scanning and scoring never requires this. |
| Communications | Emails or messages you send us | Direct correspondence via support/contact channels |
| Technical & usage data (website) | Pages visited, browser type, approximate location | Only if/when we introduce website analytics — see Section 5 |
We do not currently require an account to use core scanning and scoring, and regular scanning never sends personal data to our servers. The one exception is the contribution flow: if you choose to submit a photo to help score a product, that photo — and the data extracted from it — is collected and stored server-side as a permanent part of that product's record. This is true for every contributor, not just Pro members, and happens only when you actively start that flow. Your IP address is briefly checked at that moment purely to prevent spam or abuse of the feature, and is not stored alongside your submission. Separately, if you choose to become a Pro member, your email address and saved allergen/dietary preferences are collected to identify your account — this is entirely optional and unrelated to the contribution flow. We do not collect health or medical data about you as an individual — dietary filter preferences reflect a chosen viewing mode, not a medical record, and are not shared with any third party.
| Purpose | What we do | Legal basis (UK/EU GDPR) |
|---|---|---|
| Provide core scanning/scoring | Process the barcode you scan against our product database | Performance of a contract / legitimate interest |
| Send occasional product updates (if you opt in) | Deliver updates you've signed up for by email | Consent (opt-in) |
| Respond to enquiries | Customer support | Legitimate interest / contract |
| Improve the app and website | Reviewing contribution data and, if introduced, website analytics | Legitimate interest |
| Comply with law | Regulatory or legal requests | Legal obligation |
The product information and scores shown in Amla (ingredients, nutrition facts, scoring) relate to products, not to you personally, and are sourced primarily from Open Food Facts, a collaborative open database, supplemented by our own research and by contributions from users like you. This is separate from any personal data described above.
We do not currently run analytics or use cookies on our website. If we introduce website analytics in future, we will use a privacy-respecting tool that does not require a cookie consent banner, and we'll update this policy to name it.
We share personal data only with trusted service providers who help us run the Service, under agreements requiring them to protect your data:
| Provider | Purpose |
|---|---|
| Supabase | Database and file storage (e.g., website sign-ups, product contribution photos and data) |
| Netlify | Website hosting |
| Open Food Facts | Source of product data (we query/contribute to this open database; we do not send your personal data to it) |
If we begin sending update emails through a dedicated email delivery platform, we'll add that provider here and confirm it in this policy before it goes live. We do not sell your personal data, and we do not share it with third parties for their own independent marketing purposes without your consent.
Where we transfer personal data of UK or EEA residents outside the UK/EEA (for example, to service providers based elsewhere), we rely on appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or transfers to countries recognised as providing adequate protection.
If you are in the UK or EU, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, port your data, withdraw consent, and complain to your local data protection authority (the ICO in the UK). To exercise these rights, contact us at support@amlascan.com. If you're a California resident, you have similar rights under the CCPA/CPRA; we don't sell personal information.
We use technical and organisational measures appropriate to the data we hold, including encrypted connections and reputable, security-vetted processors. No system is 100% secure, but we take reasonable steps to protect your data.
Amla is not directed at children under 13, and we do not knowingly collect personal data from children. If we become aware we have inadvertently done so, we will delete it.
Amla's product scores are calculated automatically by applying published methodologies (see our methodology and Section 4 of our Terms) to product data — this relates to products, not to automated decisions about you as an individual, and does not produce legal or similarly significant effects about you.
We may update this policy as our Service, processors, or the law change. We'll update the “last updated” date above, and for material changes, provide a more prominent notice.
Data Controller: The Nirvanist LLP, trading as Amla, 128 City Road, London, EC1V 2NX, United Kingdom
Privacy queries: support@amlascan.com
Amla