Privacy Policy
Last updated: 26 July 2026
1. Who we are
Beni is a mobile app that lets you scan packaged food products and understand what is in them.
Beni is operated by MyBeni OÜ, a company registered in Estonia under registration code 17341260, with its registered office at Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Kotzebue tn 14-11, 10412.
MyBeni OÜ is the data controller for the personal data described in this policy. That means we decide what data is collected and why, and we are responsible to you for how it is handled.
If you have any question about this policy or your data, write to admin@mybeni.ai.
2. What this policy covers
This policy applies to the Beni mobile app on iOS and Android, and to mybeni.ai. It explains what we collect, why, how long we keep it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
3. What we collect
Account information
Beni requires an account. Depending on how you sign up, we collect:
• Email and password sign-up: your name and email address, and an encrypted password credential. We never store your password in readable form.
• Sign in with Google or Sign in with Apple: your email address, the name associated with that account, and a unique identifier from the provider. If you use Apple’s Hide My Email, we only ever receive the relay address.
Your profile
Your profile can include height, weight, age, physical activity level, food preferences, allergies and sensitivities, and medical conditions. You can also choose a food standard, such as EFSA, and a language.
Every one of these fields is optional. You can create an account with just a name and skip the entire profile, and Beni works fully — scanning, ratings, ingredient breakdowns and chat all function exactly the same. We ask for this information only so that we can tailor product analysis to you, and you can leave any field blank or clear it later.
Allergies, sensitivities, medical conditions, dietary preferences, and the combination of height, weight and activity level are health data, which the GDPR treats as a special category requiring extra protection. We process this data only with your explicit consent, which we ask for separately and in clear terms before you enter it. You can withdraw that consent at any time and delete this part of your profile without losing access to the rest of the app.
We do not use your profile for advertising, we do not share it with any third party for their own purposes, and we do not sell it.
Product images you scan
When you scan a product, the app captures images of the product itself — the front of pack, the back of pack, the ingredients list and the nutrition table — and uploads them to our servers so we can read and analyse them.
The app only uploads images of food products. If you point the camera at something that is not a product label, the app stops the process on your device and nothing is uploaded. We do not want, ask for, or accept photographs of people, documents, or anything else, and there is no feature that lets you upload an arbitrary image or attach an image to a chat.
Your scan history
We store a record of the products you have scanned, linked to your account, so that your history is available to you across sessions and devices.
Chat messages
Beni includes a chat feature that answers questions about a product in our catalogue. We store the questions you ask and the answers given, linked to your account. You can only chat about products already in the app — you cannot upload an image into the chat.
Device and usage data
Through Google Firebase we collect standard app analytics and crash diagnostics: a device identifier, device model, operating system version, app version, approximate region derived from IP address, and events describing how the app is used, such as that a scan was completed. This helps us find bugs and understand which features people use. We ask for your consent to analytics when you first open the app, and you can change your choice at any time in Settings.
What we do not collect
We do not collect precise GPS location. We do not access your photo library or your contacts. We never see your payment card details. We do not sell personal data to anyone, we do not use your data for third-party advertising, and we never use your health information to target advertising.
4. Why we use your data, and our legal basis
What we do
Why
Legal basis
Create and maintain your account
To let you sign in and use the app
Performance of a contract — Art. 6(1)(b)
Analyse the product images you scan and return a result
This is the core function you asked for
Performance of a contract — Art. 6(1)(b)
Store your scan history
So you can see what you have scanned
Performance of a contract — Art. 6(1)(b)
Answer your questions in chat
This is a feature you chose to use
Performance of a contract — Art. 6(1)(b)
Store your health and dietary profile, and use it to tailor product analysis to you
To give you results relevant to your needs and goals
Explicit consent — Art. 6(1)(a) and Art. 9(2)(a)
Retain product images and extracted data to build and improve our food database
To make the product catalogue more accurate and complete for all users
Legitimate interests — Art. 6(1)(f)
Analytics and crash reporting
To fix problems and improve the app
Consent — Art. 6(1)(a)
Security, fraud prevention and abuse handling
To keep the service safe
Legitimate interests — Art. 6(1)(f)
Respond to your support messages
To help you
Legitimate interests — Art. 6(1)(f)
Where we rely on legitimate interests, we have weighed our interest against your rights. Product label images are pictures of commercial packaging rather than of people, which makes the privacy impact low, while an accurate shared database is what makes the app useful. You can object to this use at any time.
Where we rely on consent, you can withdraw it at any time in Settings, and doing so will not affect anything done before you withdrew it.
Explicit consent for health data. Because allergies, medical conditions, dietary preferences and body measurements are special category data under Article 9, we ask for your explicit consent separately — a clear, specific, opt-in choice, never a pre-ticked box and never bundled into acceptance of our Terms & Conditions. Agreeing to our Terms is required to use Beni; consenting to health-data processing is not, and the two are asked separately for that reason. Refusing costs you nothing but the personalized features — the rest of Beni works exactly the same.
5. Subscriptions and payments
Beni is currently free to use. We expect to introduce paid features in future. When we do, payments will be processed by Apple’s App Store and Google Play, not by us: we will receive confirmation of your subscription status and will never see your card details.
6. Who we share your data with
We do not sell your data. We share it only with service providers who process it on our instructions, under a data processing agreement.
Microsoft Azure OpenAI Service powers the product chat, processing the text of your questions to generate an answer. This runs within the European Union. Microsoft does not use Azure OpenAI customer data to train its models.
Google (Firebase) provides authentication, database and file storage, analytics and crash reporting. Google Cloud infrastructure may involve storage or processing outside the European Economic Area. Where that happens, transfers are covered by Standard Contractual Clauses approved by the European Commission and by Google’s certification under the EU–US Data Privacy Framework. You can request details of the safeguards in place by writing to admin@mybeni.ai.
We may also disclose data where we are legally required to — for example in response to a valid order from a competent authority — or to establish or defend legal claims.
7. International transfers
The chat feature runs on Azure OpenAI within the European Union, so your chat content is not transferred outside the EU for that purpose.
Firebase services may involve Google LLC in the United States. Those transfers are covered by Standard Contractual Clauses and by Google’s Data Privacy Framework certification. You can request a copy of the safeguards in place by writing to admin@mybeni.ai.
8. How long we keep your data
Data
Retention
Account data
Until you delete your account. Your account is closed immediately on request and all associated data is permanently erased within 7 days, except where we must keep records to meet a legal obligation
Health and dietary profile
Until you delete it, withdraw your consent, or delete your account — removed immediately in each case
Scan history
Until you delete it or delete your account
Chat messages
12 months from the date of the message
Product images and the data extracted from them
Retained as part of our food product database. Once processed, these images are unlinked from your account
Analytics and crash data
Up to 14 months
Support correspondence
3 years from the last message
9. Your rights
Under the GDPR you have the right to:
• Access the personal data we hold about you, and receive a copy
• Correct data that is inaccurate or incomplete
• Erase your data — the “right to be forgotten”
• Restrict how we process your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format, or have it sent to another provider
• Object to processing based on our legitimate interests
• Withdraw consent at any time, without affecting processing already carried out
Deleting your account
You can delete your account and your data at any time in the app, under Settings → Account → Delete account. When you confirm:
• Your account is closed immediately. You are signed out and cannot sign back in.
• All your personal data — profile, scan history and chat messages — is permanently erased from our systems within 7 days.
• Your health profile is deleted along with everything else. Nothing is retained for personalization.
If you no longer have the app installed, you can request deletion at https://mybeni.ai/delete-account or by writing to admin@mybeni.ai.
Product label images that have already been processed and unlinked from your account are no longer personal data and are not affected by account deletion. They remain in our food database as records of commercial packaging.
For any other request, write to admin@mybeni.ai. We will respond within one month.
If you believe we have handled your data improperly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — info@aki.ee, www.aki.ee — or to the supervisory authority in your own country.
10. Children
Beni is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child has given us personal data, write to admin@mybeni.ai and we will delete it.
11. Security
We protect your data with encryption in transit and at rest, access controls limiting who on our team can reach production data, and the security infrastructure of Microsoft Azure and Google Cloud. No system is perfectly secure, but we take this seriously, and if a breach ever affects your rights we will notify you and the Estonian Data Protection Inspectorate as the GDPR requires.
12. Automated processing
Beni generates a rating for products and answers your questions using an AI model. Where you have given consent, this analysis takes your profile into account. This is automated, but it produces general information about food products — it does not make decisions that have legal or similarly significant effects on you within the meaning of Article 22. You can always see the reasoning behind a rating, and you can turn personalization off at any time.
Beni provides general information about food. It is not medical advice, and it is not a substitute for a doctor, dietitian or pharmacist. If you have a health condition, an allergy, or you are pregnant, speak to a qualified professional before making dietary decisions.
13. Changes to this policy
If we change this policy materially we will tell you in the app before the change takes effect. The date at the top always reflects the current version.
14. Contact
MyBeni OÜ Registration code 17341260 Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Kotzebue tn 14-11, 10412 admin@mybeni.ai