Privacy Policy

LactoGo ("LactoGo," "we," "us," "our") operates the website https://lactogo.eu and the LactoGo web and mobile applications (together, the "Platform"). LactoGo is an independent, AI-powered personalized behavioral intelligence platform focused on digestive and dairy wellness. It helps you understand your own food patterns — not through generic education alone, but through personalized tools including LactoLens (photo and barcode food scanning), the Luna AI companion, Dairy Diary (meal and symptom tracking), the 28-Day Challenge (a structured personal food-behavior exploration program with streaks, badges, and pattern insights), and bite-sized Learn content (archived/legacy educational articles).

Data controller: LACTOGO DIGEST HEALTH PRODUCTS TRADING, registered business DTI No. 8448632 ("LactoGo," the controller for the purposes of the EU General Data Protection Regulation ("GDPR") and, for users in the Philippines, a personal information controller under the Data Privacy Act of 2012 (RA 10173) ("DPA")).

Contact for privacy matters: team@lactogo.eu. You can also reach the founders directly at michi.fujiwara@lactogo.eu or jj.siochi@lactogo.eu. We personally review every message and aim to respond within 2 working days.

This Privacy Policy applies to anyone who visits lactogo.eu, creates an account, uses LactoLens, Luna, Dairy Diary, or the 28-Day Challenge, or follows the LactoGo community on Instagram. It applies regardless of where you are located, with additional protections described below for users in the European Economic Area ("EEA"), the United Kingdom, and the Philippines, and it is designed to extend sensibly as LactoGo expands across Southeast Asia.

We collect only what is needed to run and improve the Platform. The table below groups data by feature.

• Account data — name, email address, password (hashed), country, language preference, and account status. Used to create and secure your account and communicate with you. Legal basis: performance of a contract (GDPR Art. 6(1)(b)); consent (Art. 6(1)(a)) for optional marketing. Under the DPA, this is processed under consent and contract-fulfillment criteria.
• Food photo scans and barcode scans (LactoLens) — images you choose to upload and the barcode or product identifier scanned. Used to run the scanning feature and return an educational, confidence-scored result. Legal basis: performance of a contract / consent, since you actively choose to submit a scan. Scan images are automatically deleted from our systems within 24 hours of processing; only the resulting text-based insight is retained as part of your account history, unless you delete it sooner.
• Dairy Diary entries — meals, symptoms, and notes you choose to log, and any trends we show you over time. This may include data concerning health under GDPR Art. 9. Used solely to show you your own patterns; never used to make medical determinations. Legal basis: your explicit, separate consent (Art. 9(2)(a)). You may decline to use Dairy Diary and still use the rest of the Platform.
• 28-Day Challenge data — your participation status, streaks, badges, daily scan/Luna usage counts, and the personal food patterns the Challenge surfaces to you. Used to run the Challenge and show you your own progress. Legal basis: performance of a contract / consent.
• AI chat data (Luna) — the questions and messages you send to Luna, and Luna's responses. Used to provide the companion feature and improve its accuracy over time. Legal basis: performance of a contract; consent where chats are used for model improvement (see Section 1.6).
• Community activity — LactoGo's community lives primarily on Instagram (@wearelactogo) and via the #LactoGoMoments hashtag; feedback you submit through the Platform. Legal basis: your consent to interact publicly, and legitimate interests in improving the Platform from your feedback.
• Analytics and usage data — pages viewed, features used, device type, general location (city/country level), approximate session duration, and crash logs. Legal basis: legitimate interests (Art. 6(1)(f)) for essential product analytics; consent for non-essential analytics cookies (see the Cookie Policy).
• Marketing and email communications — your email address and engagement history (opens/clicks) where you have opted in. Legal basis: consent, which you can withdraw at any time.

We use cookies and similar technologies for essential site operation, functional preferences, and analytics. Full detail, including the categories used, retention periods, and how to manage consent, is set out in our Cookie Policy, which forms part of this Privacy Policy.

Creating an account requires the information above and is subject to the eligibility rules in the Terms and Conditions. LactoGo's community is hosted on Instagram rather than an in-app forum — anything you share there (including under #LactoGoMoments) is visible publicly under Instagram's own terms and privacy practices, and some posts may be featured on our social media with your permission. Do not post information you want to keep private, including health details.

Luna and LactoLens use automated processing, including AI models, to generate an educational, confidence-scored response from the text, images, or barcodes you submit. We may use anonymized or aggregated inputs to improve the accuracy of these tools. Where we would use identifiable chat or scan content to train or fine-tune AI models beyond providing the immediate response, we will ask for your separate consent and let you opt out without losing access to the core Platform. See our AI Disclaimer for the limitations of these outputs.

The Platform is not directed at children and is not intended for use by anyone under 16 (or the applicable minimum age of consent for information society services in their EU member state, which can be as low as 13) or under the equivalent Philippine age threshold. We do not knowingly collect personal data from children below that age. If we learn that we have collected such data without valid parental or guardian consent, we will delete it promptly. Parents or guardians who believe a child has provided us data may contact us at team@lactogo.eu for deletion.

LactoGo is based in Estonia (EU) and serves users in the EEA, the United Kingdom, the Philippines, and, over time, other Southeast Asian markets. Our current infrastructure is as follows, and will be kept up to date here as it changes:

• Website hosting: IONOS, hosted in Spain (within the EU/EEA).
• Security and content delivery: Cloudflare, whose global network may route or cache traffic outside the EEA as part of standard security and performance protection.
• Application data storage and cloud infrastructure: hosted with providers based in the United States.

Where personal data is transferred outside the EEA/UK — including to our US-based cloud storage providers, or where Cloudflare's network processes traffic outside the EEA — we rely on the European Commission's Standard Contractual Clauses, applicable adequacy mechanisms (including the EU-U.S. Data Privacy Framework where the recipient is certified), or other safeguards recognized under GDPR Chapter V, and we take supplementary measures where required. For Philippine users, we comply with the National Privacy Commission's rules on cross-border transfers, including ensuring recipients provide a comparable level of protection. A current list of our sub-processors is available on request at team@lactogo.eu.

We apply technical and organizational measures appropriate to the sensitivity of the data involved. Our website sits behind Cloudflare for security, DDoS protection, and content delivery, and is hosted with IONOS in Spain. We use encryption of data in transit, access controls, staff confidentiality obligations, and vendor due diligence for our cloud storage providers. No system is completely secure, and we cannot guarantee absolute security; we will notify affected users and the relevant supervisory authority of any personal data breach as required by GDPR Articles 33–34 and, for Philippine users, the DPA and NPC Circular rules on breach notification.

We keep personal data only as long as needed for the purposes described above, or as required by law. As general guidance: scan images are auto-deleted within 24 hours of processing; account, Dairy Diary, and Challenge data are retained while your account is active and for a limited period afterward to allow reactivation and meet legal obligations; analytics data is retained in aggregated or anonymized form beyond the periods needed for individual-level analysis. When data is no longer needed, we delete or anonymize it. You own your data and can request deletion at any time (Section 1.11).

If you are in the EEA/UK, under GDPR you have the right to: access the personal data we hold about you; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; object to processing based on legitimate interests or direct marketing; data portability (receive your data in a structured, machine-readable format); and withdraw consent at any time without affecting prior lawful processing. You also have the right to lodge a complaint with your local data protection supervisory authority, or with Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon).

If you are in the Philippines, under the Data Privacy Act you have the right to: be informed; object; access; correct; erasure or blocking; data portability; damages for inaccurate, unlawfully obtained, or unauthorized use of data; and to file a complaint with the National Privacy Commission (NPC).

To exercise any of these rights, email team@lactogo.eu. We will respond within one month (GDPR) or the timeframe required under the DPA, and may need to verify your identity first.

We only send marketing or promotional emails (including future product announcements) to users who have opted in. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time without affecting service-related communications (e.g., account, security, or legal notices), which are sent regardless of marketing preferences.

If you have a concern about how we handle your data, please contact us first at team@lactogo.eu so we can try to resolve it directly. You may also complain to your national supervisory authority (in the EEA/UK) or the National Privacy Commission (in the Philippines) at any time; you are not required to contact us first.

We may update this Privacy Policy as the Platform evolves, including to cover new features. Material changes will be notified via the Platform or email before they take effect. The "Last updated" date above reflects the most recent revision.

LactoGo · LACTOGO DIGEST HEALTH PRODUCTS TRADING · Registered Business DTI No. 8448632