Cleo Privacy Policy

1. Personal Information We Collect

We may collect personal information directly from you, automatically when you use the Services, and from third parties.

2. Personal Information You Provide to Us

Account and Profile Information

You may use certain parts of Cleo without creating an account. If you create an account, sign in, subscribe, contact us, or otherwise provide information to us, we may collect information such as your name, email address, account identifiers, login method, subscription status, and other account-related information.

Skin Goals, Preferences, Allergies, and Sensitivities

Cleo may allow you to select or enter goals, preferences, restrictions, allergies, or sensitivities. This may include acne-prone skin, eczema-prone skin, oily skin, inflammation, dairy sensitivity, low sugar goals, seed oil avoidance, clean ingredient preferences, gut health or bloating goals, energy goals, minimally processed food preferences, allergens, sensitivities, and similar information.

Some of this information may be considered sensitive personal information or consumer health data under applicable laws when it relates to, or may allow someone to infer, a health condition, skin condition, allergy, sensitivity, or wellness concern.

Scan, Product, Food, and Meal Information

When you use Cleo, you may submit or generate information related to foods, drinks, ingredients, nutrition labels, barcodes, product packaging, product photos, meal photos, and similar content. This may include:

• Barcodes and product identifiers;
• Product names, brands, categories, ingredients, nutrition facts, and labels;
• Product, ingredient, nutrition, barcode, or meal photos you choose to upload or capture;
• Scan history, saved products, product feedback, and product ratings;
• Cleo scores, verdicts, ingredient flags, breakdowns, better swaps, and AI-generated explanations;
• Information inferred from scans, such as whether a product may align with your selected skin goals, allergies, sensitivities, or preferences.

Photos and Camera Access

If you use photo-based features, Cleo may request access to your camera or photo library. We only access camera or photo content when you choose to use those features or grant permission.

Photos may be processed to identify products, ingredients, nutrition labels, meal contents, or other information needed to provide Cleo’s analysis. Unless we state otherwise in the app, we may retain photos, scan data, extracted text, product information, and related analysis to provide the Services, improve product accuracy, maintain scan history, improve Cleo’s product catalog, troubleshoot issues, and operate the Services.

Communications with Us

If you contact us, we may collect your name, email address, message content, attachments, feedback, support requests, and any other information you choose to provide.

Research, Surveys, and Feedback

If you participate in surveys, beta testing, research, interviews, product feedback, or user testing, we may collect your responses, opinions, screenshots, recordings, contact information, and other information you choose to provide.

Payment and Subscription Information

Cleo may offer paid subscriptions or paid features. Purchases and subscriptions are processed through third-party platforms such as the Apple App Store and related subscription-management providers, including Superwall.

We do not receive your full payment card number from Apple. We may receive information about your subscription status, purchase history, product plan, renewal status, trial status, transaction identifiers, and related purchase metadata.

3. Information We Collect Automatically

When you use the Services, we and our service providers may automatically collect information such as:

• Device type, operating system, app version, browser type, and language settings;
• IP address, general location inferred from IP address, and device identifiers;
• Usage data, such as screens viewed, scans completed, buttons tapped, features used, session duration, crash logs, and diagnostic information;
• Performance data, such as loading times, network errors, and app stability data;
• Referral, attribution, and campaign information if you arrive through links, the App Store, or other campaigns.

We may use cookies, pixels, local storage, software development kits, and similar technologies on our website or in our app to operate the Services, analyze usage, improve performance, prevent fraud, and understand the effectiveness of our marketing. As of the effective date of this Privacy Policy, Cleo does not use advertising technologies to sell personal information or target ads based on skin, allergy, sensitivity, health, scan, or meal data.

4. Information We Receive from Third Parties

We may receive information from third parties, including:

Login Providers

If you sign in using Apple or another third-party login provider, we may receive information such as your name, email address, account identifier, and authentication token, depending on your settings with that provider.

Service Providers

We may receive information from service providers that help us host the app, store data, process scans, analyze app usage, manage subscriptions, provide customer support, monitor crashes, prevent fraud, and improve the Services.

Current service providers may include:

• Supabase, for database, storage, authentication, and backend infrastructure;
• OpenAI, for AI-powered analysis and explanation features;
• Superwall, for paywall, subscription, and purchase-experience management;
• Apple, for App Store distribution, in-app purchases, subscriptions, and device-level permissions.

We may add, remove, or change service providers as the Services evolve.

Product Databases and Data Sources

We may use public or third-party product databases to retrieve product information, such as barcode, ingredient, nutrition, brand, and product-category data. We do not intentionally send your name or email address to public product databases when performing product lookups.

5. Sensitive Information and Consumer Health Data

Cleo may process information that could be considered sensitive personal information or consumer health data under certain laws. This may include information related to skin goals, acne-prone skin, eczema-prone skin, inflammation, allergies, sensitivities, dietary restrictions, scanned products, saved products, meal scans, food logs, photos, and inferences generated from this information.

We use this information to provide and personalize the Services, including Cleo scores, ingredient flags, scan results, skin-goal insights, saved history, recommendations, and better swaps.

We do not sell consumer health data. We do not use sensitive skin, allergy, sensitivity, scan, meal, or health-related information for third-party targeted advertising.

6. How We Use Personal Information

We may use personal information for the following purposes:

Provide and Operate the Services

We use personal information to create and manage accounts, enable guest use, process scans, analyze ingredients and nutrition labels, generate Cleo scores and explanations, recommend better swaps, save scan history, provide personalized results, and operate the app.

Personalize Your Cleo Experience

We may use your selected goals, preferences, allergies, sensitivities, scan history, saved products, and interactions to personalize product analysis, warnings, recommendations, and app content.

Process Images, Labels, and Scans

We may use image recognition, optical character recognition, machine learning, artificial intelligence, and human or automated review systems to identify products, extract ingredients or nutrition information, detect missing data, improve product accuracy, and generate analysis.

Improve Product Quality and Accuracy

We may use scans, photos, extracted text, feedback, ratings, corrections, and review flags to improve Cleo’s catalog, scoring system, recommendations, product-detection accuracy, and overall app quality.

Communicate with You

We may use your information to respond to support requests, provide updates, send administrative messages, request feedback, and notify you about changes to our Services or policies.

Manage Subscriptions and Purchases

We may use purchase and subscription information to provide paid features, verify entitlements, prevent fraud, resolve billing issues, and manage trials or renewals.

Analyze and Improve the Services

We may use personal information to understand usage trends, troubleshoot issues, measure performance, test features, improve onboarding, improve recommendations, and develop new features.

Maintain Security and Prevent Misuse

We may use personal information to detect, prevent, and respond to fraud, abuse, unauthorized access, security incidents, policy violations, or other harmful activity.

Comply with Law and Protect Rights

We may use personal information to comply with applicable laws, respond to valid legal requests, enforce our terms, resolve disputes, protect our rights, and protect the rights, safety, and property of users or others.

Business Transactions

We may use personal information in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar business transaction.

7. AI and Automated Analysis

Cleo uses automated systems, including artificial intelligence and machine learning, to help analyze products, ingredients, nutrition labels, meals, photos, and user preferences. These systems may generate scores, summaries, warnings, recommendations, ingredient flags, and “Cleo’s Take” style explanations.

Cleo’s outputs are informational only. They are not medical advice, diagnosis, or treatment. You should consult a qualified healthcare professional before making medical decisions.

We may use service providers, including OpenAI, to process images, text, product data, scan data, and related inputs to provide AI-powered features. We configure our AI service providers not to use your personal information to train general-purpose AI models where such controls are available to us, unless we provide notice and obtain consent where required by law.

8. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients:

Service Providers and Processors

We may disclose information to vendors that help us provide hosting, cloud storage, database management, authentication, analytics, crash reporting, customer support, image processing, OCR, AI analysis, subscription management, security, fraud prevention, email delivery, and related services.

Payment, Subscription, and App Store Providers

Purchases and subscriptions may be processed by Apple and related subscription-management providers, including Superwall. Their terms and privacy policies may also apply to their processing of your information.

Product Data Providers

We may use product databases or data sources to retrieve or verify product information, ingredients, nutrition facts, and barcode data.

Analytics and Infrastructure Providers

We may disclose usage, device, performance, and diagnostic data to analytics and infrastructure providers to help us understand how the Services are used, improve the app, and maintain reliability.

Professional Advisors

We may disclose information to lawyers, accountants, auditors, insurers, and other professional advisors.

Authorities, Legal Process, and Protection of Rights

We may disclose information when we believe disclosure is necessary to comply with applicable law, respond to valid legal process, enforce our terms, protect our rights, investigate fraud or security issues, or protect users or others.

Business Transaction Parties

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.

With Your Consent or Direction

We may disclose information when you direct us to do so or consent to the disclosure.

9. Sale, Sharing, and Targeted Advertising

As of the effective date of this Privacy Policy, Cleo does not sell personal information for money. Cleo does not sell consumer health data.

Cleo does not use sensitive skin, allergy, sensitivity, scan, meal, or health-related information for third-party targeted advertising.

Some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly. If we use advertising, attribution, analytics, or similar technologies in a way that is considered a “sale,” “sharing,” or “targeted advertising” under applicable law, we will provide any required rights.

10. Your Choices

Guest Use

You may be able to use certain Cleo features without creating an account. Guest use may limit your ability to save data across devices, restore history, manage subscriptions, or access certain personalized features.

Account Information

You may be able to update certain account information in the app. You may also contact us to request updates.

Camera and Photo Permissions

You can control camera and photo library permissions through your device settings. Some scan features may not work if you disable these permissions.

Push Notifications

You can control push notification permissions through your device settings.

Marketing Communications

If we send marketing emails, you can opt out by using the unsubscribe link in the email or contacting us at team@opencleo.app. You may still receive non-marketing messages, such as account, support, security, legal, or transactional messages.

Delete Your Account or Data

You may request account or data deletion by contacting us at team@opencleo.app. If account deletion is available in the app, you may also use the in-app deletion flow.

We may retain certain information where required or permitted by law, such as for security, fraud prevention, legal compliance, dispute resolution, backup, product integrity, or recordkeeping.

11. How We Protect Personal Information

We use reasonable technical, administrative, and organizational safeguards designed to protect personal information from unauthorized access, disclosure, alteration, loss, misuse, or destruction.

However, no method of transmission or storage is completely secure. We cannot guarantee absolute security of your information.

12. How We Retain Personal Information

We retain personal information for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, maintain security, and improve the Services.

Because Cleo uses scan history, photos, extracted label data, product feedback, and product-review systems to provide and improve the Services, we may retain scan-related information unless and until it is deleted through an available in-app feature, your account is deleted, or you submit a deletion request, subject to applicable exceptions.

If we de-identify, aggregate, or anonymize information so it can no longer reasonably identify you, we may use and disclose that information for research, analytics, product improvement, catalog improvement, and other lawful purposes.

13. Children’s Privacy

Cleo is intended for users who are 18 years of age or older. If you are under 18, do not use the Services or provide personal information to us.

We do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal information from someone under 18, we may take steps to delete the information and, where applicable, close the account.

14. International Transfers

OpenCleo, LLC is based in the United States. Your personal information may be processed in the United States and other countries where we or our service providers operate. These countries may have privacy laws that differ from those in your country of residence.

When required by applicable law, we use appropriate safeguards for international transfers of personal information.

15. Your Privacy Rights

Depending on where you live, you may have certain rights regarding your personal information, including the right to:

• Confirm whether we process your personal information;
• Access the personal information we hold about you;
• Receive a copy of your personal information in a portable format;
• Correct inaccurate personal information;
• Delete personal information;
• Opt out of certain processing, such as sale, sharing, targeted advertising, or profiling, where applicable;
• Limit certain uses or disclosures of sensitive personal information, where applicable;
• Withdraw consent where processing is based on consent;
• Appeal a decision we make about your privacy request;
• Not be discriminated against for exercising your privacy rights.

To exercise your rights, contact us at team@opencleo.app. Please include the right you wish to exercise and enough information for us to verify and process your request.

We may need to verify your identity before responding to a request. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and identity verification.

16. Additional Information for California Residents

This section applies to California residents and supplements the rest of this Privacy Policy.

California law may require us to disclose the categories of personal information we collect, the purposes for collection and use, the categories of sources, and the categories of recipients to whom information is disclosed.

Categories of Personal Information We May Collect

Identifiers. Examples include name, email address, account ID, device identifiers, IP address, and similar identifiers.

Commercial information. Examples include subscription status, purchase history, products scanned, saved products, and app usage related to products or services.

Internet or electronic network activity. Examples include app interactions, screens viewed, scan activity, session data, crash logs, and usage data.

Geolocation data. Examples include approximate location inferred from IP address. We do not intentionally collect precise geolocation unless we provide notice and obtain any required permission.

Audio, electronic, visual, or similar information. Examples include product photos, ingredient label photos, nutrition label photos, meal photos, support attachments, or other images you choose to provide.

Inferences. Examples include product preferences, skin-goal fit, ingredient preferences, recommendation profiles, and other inferences generated from your scans and selected goals.

Sensitive personal information. Examples include allergies, sensitivities, skin-related goals, health-related preferences, food logs, meal scans, and information that may reveal or suggest health, skin, or wellness conditions.

Sources of Personal Information

We may collect personal information from you, your device, your use of the Services, app store providers, login providers, service providers, analytics providers, subscription-management providers, AI providers, and product data sources.

Purposes for Collection and Use

We collect and use personal information for the purposes described in this Privacy Policy, including providing the Services, personalization, scan analysis, product recommendations, subscriptions, support, analytics, security, legal compliance, and product improvement.

Disclosures

We may disclose personal information to service providers, processors, analytics providers, app store providers, subscription-management providers, AI providers, product data providers, professional advisors, legal authorities, business transaction parties, and others with your consent or direction.

Sale and Sharing

Cleo does not sell personal information for money. Cleo does not sell consumer health data. Cleo does not use sensitive skin, allergy, sensitivity, scan, meal, or health-related information for third-party targeted advertising.

If our use of cookies, analytics, attribution, advertising, or similar technologies is considered a “sale” or “sharing” under California law, we will provide applicable opt-out rights.

California Privacy Rights

California residents may have the right to know, access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights.

To exercise these rights, contact us at team@opencleo.app.

17. Additional Information for Washington Residents

This section applies to Washington residents and provides additional information regarding consumer health data.

Cleo may collect consumer health data if you choose to use features involving skin goals, acne-prone skin, eczema-prone skin, inflammation, allergies, sensitivities, dietary preferences, scan history, food logs, meal scans, saved products, product recommendations, or related inferences.

Categories of Consumer Health Data We May Collect

Depending on how you use the Services, we may collect:

• Skin-goal information;
• Allergy and sensitivity information;
• Food, drink, product, meal, ingredient, and nutrition information;
• Photos of products, labels, ingredients, nutrition facts, or meals;
• Scan history and saved product information;
• Cleo scores, verdicts, recommendations, and inferences related to your selected goals;
• Information you provide in support messages, surveys, or feedback.

Why We Collect Consumer Health Data

We collect consumer health data to:

• Provide Cleo scores and scan results;
• Personalize product analysis to your selected goals;
• Identify ingredients or nutrition factors that may be relevant to your preferences;
• Recommend better swaps;
• Save your scan history and preferences;
• Improve product accuracy and app functionality;
• Provide customer support;
• Maintain security and prevent misuse;
• Comply with law.

Sources of Consumer Health Data

We may collect consumer health data directly from you, from your device, from your use of Cleo, and from service providers that help us operate the Services.

Sharing of Consumer Health Data

We may disclose consumer health data to service providers and processors that help us provide the Services, such as hosting, storage, authentication, AI/OCR processing, analytics, security, support, subscription management, and app infrastructure providers.

We do not sell consumer health data. We do not use consumer health data for third-party targeted advertising.

Washington Privacy Rights

Washington residents may have rights to access, confirm, or withdraw consent for certain collection or sharing of consumer health data, subject to applicable exceptions.

To exercise these rights, contact us at team@opencleo.app.

18. Additional Information for EEA, UK, and Swiss Residents

If you are located in the European Economic Area, United Kingdom, or Switzerland, this section applies to you.

Controller

The controller of your personal information is OpenCleo, LLC.

Legal Bases for Processing

We process personal information based on the following legal bases:

Performance of a contract. To provide the Services, manage your account, enable guest functionality, process scans, provide recommendations, manage subscriptions, and respond to support requests.

Consent. Where required, including for certain sensitive information, camera/photo permissions, marketing communications, cookies, or similar technologies.

Legitimate interests. To improve the Services, analyze usage, prevent fraud, maintain security, develop new features, and operate our business, where those interests are not overridden by your rights and interests.

Legal obligation. To comply with applicable laws, legal requests, and regulatory obligations.

Protection of rights. To establish, exercise, or defend legal claims and protect the rights, safety, and property of Cleo, users, or others.

Your Rights

You may have the right to access, correct, delete, restrict, object to processing, request portability, withdraw consent, and lodge a complaint with your local data protection authority.

To exercise your rights, contact us at team@opencleo.app.

19. Additional Information for Canadian Residents

If you are located in Canada, you may have the right to access and correct personal information we hold about you and to withdraw consent where processing is based on consent, subject to legal and contractual restrictions.

To exercise your rights, contact us at team@opencleo.app.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by law, such as by updating the effective date, posting a notice in the app or on our website, or sending you a notification.

Your continued use of the Services after an updated Privacy Policy becomes effective means you acknowledge the updated policy.

21. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, contact us at:

OpenCleo, LLC
Email: team@opencleo.app
Mailing Address: [Insert company mailing address]