As of: 22.03.2026

We take the protection of your data seriously. Here we explain which data is processed when using BFF, what we need it for, and which rights you have.

The controller responsible for data processing is:

Efficial e.K.

Taunusstr. 126

61381 Friedrichsdorf

Germany

info@buyfromfriends.app

Data Protection Officer: not appointed

1. Use of the App

BFF is a barcode scanner for products, in particular food products. The app processes barcode and product data on our server in order to provide information about the product and, in particular, about the associated company and its headquarters.

The app can be used anonymously. Registration via email/password, Sign in with Apple, or Sign in with Google is voluntary.

2. Which data we process

a) Anonymous use
In the case of anonymous use, we process in particular:

- technical user ID

- artificial installation ID

- timestamps of credits and debits of the in-app currency

- information on the available and used in-app currency

Purpose: Provision of the app, technical assignment, protection against misuse, and management of in-app content.
Legal basis: Art. 6 para. 1 lit. b and lit. f GDPR.

b) Registration and login

Depending on the type of login, we process:

- for email/password: email address

- for Apple login: email address, where applicable relay address

- for Google login: email address

We do not actively request profile pictures, real names, or similar profile data.

Purpose: Login, account management, account recovery, and allocation of in-app purchases.
Legal basis: Art. 6 para. 1 lit. b GDPR.

According to Google, Firebase Authentication may also process technical device and connection data as well as data for the prevention of misuse depending on the login method, including IP addresses and other technical information. In the app itself, we only use login via email/password as well as Sign in with Apple and Sign in with Google.

c) User profile

The app is always used via a user account. This account may be anonymous or voluntarily registered. In this context, we store the following data:

- time of account creation

- optionally your email address

- time of the last change to your in-app currency balance

- active / inactive status

- artificial installation ID

- number of acquired and used in-app currency units

Purpose: Account management, provision of in-app currency, and protection against manipulation.
Legal basis: Art. 6 para. 1 lit. b and lit. f GDPR.

d) Scans, barcode data, and server-side processing

The app can store scanned barcodes on your device. There is no permanent server-side storage of which user scanned which barcode. Independently of this, we store barcode, product, and analysis information on the server insofar as this is necessary for the provision and improvement of the app functions.

Barcodes may temporarily appear in technical log files. These logs are automatically deleted after 30 days.

When you scan a barcode, our server processes the barcode and public product information in order to provide the core function of the app.

For individual server-side processing steps, we use OpenAI as well as Open Food Facts, Open Beauty Facts, and Open Product Facts. In doing so, we transmit only the barcode and product data required for the respective request, but not user identifiers, email addresses, or other information by which you could be directly identified. According to our settings, no data storage is activated for the OpenAI API project used. OpenAI also documents that API data is not used for training by default unless separate permission has been granted.

Purpose: Provision of the app and technical error analysis.
Legal basis: Art. 6 para. 1 lit. b and lit. f GDPR.

e) Correction suggestions

Registered users can submit correction suggestions. In doing so, we process:

- technical user ID

- textual correction suggestions

- 1 to 3 product photos

Please upload only product photos that you have taken yourself and that show only the affected product. Photos with persons or other content not required should not be uploaded. We reserve the right to delete unsuitable photos at any time.

Purpose: Review and processing of corrections, quality assurance of the product database.
Legal basis: Art. 6 para. 1 lit. b and lit. f GDPR.

Correction suggestions and photos are stored until they have been processed and then deleted.

f) In-app purchases

For in-app purchases, we process in particular:

- product ID

- time of purchase

- platform

- Firebase user ID

- transaction status

We use RevenueCat for the technical processing of in-app purchases. In this context, a randomly generated pseudonymous identifier, basic technical information about the app and the device, timestamps, and purchase-related information such as product ID, time of purchase, purchase status, and verification data provided by the app stores are processed. We do not transmit email addresses, names, telephone numbers, advertising IDs, or IP addresses to RevenueCat.

Purpose: Processing of purchases, provision of purchased content, restoration of purchases, protection against manipulation, as well as compliance with legal and accounting obligations.
Legal basis: Art. 6 para. 1 lit. b and lit. c GDPR.

RevenueCat states that it retains purchase data and associated technical data for as long as this is necessary for the verification of transactions, the provision of purchased content, compliance with legal or accounting obligations, and the resolution of disputes. RevenueCat also processes data in the USA.

g) Error reports and stability of the app

We use Firebase Crashlytics to detect and fix crashes and technical errors. In particular, device information, operating system, app version, time of the error, crash information, stack traces, and technical identifiers may be processed.

Purpose: Detection, analysis, and correction of technical errors as well as improvement of the stability and security of the app.
Legal basis: Art. 6 para. 1 lit. f GDPR.

Our legitimate interest lies in providing the app reliably, securely, and with as few errors as possible. Google states for Crashlytics, among other things, the processing of crash data, crash stack traces, and technical identifiers. Google states a retention period of 90 days for this before removal from live and backup systems begins.

h) Support by email

If you contact us by email, we process the information from your message, in particular your email address and the content of your message.

Purpose: Processing your request.
Legal basis: Art. 6 para. 1 lit. b GDPR if it concerns your use of the app, otherwise Art. 6 para. 1 lit. f GDPR.

3. Services used

Firebase

We use Google Firebase for authentication, database, Cloud Functions, Remote Config, Crashlytics, and, where applicable, Cloud Storage.

The following regions or storage locations are used for our Firebase services:

- Cloud Firestore: europe-north2

- Cloud Functions: europe-west1 and europe-west4

- Cloud Storage for correction photos: us-central1

- For Authentication, Remote Config, and Crashlytics, Google does not make any separately defined regional assignment visible to us.

Google explains that Firebase processes different data depending on the service. Depending on the service used, this includes in particular login data, technical identifiers, configuration data, as well as error and crash information.

RevenueCat

We use RevenueCat for the technical processing of in-app purchases. In this context, RevenueCat processes pseudonymous, technical, and transaction-related data that are required for purchase verification, provision of purchased content, restoration of purchases, and protection against misuse. RevenueCat points out that data may be processed in the USA. We do not transmit email addresses, names, telephone numbers, advertising IDs, or IP addresses to RevenueCat.

OpenAI

We use OpenAI for individual server-side processing steps. In doing so, we transmit only barcode-related and product-related metadata insofar as this is required for the function. User-related identity data are not transmitted along with this. For the API project used, Data Retention: None is activated. OpenAI documents that with Zero Data Retention, data storage is disabled for eligible endpoints and API data is not used for training by default unless explicit permission has been granted.

Open Food Facts / Open Beauty Facts / Open Product Facts

We also use public product databases from Open Food Facts, Open Beauty Facts, and Open Product Facts for product queries.

4. Transfers to third countries

Part of the processing may take place in countries outside the European Union, in particular in the USA. According to our current status, this concerns in particular OpenAI, RevenueCat, Cloud Storage, as well as, depending on the Firebase service, other Google services.

If personal data are transferred to third countries, in particular to the USA, this is done on the basis of the European Commission’s standard contractual clauses. According to our current contractual status, this applies in particular to the Google/Firebase services, RevenueCat, and OpenAI used by us.

5. Retention period

We store personal data only for as long as they are needed for the stated purposes or as long as we are legally obliged to do so.

In detail:

- Account data, auth data, and user profile: until you delete your account

- Correction suggestions and correction photos: until processing, then deletion

- Purchase data: for as long as this is necessary for verification, provision of purchased content, prevention of misuse, and compliance with legal obligations

- Server and cloud logs: 30 days

- Crashlytics data: according to Google’s standard periods, 90 days before removal from live and backup systems begins

- Support requests by email: for as long as this is necessary for processing and insofar as statutory retention obligations exist

Google also states for Firebase Authentication that certain logged IP addresses are stored only for a few weeks and that other auth information remains stored until the user is deleted; after that, removal from live and backup systems may still take up to 180 days. For Remote Config, Google states a retention of Firebase Installation IDs until deletion by the customer, followed likewise by delayed removal from live and backup systems.

6. Deletion of your account

You can delete your account in the app. In this case, your user profile and associated data are generally deleted.

Please note: If you delete your account, any existing in-app currencies will also be lost, including purchased coins, insofar as technical restoration is no longer possible.

Data that we must continue to retain for legal reasons or for the prevention of misuse may be exempt from immediate deletion. This applies in particular to purchase-related records.

7. Minors

The app is not specifically intended for children, but can be used generally. If, under the law applicable in your country, you require the consent of your parents or legal guardians, please use the app only with that consent.

8. Your rights

Within the scope of the statutory requirements, you have the right to access, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent given with effect for the future, as well as the right to lodge a complaint with a data protection supervisory authority. These rights arise in particular from Art. 15 to 21 as well as Art. 77 GDPR.

9. Which information is required

Use of the app always takes place via an account. This account may be anonymous or voluntarily registered. We require certain information so that individual functions of the app can be provided.

If you would like to register voluntarily, we require your login data for this purpose. If you would like to make an in-app purchase, we require the information necessary for the processing of the purchase. If you would like to submit correction suggestions, a voluntarily registered account is required for this.

Anonymous use of the app is also possible. If you do not wish to use certain voluntary functions or do not provide the information necessary for them, these functions may not be available or may only be available to a limited extent.

10. Changes to this privacy policy

We may amend this privacy policy if the app, the services used, or the legal requirements change. The version published at https://buyfromfriends.app/app-privacy-en shall apply in each case.