Privacy Policy

1. Who we are

EcoRate ("EcoRate", "we", "us", "our") operates a sustainable packaging verification platform comprising a consumer mobile application, a commercial compliance portal, and the website at ecorate.app (together, the "Services").

This policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over it. It applies to all of the Services.

For the purposes of the UK and EU General Data Protection Regulation, EcoRate is the data controller for the information described in this policy.

2. What information we collect

Information you give us

• Account information — your email address and a password, or authentication through a third-party sign-in provider. Optionally, a display name.
• Subscription information — if you purchase a premium subscription, our payment processor collects and holds your payment details. We do not store full card numbers on our systems.
• Contributions — product ratings, written reviews, greenwashing reports, and any supporting evidence you submit.
• Correspondence — messages you send us through the contact form, by email, or through in-app support.

Information generated through your use of the Services

• Scan data — the barcodes and product identifiers you scan, together with a timestamp. Scan images are processed to identify packaging characteristics and are not retained after processing unless you explicitly submit them as evidence.
• Approximate location — where you grant permission, a coarse location (region or city level) used to determine which regulatory framework applies to your scan. We do not collect or store precise GPS coordinates.
• Device and technical information — device type, operating system version, application version, language setting, and IP address.
• Usage information — features accessed, session duration, and interaction patterns, used to diagnose faults and improve the Services.

Information from other sources

• Product and regulatory data — sourced from public regulatory databases, certification bodies, brand disclosures, and licensed commercial datasets. This is information about products, not about you.
• Commercial client data — where you access the Services as an employee of a retailer or brand client, we receive your name, work email, and role from that organisation.

3. Why we process your information

Purpose	What this involves
Providing the Services	Authenticating you, returning scan results, maintaining your impact history, and delivering premium features you have paid for.
Improving grading accuracy	Aggregated and de-identified scan and rating data improves the accuracy of our scoring algorithm and greenwash detection model.
Community verification	Publishing ratings and reviews you choose to submit, attributed to your display name or anonymously at your election.
Commercial reporting	Providing retailer and brand clients with aggregate, de-identified scan intelligence. Clients never receive information identifying individual users.
Research and public interest	Producing aggregate analyses of packaging compliance for publication, regulatory submission, and academic research. Always de-identified.
Safety and integrity	Detecting fraudulent ratings, coordinated manipulation, abuse, and security threats.
Legal obligations	Complying with tax, accounting, and lawful requests from competent authorities.

4. Legal bases for processing

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Services you have signed up for, including premium features.
• Legitimate interests — to improve the accuracy of our grading systems, maintain platform integrity, prevent fraud, and conduct research in the public interest regarding packaging sustainability. We have assessed that these interests are not overridden by your rights.
• Consent — for approximate location access, optional marketing communications, and any non-essential cookies. You may withdraw consent at any time.
• Legal obligation — where processing is required by law.

5. How we share information

We share information only in these circumstances:

• Service providers — hosting, authentication, payment processing, error monitoring, and AI processing providers who act on our instructions under written agreements and may not use your data for their own purposes.
• Commercial clients — only aggregate, de-identified data. A retailer can see that a product was scanned 340 times last month; they cannot see who scanned it.
• Public contributions — ratings and reviews you submit are visible to other users, attributed as you choose.
• Researchers and regulators — aggregate, de-identified datasets under licence or in the public interest.
• Legal requirements — where compelled by valid legal process, or to protect the rights, safety, or property of EcoRate, our users, or the public.
• Corporate transactions — in connection with a merger, acquisition, or sale of assets, subject to this policy continuing to apply.

6. Cookies and similar technologies

We use a deliberately minimal approach. Our website uses:

• Strictly necessary cookies — to maintain your session and record your cookie preference. These cannot be disabled without breaking the Services.
• Analytics — privacy-preserving, aggregate measurement only, with no cross-site tracking and no advertising identifiers.

We do not use advertising cookies, social media tracking pixels, or third-party behavioural profiling. You can control cookies through your browser settings and through the consent banner presented on first visit.

7. Data retention

Category	Retention period
Account information	For as long as your account is active, then 30 days after deletion request.
Scan history	24 months, or until you delete it from your account.
Scan images	Processed and discarded immediately unless submitted as evidence.
Published ratings and reviews	Retained while published. On account deletion, retained in anonymised form to preserve the integrity of product scores.
Aggregate and de-identified data	Retained indefinitely. This data cannot be linked back to you.
Correspondence	36 months from last contact.
Transaction records	As required by applicable tax and accounting law, typically 7 years.

8. Your rights

Depending on where you live, you may have the right to:

• Access — obtain a copy of the personal information we hold about you.
• Rectification — correct inaccurate or incomplete information.
• Erasure — request deletion of your personal information, subject to legal retention obligations.
• Restriction — ask us to limit processing in certain circumstances.
• Portability — receive your information in a structured, machine-readable format.
• Objection — object to processing carried out on the basis of legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Complain — lodge a complaint with your local data protection authority.

To exercise any of these rights, write to us at the address below. We will respond within 30 days and will not charge a fee or discriminate against you for making a request.

9. California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended gives you the rights described above, together with the right to opt out of the sale or sharing of personal information and the right to limit the use of sensitive personal information.

You may designate an authorised agent to make a request on your behalf. We will verify your identity before fulfilling any request.

10. International transfers

EcoRate operates internationally and your information may be processed in countries other than your own, including the United States. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards including Standard Contractual Clauses approved by the European Commission, together with supplementary technical and organisational measures where required.

11. Children's privacy

The Services are not directed at children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected information from a child under 13, we will delete it promptly. Users between 13 and 16 in the European Economic Area may require parental consent depending on their country of residence.

If you believe a child has provided us with personal information, please contact us and we will take appropriate action.

12. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access controls, audit logging of administrative actions, and regular review of access permissions. Administrative access to sensitive systems requires multi-factor authentication.

No system is entirely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

13. Automated decision-making

EcoRate uses automated processing to assign sustainability grades to products and to identify potentially misleading environmental claims. These determinations concern products and the claims printed on them, not individual people, and they do not produce legal or similarly significant effects concerning you.

Grades are generated by a documented, weighted methodology subject to human editorial review. Brands may dispute a determination through the process described in our Terms of Service, and every override is recorded in an audit log.

14. Changes to this policy

We may update this policy to reflect changes to the Services, our practices, or applicable law. Where changes are material, we will notify you by email or through a prominent notice in the Services before the changes take effect. The date at the top of this page shows when it was last revised.