Zeebro Privacy Policy

Version 1.4 — in force from 1 November 2026. What changed since 1.3: a photo the camera warns you about is uploaded, whether or not you send it (§2, §5, §6), and a personal photo sent by mistake is removed at once (§5).

In short: Your receipts are yours — nobody can see what you bought. What becomes public is only anonymous price information: product X costs €Y at store Z. You can delete your account at any time; your personal data is erased, and the anonymous prices already shared with the community stay (they were never linked to you publicly in the first place). We don't sell personal data, we don't show ads, and we host your data in the EU. The AI services that read your photos work outside it (§5).

1. Who we are

Zeebro ("we", "us") is operated by a sole trader established in Italy, who is the data controller for the processing described in this policy. The operator's legal name is at the foot of this page. Contact for privacy matters: [email protected].

Zeebro is a collaborative grocery-price app: users scan receipts and shelf tags, and the community gets anonymous, verified price information in return.

This policy covers the Zeebro mobile app (iOS and Android), the zeebro.io website (including the waitlist and beta signup), and related Zeebro services. It is drafted in English; translations are provided for convenience, and the English version prevails.

2. What data we process

Photos the camera warns about. When you take a photo and the camera warns you about it, for example that the total can't be read, that photo is uploaded to us with the warning, even if you then retake it or don't send it. We use it only to find out why the camera warned you, and to improve that. Our moderators can see it, and we delete it after 30 days. Unless you send it, no outside company reads it and it isn't added to your purchases. From app version 1.30, a frame that shows no receipt at all stays on your phone.

What we deliberately do NOT keep: our automated extraction is instructed to ignore personal data printed on receipts (names, loyalty-card numbers, payment-card digits), so none of it goes into your purchase data — a protection that also covers any third party whose discarded receipt is submitted. To be precise about what that does and does not mean: the extraction service receives the photograph as you took it, so anything printed on the receipt is visible to it, and the company running it keeps its copy for the period on Who reads your receipts; what the instruction prevents is that data being returned to us. The text your phone reads from a receipt, and the official tax document it fetches for some receipts, are different: we keep them with your history as evidence of what the paper says, after removing the identifying details we can recognise, such as tax numbers, names and card digits. A detail we fail to recognise can stay. Raw receipt images are stored in a private bucket accessible only to you and our moderation tooling, and are deleted 90 days after processing. We do not build location histories. For "prices near me", your coordinates are used to answer the query and are not kept. When you photograph a shelf tag, that capture records where it was taken — we need it to check the feature is available in your country, and our moderators use it to judge whether a price is plausible — and we delete those coordinates 30 days after the capture is processed.

Sensitive data. We don't ask for it. A receipt can still reveal some: a pharmacy receipt shows what you bought there. It stays in your private history, we don't use it to profile you for advertising, and deleting your account erases it (§7).

3. What becomes public — and what never does

When your contribution is accepted, the community sees only the anonymous observation: product, store, price, and date. Published prices, product photos accepted into the shared catalog, and product information corrections carry no public attribution — nobody, including other users, can see who contributed them or link a purchase to you.

Never public: your identity, your email, your receipts, your purchase history, your location.

4. Why we process it (legal bases, GDPR)

Automated processing. Reading purchase data out of your images and first-line screening of contributions (duplicate, abuse, and quality checks) are automated, and a contribution may be held back or rejected automatically. These checks affect only the contribution and your contributor standing — we make no automated decisions with legal or similarly significant effects for you, and we do not profile you for advertising. You can always ask for human review of a refused contribution via [email protected].

5. Processors and recipients

We use a small number of service providers (processors) under data-processing agreements. The roles below are what matters and will not change quietly; the named provider for each is the one we use today and may be replaced by another bound to the same terms, in which case we update this list.

• Supabase — database, authentication, storage; hosted on AWS eu-west-1 (Ireland).
• Automated extraction — reads the images you submit and returns the products and prices. It receives the photograph as taken, including anything printed on it; it is not given your name, email or account. Every company that reads your receipts works only on our instructions, may not use what we send to train its models and, where it handles data outside the EU/EEA, is covered by the EU Standard Contractual Clauses or an adequacy decision. Who they are today, where they process and how long they keep what they receive: Who reads your receipts, which we keep current and date. Before a photo sent on its own is read, OpenAI checks that it isn't a personal picture sent by mistake. If it is, no other company reads it, it goes to no moderator, and we delete that copy at once.
• Map and place lookup — resolving store names and addresses to locations. Store data only; no user identity is sent. Currently: Google (Places API).
• Railway — hosting for our website, moderation tooling and image processing (receipt cropping, product-photo cleanup). Our services run in the Netherlands (EU).
• Resend — delivery of account and waitlist emails (confirmations, sign-in, double opt-in).
• Cloudflare — runs zeebro.io's domain and content delivery (so it sees the requests your browser makes to us) and forwards website analytics events on our behalf.
• Mailbox hosting — receives and stores the email you send to our addresses, including anything you send us about your privacy rights. Hosted in Switzerland. Currently: Migadu.
• PostHog (EU cloud) — product analytics for the website and app; on the website it runs cookieless (§8).
• Open Food Facts — when you scan a barcode we don't recognize, our server queries the Open Food Facts product database. Only the barcode is sent — never your identity, IP address, or location.
• On-device recognition — barcode, price-tag and receipt detection runs on your device; camera frames are analyzed locally and never leave it. On iOS this uses Apple's built-in Vision framework, which sends nothing anywhere. On Android it uses Google ML Kit with its detection models bundled in the app; frames are not sent to Google. The photos you take are different: see "Photos the camera warns about" in §2.
• Sentry — crash reporting, on their EU data region; Firebase Cloud Messaging — push notification delivery.
• Firebase Remote Config (Google) — tells the app whether its version is still supported, so we can ask you to update before an old version stops working. When you open the app or come back to it, at most once an hour, it sends Google a random identifier for this installation of the app, the app version, the operating-system version, the language, region and time zone set on the device, and when the app was first opened (and, as with any request, Google's servers see the IP address it came from). Your account and anything about what you scan, buy or search are never sent. Because an outdated app could otherwise stop working without telling you why, this check runs whatever Share usage data (§4) is set to.
• Meta (Facebook / Instagram) — measures whether one of our own app-install ads led to an install, and whether the people it brought went on to use the app. When the app opens, its Meta SDK sends Meta an anonymous app-open event with the device type, operating-system version and app version (and, as with any request, Meta's servers see the IP address it came from). Once per account, when your first receipt has been processed, it also sends one anonymous "first receipt" event: only that it happened — not what is on the receipt, not the store, not the amount. It never reads or sends the advertising identifier (IDFA / GAID), the app shows no tracking prompt, and nothing about what you scan, buy or search is sent. On iOS, install counts reach us only through Apple's privacy-preserving SKAdNetwork. Switching off Share usage data (§4) stops these events too. On the website, a link from one of our Meta ads carries Meta's ad-click reference; when you arrive through it, our server (not your browser) sends Meta that reference together with the page you opened, whether you tapped the App Store or Google Play button, your IP address and your browser's user-agent, so Meta can match the visit to the ad. The website loads no Meta code and stores nothing in your browser for this, and nothing is sent about visitors who did not arrive from a Meta ad.
• Google (Google Ads, through Google Analytics for Firebase) — measures whether one of our own Google app-install ads led to an install. When the app is opened, Google's Firebase SDK sends Google anonymous app-open and session events: that the app was opened and for how long, with the device type, operating-system version, app version and a random identifier for this installation of the app (and, as with any request, Google's servers see the IP address it came from). Nothing about what you scan, buy or search is sent, and neither is your account. It never reads or sends the advertising identifier (IDFA / GAID), the app shows no tracking prompt, and it is not used to personalise ads or to show you ads again. On iOS, install counts reach Google Ads only through Apple's privacy-preserving SKAdNetwork. Switching off Share usage data (§4) stops these events too.

We do not sell personal data. We may offer third parties (e.g. retailers, researchers) aggregated, anonymous statistics — such as average prices or category demand by area — with minimum group sizes that make re-identification impossible. Individual purchase data is never shared, licensed, or sold. If we run partner promotions (e.g. converting points into a retailer coupon — Terms §8), the partner receives only aggregate redemption reporting, never your identity or purchase history.

Automated extraction happens outside the EU/EEA, mainly in the United States. That transfer, and any other outside the EU/EEA, is covered by the EU Standard Contractual Clauses or an adequacy decision.

Disclosure required by law. We may disclose personal data where a law, court order, or competent authority validly requires it. We assess every such request, disclose only the minimum necessary, push back on requests we consider overbroad or unlawful, and inform you where we are legally permitted to.

6. Retention

• Raw uploaded images: deleted 90 days after successful processing/moderation. These are our own copies; the companies that read your photos keep theirs for the periods on Who reads your receipts.
• Photos the camera warned about: deleted 30 days after the warning. A copy you sent follows the line above.
• The text read from a receipt and its tax document, with identifying details removed: kept while your account exists.
• Coordinates recorded with a shelf-tag capture: deleted 30 days after processing.
• Extracted purchase data and your private history: kept while your account exists.
• Published anonymous observations: kept indefinitely — they are the community dataset and contain no personal data.
• Waitlist emails: until you unsubscribe, or shortly after beta invitations conclude.
• Web deletion requests: kept only until the request is carried out, then deleted with the account.
• Answers to the "why did you leave" form: kept to improve the service. They are anonymous: stored with no email address and no link to any account.
• Logs and abuse records: up to 12 months.

7. Account deletion

You can delete your account at any time in the app (More → My account). If you can no longer sign in, request it at zeebro.io/delete-account — we verify you own the address before deleting anything. What happens:

• Your account, email, display name, private receipts, images, and personal purchase history are deleted.
• We send one email to your address confirming the deletion, with an optional link to an anonymous form where you can tell us why you left. It is the only email we send after a deletion, and your address is erased as soon as it goes out.
• Price observations already published to the community were shared anonymously; on deletion, any internal link between them and your account is irreversibly removed (anonymization). The historical price data itself remains part of the shared database — it no longer relates to any identifiable person and therefore is no longer personal data.
• To keep duplicate-submission fraud detectable, fiscal identifiers/fingerprints of receipts already processed are retained after deletion in a form no longer linked to you or to any account.

8. Cookies, on-device storage, and the website

The app stores your sign-in session, preferences (language, settings) and the result of its last version check (§5) on your device — they are needed for the app to work and stay there. The app does not read your device's advertising identifier. Barcode and price-tag detection runs on-device (§5): camera frames are analyzed locally, and only the images you choose to submit are uploaded.

The zeebro.io website sets no advertising or cross-site tracking cookies. Website analytics run in cookieless mode — no identifier is stored in your browser. The website loads no advertising code either: if you arrive from one of our Meta ads, our server reports that visit to Meta as described in §5, using the reference in the link you followed rather than anything stored on your device. If we ever introduce cookies that require consent, we will ask first. Joining the waitlist stores your email address only after you confirm it (double opt-in).

9. Security

Your data is hosted in the EU and encrypted in transit and at rest. The AI services that read your photos work outside the EU (§5). Database access is enforced row-by-row, so your private data is readable only by your own account and our moderation tooling; receipt images live in private storage buckets. Passwords are stored hashed, infrastructure access is limited to authorized operators, and rate limiting and abuse screening protect the service against misuse. No system is perfectly secure — if a breach ever affects your data, we will notify you and the supervisory authority as the GDPR requires.

10. Your rights

Under the GDPR you have the right to access, rectify, erase, and receive a copy of your data (portability), to object to processing based on legitimate interest, and to withdraw consent at any time. Contact [email protected] — we may ask you to verify your identity, and we respond within one month (extendable by up to two further months for complex requests; we will tell you if we need longer). You also have the right to complain to a supervisory authority — in Italy, where we are established, the Garante per la protezione dei dati personali (garanteprivacy.it), or the data-protection authority of your own EU country of residence.

For users in Brazil, equivalent rights apply under the LGPD.

11. Children

Zeebro is not directed at children and requires users to be 16 or older. App-store age ratings measure something different: they describe whether the content shown is suitable, and Zeebro's is rated for all ages because it displays no objectionable material and every catalogue image is moderated before it can appear. That rating is not permission for a child to register. The 16-year minimum is about processing personal data, and it applies whatever the store rating says.

12. Changes

We will tell you about material changes to this policy before they take effect, by email or a notification from the app. A change that the law requires, or that corrects how this policy describes what we already do, may take effect straight away, and we will tell you as soon as we can. A change of company on Who reads your receipts is not a new version of this policy: we update that page and its date. The current version is always available at zeebro.io/privacy and in the app.

© 2026 Zeebro

FARIAS DE FREITAS ANDRADE BRUNO