Privacy Policy

This Privacy Policy is available at https://lactohero.app/datenschutz. This is the privacy policy URL intended for App Store, AdMob, and app consent configuration.

Last updated: June 7, 2026.

SoftwareFast Lorenzo Gioco
c/o IP-Management #4755
Ludwig-Erhard-Str. 18
20459 Hamburg, Germany
Email: info@setupfast.net
Privacy contact: info@setupfast.net

This Privacy Policy applies to the LactoHero website, the LactoHero backend API, and the LactoHero iOS app. The app helps users estimate lactose-related meal information and base FCC recommendations. It may also display ads and may use purchase, subscription, and ad revenue reporting tools.

The website and backend are hosted by Vercel. When you visit the website or call the backend, technical access data may be processed to provide, secure, debug, and operate the service. This may include IP address, time of access, requested URL or route, HTTP method, response status, referrer, user agent, and security-related event data.

The website itself does not require a user account. It may use only technically necessary processing required to provide the website and backend unless additional tools are added and described here.

For meal analysis, the app may send locale, app version, a device installation ID, tablet FCC value, prompt version, portion information, known ingredients, voluntary notes, meal descriptions, and, for photo analysis, a base64-encoded image and image MIME type to the backend.

The backend validates requests before processing them. The device installation ID is hashed for rate limiting. Full meal text and images are not intended to be stored permanently by the backend. Production logs are limited to technical metadata such as request ID, app version, analysis mode, text length, image size, rate-limit status, and similar operational information.

LactoHero uses OpenAI as a technical AI provider to analyze meal text and, where applicable, meal images. The OpenAI API key is stored only on the server as an environment variable and is never included in the iOS app or returned to users.

Validated analysis content may be transmitted to OpenAI to generate a structured result for the app. The result is a cautious estimate and not medical advice. Users should avoid sending unnecessary personal or sensitive information in meal notes or images.

The LactoHero iOS app may use Google AdMob / Google Mobile Ads SDK to display ads. In connection with ad delivery, measurement, fraud prevention, frequency capping, debugging, and reporting, Google and its ad technology partners may process data such as IP address, device information, app information, ad identifiers such as Apple's Identifier for Advertisers where available and permitted, ad interactions, impression data, and approximate location derived from technical signals.

Google requires publishers to disclose data collection, sharing, and use that happens as a result of Google advertising products, including technologies such as cookies, web beacons, IP addresses, or other identifiers. More information is available at How Google uses information from sites or apps that use Google services and Google Advertising Privacy.

The app may use Google's User Messaging Platform (UMP) SDK to request, store, and update advertising consent choices where required, including for users in the European Economic Area, the United Kingdom, and Switzerland. UMP may show a consent message and communicate consent choices to Google and participating ad technology providers.

You can withdraw or change your advertising consent in the app through the privacy or ad consent setting. When this setting is opened, the app can show the Google UMP consent form again where available. You can also manage device-level advertising choices in iOS settings, including settings related to Apple's advertising identifier and app tracking permissions.

Depending on your region, consent choices, device settings, and Google's ad serving rules, the app may request personalized ads or non-personalized ads. Personalized ads may use additional data to make ads more relevant. Non-personalized ads are not based on a user profile for ad personalization, but Google may still process limited data such as IP address, device and app information, ad identifiers where permitted, and contextual information to deliver ads, measure performance, limit abuse, and comply with legal obligations.

If you decline or withdraw consent, personalized ads will not be requested where consent is required. Depending on Google's requirements and ad availability, the app may show non-personalized ads, fewer ads, or no ads.

LactoHero may use RevenueCat to manage subscriptions, purchases, entitlements, and revenue analytics. RevenueCat may process purchase history, product identifiers, app user identifiers, subscription status, transaction metadata, and technical data needed for receipt validation, fraud prevention, analytics, and app functionality.

The app may also use RevenueCat ad revenue tracking. When enabled, ad events from Google AdMob or another ad provider may be reported to RevenueCat. This may include ad network name, mediation provider, ad format, placement, ad unit ID, impression ID, event type, timestamps, revenue amount, currency, and error codes for failed ad events. RevenueCat uses this data to provide monetization reporting, lifetime value calculations, and analytics.

More information is available in the RevenueCat Privacy Policy, RevenueCat GDPR information, and RevenueCat Ad Monetization documentation.

LactoHero is designed to avoid unnecessary backend storage of full meal descriptions, base64 images, sensitive health information, OpenAI API keys, and app API tokens. Image and meal content is processed transiently for analysis unless storage is legally required or explicitly introduced and described in this Privacy Policy.

Depending on the feature and jurisdiction, processing may be based on performance of a contract, consent, legitimate interests in operating and securing the service, compliance with legal obligations, or your consent for advertising and tracking where required.

Data may be processed by technical providers that support operation of the service, including Vercel for hosting, OpenAI for AI analysis, Google for ads and consent management, RevenueCat for purchases and revenue reporting, and Apple for App Store, payment, and device-level privacy functionality. These providers process data under their own terms and privacy documentation where applicable.

Providers used by LactoHero may process data in countries outside your country of residence, including outside the European Economic Area. Where required, transfers are based on appropriate legal safeguards such as contractual safeguards, adequacy decisions, or other mechanisms recognized by applicable law.

We keep personal data only as long as necessary for the purposes described in this Privacy Policy, including service operation, security, legal compliance, billing, analytics, and dispute resolution. Technical logs are kept for a limited operational period unless a longer period is required for security investigation or legal obligations. Third-party providers may apply their own retention periods.

You may change or withdraw advertising consent in the app through the privacy or ad consent setting. You may also manage device-level privacy settings in iOS, including app tracking permissions and advertising identifier settings. If you subscribe or make purchases, Apple and RevenueCat may provide additional controls related to purchases and subscriptions.

Depending on applicable law, you may have rights to access, rectification, deletion, restriction of processing, data portability, objection, and withdrawal of consent. You may contact us at info@setupfast.net.

LactoHero is not intended to provide medical diagnosis, treatment, or medically safe dosing. Users should not submit unnecessary sensitive information. If the app is made available to minors or special user groups, ad settings and consent flows must be configured accordingly in the app and in Google AdMob.

We may update this Privacy Policy when the app, website, backend, advertising setup, providers, or legal requirements change. The current version is published on this page.