ABCDE Open Food Data Lab
Privacy Policy for metu.lv
Last Updated: 8 October 2026
Website: https://metu.lv
At metu.lv, we respect your privacy and are committed to protecting your personal data. This Privacy Policy outlines how your information is handled when you use our service.
We operate in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable laws of the Republic of Latvia.
1. Data Controller
The data controller responsible for your personal data is:
- Organization:
- NGO "ABCDE Open Food Data Lab"
- Contact Email:
- admin@abcde.lv
- Location:
- Latvia
2. Information We Process
We apply the principle of data minimization and process the information needed to provide, secure, and improve the service:
Account Information:
Account identifiers and email address: Used to create and identify your account, manage sign-ins, authenticate sessions, and respond to account or privacy requests.
Uploaded Receipt Data:
Receipt / Invoice Images: Users upload Rimi receipts or invoices. The original files are processed transiently for text extraction and are not retained as part of the user's purchase history. Temporary upload files may be held briefly while processing completes or failed uploads are recovered, and are then removed by automated cleanup.
Purchase and product data: We retain the original filename, upload and receipt dates, receipt total, product names and identifiers, quantities, prices, VAT information, measurement data, matched catalogue references, Nutri-Scores, and calculated or source nutritional values so that users can review their purchase history and receive recommendations.
Recommendations and feedback: We retain generated recommendation content, the prompt and purchase records used to produce it, creation time, and any helpful/not-helpful feedback.
Note: The full uploaded document is necessarily processed transiently during parsing and OCR. Payment card details, bank information, and "Mans Rimi" loyalty numbers that may appear on a receipt are filtered out and are not intentionally retained or used for nutritional recommendations.
Telegram Bot Data:
Telegram identifiers: If you use our Telegram bot, we process your Telegram user ID and private chat ID to receive documents, associate your purchase history with you, and deliver results.
Processing records: We retain document filenames, file fingerprints used to detect duplicates, job status and timestamps, related purchase and recommendation identifiers, delivery message identifiers, and limited error information needed to operate and recover processing jobs.
Optional Public-Page Analytics:
Google Analytics 4: Only if you allow analytics, Google receives public-page addresses without query strings or fragments, fixed page titles, cookie-based identifiers and technical browser/device information. Google also receives the IP address needed for the network connection. We do not send account identifiers, receipt content, purchase history or nutrition data, and do not track the workspace or sign-in pages.
Technical Logs:
Standard server access logs (IP address, browser type, request timestamps) required to secure our services and prevent abuse.
3. Purpose and Legal Basis for Processing
| Purpose | Data Category | Legal Basis (GDPR) |
|---|---|---|
| User authentication and account access | Account identifier and email address | Contract performance (Art. 6(1)(b)) |
| Receipt OCR parsing, purchase history, Nutri-Score calculation, and recommendations | Receipt image (transient), receipt metadata, product, price, VAT, measurement, and nutrition data | Contract performance (Art. 6(1)(b)) |
| Generation and storage of nutritional recommendations | Purchase history, nutritional data, generated content, prompts, and feedback | Contract performance (Art. 6(1)(b)) |
| Telegram receipt processing and result delivery | Telegram user/chat identifiers, temporary files, and processing-job metadata | Contract performance (Art. 6(1)(b)) |
| Site security, diagnostics, and abuse prevention | Technical logs (IP address) | Legitimate interest (Art. 6(1)(f)) |
| Understanding visits to public pages | Public-page views and Google Analytics cookie/device information | Consent (Art. 6(1)(a)); optional and withdrawable |
4. Important Disclaimer: Informational Use Only (Not Medical Advice)
Product evaluations, Nutri-Scores, and nutritional recommendations provided on metu.lv are generated automatically for informational and educational purposes only.
The content does not constitute medical advice, clinical dietary advice, health diagnosis, or medical treatment.
Always consult a qualified physician, certified nutritionist, or healthcare professional regarding specific nutritional needs, medical conditions, allergies, or intolerances.
5. Third-Party Service Providers (Data Processors)
We do not sell, rent, trade, or share your personal data with third parties for commercial or marketing purposes.
We use service providers acting on our instructions to operate the service:
Replit: Provides application hosting, runtime, database, and related cloud infrastructure.
Clerk: Provides account authentication, session management, social sign-in, and related account email services.
Telegram: Receives and delivers bot messages and uploaded receipt files. Telegram processes account, chat, message, and file data under its own terms and privacy policy.
Google Gemini: Processes selected purchase-history and nutritional data to generate automated nutritional recommendations. We do not intentionally send original receipt images, payment card details, bank information, or loyalty-card numbers to Gemini.
Google Analytics: Provides optional public-page usage measurement after you consent. Advertising personalization and Google signals are disabled. Google processes analytics identifiers and technical information under its applicable terms and privacy policy; this is separate from Gemini's nutritional recommendation processing.
These providers may process data in countries outside Latvia or the European Economic Area. Where required, such processing is subject to the provider's contractual and legal data-transfer safeguards.
6. Data Retention
Receipt Images: Processed transiently and not retained as part of purchase history. Temporary upload files are removed after processing or automated recovery and expiry handling.
Telegram temporary files and jobs: Telegram receipt files may be stored in protected temporary storage while a processing job is active and, by default, expire within 24 hours. Job metadata is retained as needed to prevent duplicate processing, recover deliveries, and maintain the associated purchase and recommendation history.
Account and purchase history: Retained while your account is active or until you delete an individual purchase or ask us to delete your account, subject to any limited retention required for security, legal obligations, or backup integrity.
Recommendations and feedback: Retained with your account and removed when the related purchase or account data is deleted, subject to the same limited exceptions.
Technical logs: Retained only for as long as reasonably necessary for security, diagnostics, abuse prevention, and infrastructure operations, according to our and our service providers' operational settings.
Optional analytics: Google Analytics data is retained according to the analytics property's settings and applicable Google terms. Withdrawing consent stops future collection; it does not automatically delete data already received by Google.
7. Your Rights Under GDPR
Under the GDPR, you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Request erasure of your data ("right to be forgotten");
- Restrict or object to data processing;
- Data portability (obtain your data in a structured, machine-readable format).
You can remove individual purchases in the service. To exercise other rights or request deletion of your account and associated data, contact us at admin@abcde.lv. We will respond without undue delay and within the time required by GDPR.
You also have the right to lodge a complaint with the supervisory authority in Latvia:
Datu valsts inspekcija (Data State Inspectorate) Elijas iela 17, Rīga, LV-1050, Latvia Email: pasts@dvi.gov.lv | Website: www.dvi.gov.lv
8. Cookies
metu.lv uses strictly necessary technical session cookies or tokens to keep you signed in. Separately, optional Google Analytics cookies are used only after you choose “Allow analytics”. We do not load Google Analytics or send analytics requests before that choice, or if you decline.
Analytics is limited to public landing, About and Privacy pages. It does not measure the signed-in workspace, authentication pages, receipt data or nutrition information. Advertising features are disabled.
Your analytics choice is saved in this browser's local storage until you change it or clear browser storage. You can accept, reject or withdraw consent through “Privacy settings” on any public page. Withdrawal stops future tracking and removes this integration's accessible analytics cookies where possible, without affecting essential sign-in cookies. If browser storage is unavailable, your choice lasts only for the current visit.
9. Contact Us
If you have any questions regarding this Privacy Policy or your data, please contact:
- Email:
- admin@abcde.lv
- Website:
- https://metu.lv