Service Providers and Sub-Processors
Kaibu uses the following third-party service providers to operate the app. These organizations have access to your data only to the extent necessary to provide their service. All service providers are contractually obligated to protect your data according to this privacy policy.
Authentication and Account Management
Clerk
- Purpose: User sign-up, authentication, and account management
- Data processed: Email, username, password hash, profile information
- Location: United States (subject to EU-US Data Privacy Framework for EU users)
- More information: Clerk Privacy Policy
Analytics and Insights
PostHog
- Purpose: Anonymous usage analytics and feature tracking (optional, opt-in)
- Data processed: App usage events, feature interactions, app version
- Data NOT sent: Personal health data, ingredient preferences, dietary notes
- Location: EU (PostHog EU cloud) or US depending on configuration
- Retention: 12 months
- More information: PostHog Privacy Policy
AI and Machine Learning
Anthropic
- Purpose: Generating personalized ingredient recommendations and notes
- Data processed: Product data and ingredient categories only (no personal identifiers)
- Data NOT sent: Your name, account ID, scan history, email, or personal health details
- Location: United States
- More information: Anthropic Privacy Policy
Push Notifications
Apple Push Notification service (Apple)
- Purpose: Delivering the notifications you turned on to your iPhone
- Data processed: Push token, and the notification's title and text
- Location: United States
- More information: Apple Privacy Policy
Firebase Cloud Messaging (Google)
- Purpose: Delivering the notifications you turned on to your Android phone
- Data processed: Push token, and the notification's title and text
- Location: United States
- More information: Firebase Privacy and Security
Email Delivery
Amazon Web Services (Amazon SES)
- Purpose: Sending account emails (such as account deletion confirmation links) and, if you subscribe to it, the Kaibu mailing list
- Data processed: Your email address and the content of the email sent to you
- Location: EU (Ireland), AWS region eu-west-1
- Retention: AWS keeps delivery and bounce records for its own operational logs; we keep the send outcome only
- More information: AWS Privacy Notice
Mailing list (self-hosted)
- Purpose: Holding the mailing list you can subscribe to on kaibu.app
- Data processed: Your email address, the date you confirmed your subscription, and whether each email was opened or bounced
- Software: Listmonk, run by us on our own hosting, so no other company receives the list
- Consent: You subscribe by entering your address on kaibu.app. The date and time are recorded with it, and every email carries an unsubscribe link
- Retention: Until you unsubscribe, after which the address is removed from the list
Infrastructure and Hosting
Cloud Hosting Provider
- Purpose: Cloud hosting for database, API server, and application services
- Data processed: All user data stored on our servers
- Security measures: Encryption at rest, TLS in transit, access controls
- Backups: Daily automated backups retained for 30 days
- Location: To be confirmed
Object Storage Provider
- Purpose: Storing cached product images and user-uploaded photos
- Data processed: Product photos from Open Food Facts, user uploads
- Access: Private bucket with signed URLs
- Location: To be confirmed
App Distribution
Apple App Store and Google Play
- Purpose: App distribution and payment processing
- Data processed: Account information, subscription status, app usage (per store policies)
- More information: Apple Privacy Policy, Google Privacy Policy
Payments and Subscriptions
RevenueCat
- Purpose: Managing and processing subscription events from app stores
- Data processed: Local user ID and subscription status updates from store webhooks
- Payment handling: Card details are handled by Apple App Store and Google Play Store only. Card details are never received by us or by RevenueCat.
- Location: United States
- More information: RevenueCat Privacy Policy
Product Data
Open Food Facts
- Purpose: Product names, nutritional information, ingredient lists
- Data shared: When you upload photos, they are published to Open Food Facts under Creative Commons BY-SA
- License: Open Data Commons Open Database License (ODbL)
- More information: Open Food Facts Terms of Use
Data Processing Agreements
All service providers listed above have signed Data Processing Agreements (DPAs) or similar legal agreements that ensure they comply with this privacy policy and applicable data protection regulations including GDPR.
Changes to Sub-Processors
We update this list whenever we add or change service providers. Material changes will be communicated through the app or by email.
Last updated: 2026-09-20