Privacy Policy

Last updated: June 8, 2026

This Privacy Policy describes how Osana (“we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information when you use the Osana mobile application (the “App”), our website at osana.co (the “Site”), and any related services (collectively, the “Service”). By accessing or using our Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

1. Data Controller

The data controller responsible for processing your personal data is:

2. Scope

This Privacy Policy applies to:

  • Your use of the Osana iOS and/or Android application
  • Your visits to osana.co and any subdomains
  • Any emails, forms, or other communications you send to us
  • Any subscription, free trial, or purchase you make through the Service

This policy does not apply to third-party services such as Apple, Google, payment processors, or Open Food Facts, each of which operate under their own privacy policies.

3. Information We Collect

3.1 Information You Provide

  • Account information: When you create an account or subscribe, we may collect your email address, name, and payment information (processed by our third-party payment processor)
  • Communications: When you contact us via email or support forms, we collect your email address, name, and the content of your message
  • User preferences: Dietary preferences, allergen profiles, or other settings you configure within the App

3.2 Information Collected Automatically

  • Device information: Device type, operating system version, unique device identifiers, language settings
  • Usage data: Features used, scan frequency, interaction patterns, crash logs, and performance data
  • Network data: IP address, request headers, and connection metadata when you communicate with our servers
  • Scan data: Barcodes scanned, product lookup results, and associated timestamps

3.3 Camera Access

Osana requests camera access solely to scan product barcodes. We do not capture, store, or transmit photographs or video from your camera beyond processing the barcode image locally on your device.

3.4 Information from Third Parties

We may receive limited information from Apple or Google (such as subscription status) in connection with in-app purchases and subscription management.

4. How We Use Your Information

We use the information we collect for the following purposes:

  • Provide the Service: To deliver barcode scanning, product analysis, health scores, and personalized recommendations
  • Process payments: To manage subscriptions, free trials, billing, and refunds
  • Improve the Service: To analyze usage patterns, fix bugs, and develop new features
  • Communicate with you: To respond to support requests, send service notifications, and provide account-related information
  • Ensure security: To detect and prevent fraud, abuse, and unauthorized access
  • Comply with law: To meet legal obligations, respond to lawful requests, and protect our rights

5. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal bases for processing your personal data include:

  • Contract performance: Processing necessary to provide the Service you requested (scanning, scores, subscription management)
  • Legitimate interests: Improving our Service, ensuring security, preventing fraud, and internal analytics, where these interests are not overridden by your rights
  • Consent: Where you have given explicit consent (e.g., marketing communications), which you may withdraw at any time
  • Legal obligation: Where processing is necessary to comply with applicable law

6. Sharing and Disclosure

We do not sell, rent, or trade your personal data. We may share information only in the following circumstances:

  • Service providers: Third-party vendors who assist us with hosting (Vercel), payment processing, analytics, and customer support, bound by contractual data protection obligations
  • Product databases: When you scan a barcode, the barcode number may be sent to Open Food Facts or other product databases to retrieve product information
  • Legal requirements: When required by applicable law, regulation, legal process, or governmental request
  • Protection of rights: To enforce our Terms of Service, protect the safety of users, or defend against legal claims
  • Business transfers: In connection with a merger, acquisition, or sale of assets, in which case you will be notified of any change in data controller

7. International Data Transfers

Osana is based in France. Your information may be transferred to and processed in countries outside the EEA, including the United States (e.g., by our hosting provider). When such transfers occur, we rely on appropriate safeguards recognized under applicable law, including Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

  • Account data: Retained for the duration of your account and for up to 3 years after account deletion to comply with legal obligations
  • Local app data: Stored on your device until you delete it or uninstall the App
  • Payment records: Retained as required by applicable tax and accounting laws (typically 10 years in France)
  • Support correspondence: Retained for the time necessary to resolve your request and for up to 3 years thereafter
  • Technical logs: Retained for up to 12 months for security and debugging purposes

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate or incomplete data
  • Erasure: Request deletion of your personal data (“right to be forgotten”)
  • Restriction: Request that we limit the processing of your data
  • Portability: Receive your data in a structured, commonly used, machine-readable format
  • Objection: Object to processing based on legitimate interests
  • Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing

To exercise any of these rights, contact us at contact@osana.co. We will respond within 30 days (or within the timeframe required by applicable law). We may request verification of your identity before processing your request.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS/SSL), access controls, and regular security assessments. However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected users and relevant authorities in the event of a data breach as required by applicable law.

11. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at contact@osana.co and we will take steps to delete such information promptly.

12. Cookies and Tracking Technologies

Our website may use strictly necessary cookies to ensure proper functionality. We do not use advertising cookies or third-party behavioral tracking cookies.

  • Essential cookies: Required for the Site to function (session management, security)
  • Analytics: We may use privacy-focused analytics to understand Site traffic. No personal data is shared with advertisers

You may configure your browser to reject cookies, although this may affect Site functionality.

13. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of material changes by posting the updated policy on our Site with a revised “Last updated” date. For significant changes, we may also notify you via email or through the App. Your continued use of the Service after the effective date of the revised policy constitutes acceptance of the changes.

15. Supervisory Authority

If you are located in the European Union and believe that our processing of your personal data infringes applicable law, you have the right to lodge a complaint with your local supervisory authority. In France, the competent authority is the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

16. Contact

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: