This policy explains what data unPACKED collects, why we collect it, and how we look after it. We've written it to be readable, not just legally compliant. If you have questions, please ask.
Who is responsible for your data
Andrew Donaldson trading as unPACKED is the data controller for the purposes of UK GDPR. We are based in the United Kingdom.
Contact: hello@getunpacked.app
What we collect and why
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address | To create and manage your account, and to contact you about the service | Contract performance |
| Receipt images | To extract item and store information via our OCR processing | Contract performance |
| Scan results | To show you your scan history and generate summaries | Contract performance |
| Store name, date, time | To organise your scan history by date and location | Contract performance |
We do not collect location data, track your browsing, run analytics, serve advertising, or share your data with third parties for marketing purposes.
Receipt image processing
When you scan a receipt, the image is sent to Mistral AI for optical character recognition (OCR). Mistral processes the image to extract item names and prices. We do not store the raw receipt image after processing — only the extracted text data is saved to your account.
Mistral AI is a processor acting on our instructions. Their privacy policy can be found at mistral.ai/privacy.
Infrastructure and storage
Your account data is stored in Supabase, a database platform. Supabase stores data in EU data centres. Their privacy policy is at supabase.com/privacy.
The unPACKED application is hosted on Hetzner, a German hosting provider. Their privacy information is at hetzner.com.
We have chosen these providers deliberately for their European base and track record on data privacy.
How long we keep your data
We keep your data for as long as your account is active. If you delete your account, all associated data — scan history, results, and your email address — is permanently deleted within 30 days.
Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of the data we hold about you
- Correction — ask us to correct inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Portability — receive your data in a machine-readable format
- Object — object to processing in certain circumstances
You can delete your account and all data directly from the account settings page. For other requests, contact us at hello@getunpacked.app and we'll respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Cookies
unPACKED uses a session cookie to keep you logged in. This is strictly necessary for the service to function and does not require your consent. We do not use tracking, analytics, or advertising cookies.
Children
unPACKED is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have inadvertently done so, please contact us and we will delete it immediately.
Changes to this policy
We may update this policy from time to time. We'll update the date at the top of the page and, for material changes, notify you by email. Continued use of the service after changes constitutes acceptance of the updated policy.