Privacy Policy
Last updated 22 September 2026 · New Zealand and Australia launch
Vayloza needs food and account information to turn receipts into a pantry and meal plan. We do not sell individual receipt, allergy, diet or nutrition histories to advertisers. Billing is handled by Stripe and Vayloza does not store raw card details.
What we collect
Depending on how you use Vayloza, we may collect your email address and password hash; country, goal, eating style, calorie and protein targets, budget, allergies, dislikes, household size and preferred supermarkets; receipt OCR text and parsed grocery items; pantry, meal-plan, shopping-list and meal-consumption information; basic service events needed to operate and secure the product; and Stripe customer/subscription identifiers and billing status.
Receipt images
Receipt photos are used to perform OCR. The current design deletes the temporary uploaded receipt image after OCR processing. Parsed receipt text and grocery data may remain in your account so your pantry, corrections and history can work.
Why we use it
We use this information to authenticate your account, recognise groceries, maintain your pantry, personalise diet-aware meal suggestions, generate shopping lists, calculate estimated nutrition and budget information, provide billing, troubleshoot the service and improve product matching.
Where data is handled
The Vayloza application database is currently hosted with Fly.io in Sydney, Australia. Stripe processes subscription payments and associated billing information. GitLab and Render are used in the software deployment process. Service providers may process limited information necessary to provide their services.
Advertising and sale of personal food data
Vayloza is designed as a paid service rather than an advertising-data business. We do not sell individual food, receipt, allergy or nutrition histories to advertisers. If that model ever materially changes, this policy and the collection notice will be updated before the change applies.
Your choices
You can edit profile information in Settings. Vayloza provides an account-data export and an account deletion control. Where applicable, you may also request access to or correction of personal information.
Security and retention
We use password hashing, HTTPS, restricted service credentials and other reasonable safeguards. No internet service can guarantee absolute security. We keep account data while it is needed to provide the service, meet legal/accounting obligations or resolve legitimate disputes, then delete or de-identify it where appropriate.
Adults only
Vayloza is currently intended for people aged 18 and over.
Questions or complaints
For privacy questions, access/correction requests or complaints, contact hello@vayloza.com. We will review the issue and respond as reasonably practicable. New Zealand users may also contact the Office of the Privacy Commissioner, and Australian users may contact the Office of the Australian Information Commissioner where applicable.
This policy is intended to explain Vayloza’s current handling practices clearly. It is not a substitute for individual legal advice.