Privacy Policy

1. Introduction & Data Controller

VMDb.me ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. The data controller responsible for your personal data is:

Lourens van der Zee, Boddinstr. 12, 12053 Berlin, Germany — vmdb.me@gmail.com. Full details in our Impressum.

2. Information We Collect

Account & profile data you provide when you sign up or edit your profile:

• Username, display name, email address, password (or Google account, if you sign in with Google)
• Optional profile details: avatar, bio, location/country, dietary preference
• Optional, sensitive details: age, gender, and food allergies. These fields are never required and are never shown on your public profile — providing them is entirely your choice, and doing so is treated as your explicit consent to us storing that specific information (Art. 9(2)(a) GDPR, since allergy data is a special category of personal data)
• If you mark yourself as a producer: company name and social/website links

Content you post:

• Reviews, star ratings, and comments, associated with your display name
• Behind the scenes, we also store the IP address and browser (user agent) a review was submitted from, and, for guest reviews left before creating an account, the email address you gave — used only for spam/abuse prevention and to let you claim your past reviews if you later sign up, never shown publicly

Product submissions:

• Photos you upload of a product, and an optional email address so we can notify you once it's live
• Uploaded photos are analyzed by Google Gemini (an AI service) to automatically read the product name, brand, and nutrition information off the packaging

Automatically collected:

• Standard web analytics via Google Analytics, only after you accept cookies (see Section 8)

3. Legal Basis for Processing

Depending on the specific data, we rely on:

• Contract (Art. 6(1)(b) GDPR) — creating and managing your account, showing your reviews
• Consent (Art. 6(1)(a), and Art. 9(2)(a) for age/gender/allergies) — optional profile fields, analytics cookies, marketing/notification emails
• Legitimate interest (Art. 6(1)(f)) — spam/abuse prevention (IP/user-agent on reviews), keeping the catalog accurate and moderated

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Show your reviews and public profile information to other visitors
• Extract product information from photos you submit, using Google Gemini
• Send you an email when a product you submitted is published, via Resend
• Respond to your comments and questions
• Monitor and analyze usage trends (only with analytics consent)
• Detect, prevent, and address technical issues, spam, and fraudulent activity

5. Third-Party Service Providers

We use the following providers to run the Service. Each only receives the data it needs to do its specific job:

• Supabase — our database, login system, and file storage, hosted in the EU (Stockholm, Sweden)
• Google Gemini — reads product details from photos you submit
• Google Analytics — website traffic analytics, only after you accept cookies
• Google Sign-In — if you choose to log in with Google instead of an email/password
• Resend — delivers the "your product is live" notification email

6. International Data Transfers

Our database, authentication, and file storage (Supabase) are hosted in the EU. Some other providers we use (Google, Resend) are based in the United States. Where this involves transferring personal data outside the EU/EEA, we rely on appropriate safeguards recognized under GDPR, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

7. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We share it only with the service providers listed in Section 5 (to the extent needed for them to do their job), or:

• With your consent
• To comply with legal obligations
• To protect our rights and safety
• In connection with a business transfer or acquisition

8. Cookies and Tracking

We use a small number of strictly necessary cookies to keep you logged in — these don't require consent and can't be disabled without breaking login. Everything else is off by default: we only load Google Analytics, and set the associated analytics cookies, after you click "Accept" on the cookie banner. You can decline, and you can change your mind later by clearing your browser's site data for vmdb.me.

9. Data Retention

We keep your account and profile data for as long as your account is active. If you delete your account, we delete your profile; reviews you've left may remain (de-identified where reasonably possible) so the ratings they contributed to stay accurate for other users. Product photos and submitter details for uploads that are rejected or never followed up on are periodically cleaned up. You can request deletion at any time — see Section 10.

10. Your Rights

Under GDPR, you have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Restrict or object to processing of your information
• Request data portability
• Withdraw consent at any time, where processing is based on consent

To exercise any of these, contact us at vmdb.me@gmail.com.

11. Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a data protection supervisory authority — in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. In Germany, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal information, and periodically review the Service for security issues. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

13. Children's Privacy

Our Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13.

14. Changes to This Policy

We may update this Privacy Policy from time to time, in particular as the Service adds new features. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

15. Contact Us

If you have any questions about this Privacy Policy, please contact us at: vmdb.me@gmail.com. Full operator details are in our Impressum.