Effective Date: [●] 2026 | Version: 2.0
"Mavalo" is an application operated by Building Report LLC, a limited liability company organized under the laws of Wyoming, United States, with its principal place of business at 30 N Gould St, STE R, Sheridan, WY 82801, USA ("we", "us", "our"). This Privacy Policy ("Policy") explains how we process Personal Data in connection with:
For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR") and the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"), to the extent those laws apply to our processing, Building Report LLC is the Data Controller of the Personal Data described in this Policy. References in this Policy to "Mavalo" are to the App and Services operated by us.
How to contact us about privacy: privacy@mavalo.app (see Section 13 for postal contact details and complaint routes).
Data Protection Officer: [Option A: "We have appointed a Data Protection Officer, who can be contacted at dpo@mavalo.app." / Option B: "We have assessed our processing activities and are not required to appoint a Data Protection Officer under Article 37 GDPR. Privacy inquiries are handled by our privacy team at the address above."]
We process the following categories of information. We do not process biometric templates or perform structural facial mapping; images are analyzed solely to classify items (products, foods, plants) for safety analysis.
Transaction records and subscription status (for example, Pro tier subscription details). All payments are processed directly by the Apple App Store or Google Play Store. We never collect, process, or store your payment card numbers, financial account numbers, or billing details.
We do not collect categories of data defined as "special category data" under Article 9 GDPR or "sensitive personal information" under the CPRA, and we do not use or disclose any Personal Information for purposes that would trigger a right to limit under Cal. Civ. Code § 1798.121.
| Purpose | Data Categories | Legal Basis (EU/UK GDPR Art. 6(1)) |
|---|---|---|
| Performing camera-based safety scans and presenting safety results | Image and Video Data; feature settings | Performance of a contract (Art. 6(1)(b)) |
| Providing your account and Pro subscription features (scan history, recall alerts) | Account Data; Commercial and Transaction Data | Performance of a contract (Art. 6(1)(b)) |
| Debugging, service performance, security, and fraud/threat prevention | Usage and Performance Data; Device and Network Identifiers | Legitimate interests (Art. 6(1)(f)) — keeping the Services secure, reliable, and free of abuse |
| Showing contextual safer-alternative suggestions based on your current scan (the curated shop section uses no Personal Data) | Image and Video Data (the current scan result only) | Legitimate interests (Art. 6(1)(f)) — offering relevant, safer purchase options and funding the Services through affiliate commissions |
| Optional product analytics to improve features | Usage and Performance Data | Consent (Art. 6(1)(a)) |
| Responding to your inquiries and complaints | Communications Data | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) where a statutory request is involved |
| Complying with legal obligations (e.g., tax, accounting, responding to lawful requests) | As required | Legal obligation (Art. 6(1)(c)) |
Consent and how to withdraw it. Where we rely on consent (optional analytics), you give it through an in-app toggle when you first use the App, and you may withdraw it at any time in Settings → Privacy → Analytics. Withdrawal takes effect going forward and does not affect the lawfulness of processing carried out before withdrawal.
Legitimate interests. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object at any time (see Section 8).
The App's safety results are generated by automated image-analysis technology without human review at the point of use. In general terms, the technology compares features of your submitted image against classification models and safety reference data to identify the item and return an informational result.
Safety results — including any suggestion that an alternative product is safer (Section 5) — are informational aids only. They are not medical, veterinary, or professional safety advice, and they should never be your sole basis for a decision affecting the health or safety of a person or animal. Always exercise your own judgment and consult a qualified professional where health or safety is at stake.
If you are in the EU or UK and believe an automated result has produced a legal or similarly significant effect on you, you have the right to obtain human review of the analysis, to express your point of view, and to contest the result. Contact us at privacy@mavalo.app.
The App includes two shopping-related features, both linking to products on Amazon:
We participate in the Amazon Associates program and may earn a commission on qualifying purchases made through these links.
No Personal Data about you is sent to Amazon in connection with either feature. If you tap a link, you leave the App and navigate to Amazon, where Amazon's own privacy policy governs any data Amazon collects about your visit and purchase — we do not control that processing. Amazon does not tell us who purchased anything; affiliate reporting we receive is aggregate and does not identify you. We do not use your scan history, identifiers, or any other Personal Data to build advertising profiles, and we do not disclose your Personal Data to Amazon or any other retailer for their marketing purposes.
Suggested and catalogued products are informational recommendations, not guarantees of safety or fitness for your specific circumstances (see Section 4).
We retain Personal Data only as long as necessary for the purposes described in this Policy, and we apply the following periods or criteria:
Account deletion. You may request deletion of your account and associated data at any time via our Account Deletion Request Page. Verified deletion requests are actioned promptly: data is removed from our active systems within [7] days, and from encrypted backups on our rolling backup deletion cycle of up to [35] days, after which it is unrecoverable. We may retain limited data where the law permits or requires it — for example, to comply with legal obligations, resolve disputes, prevent fraud, or establish or defend legal claims (EU/UK GDPR Art. 17(3); Cal. Civ. Code § 1798.105(d)). Where we retain data under an exception, we will tell you so in our response.
We do not sell your Personal Data. We disclose it only to the following categories of recipients, and only as needed:
An up-to-date list of our processors is available on request at privacy@mavalo.app.
If you are in the European Economic Area or the United Kingdom, you have the following rights under Chapter III of the EU/UK GDPR:
How to exercise these rights. Email privacy@mavalo.app. We may need to verify your identity — usually by confirming control of the email address linked to your account — before acting on a request. We respond within one month of receipt. Where a request is complex or we receive multiple requests, we may extend this by up to two further months; if so, we will tell you within the first month and explain why. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
Complaints. You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your national Data Protection Authority. We would appreciate the chance to address your concern first, but you may contact the authority at any time.
We honor the rights granted by the comprehensive state privacy laws in force where you reside (including, without limitation, California, Virginia, Colorado, Connecticut, Texas, Oregon, and Montana). Depending on your state, these include the rights to:
We do not sell Personal Information, and we do not share it for cross-context behavioral advertising or use it for targeted advertising or significant-effects profiling. Because we do not engage in these activities, there is nothing to opt out of; nevertheless, we treat Global Privacy Control (GPC) and similar universal opt-out signals as valid opt-out requests as required by applicable law.
How to exercise these rights. Email privacy@mavalo.app or use the in-app request form. We will verify your request (normally by confirming control of your account email) and respond within 45 days, extendable once by a further 45 days where reasonably necessary; we will notify you of any extension. You may designate an authorized agent to act for you; we will require proof of the agent's authority and may still verify your identity directly.
In the preceding 12 months we have collected the categories of Personal Information described in Section 2 (identifiers; internet or other electronic network activity; commercial information; audio/visual information in the form of item scans), for the purposes described in Section 3, retained for the periods in Section 6, and disclosed for business purposes only to the service-provider categories in Section 7. We have not sold or shared Personal Information in the preceding 12 months. We do not collect or use sensitive personal information for purposes requiring a Right to Limit, and we have no actual knowledge of selling or sharing the Personal Information of consumers under 16.
The Services are intended for adults — parents, guardians, and adult pet owners. They are not directed to children, and we do not knowingly collect Personal Data from:
Account registration requires confirmation that the user meets the applicable minimum age. If we learn that we have collected Personal Data from a child below the applicable age, we will promptly delete it from our active systems and initiate removal from backups in accordance with Section 6. Parents or guardians who believe a child has provided us Personal Data should contact privacy@mavalo.app.
We process data on secure cloud infrastructure located in the United States and the European Union. Where Personal Data originating in the EEA or the UK is transferred to a country without an adequacy decision (Art. 45 GDPR), we implement appropriate safeguards, specifically:
You may obtain a copy of the relevant safeguards (redacted where necessary for confidentiality) by contacting privacy@mavalo.app.
We apply technical and organizational measures appropriate to the risk, including encryption of data in transit (TLS) and at rest, access controls on a least-privilege basis, network segregation, logging and monitoring, and regular security testing. No system is perfectly secure, and we cannot guarantee absolute security; you are responsible for keeping your account password confidential. If a Personal Data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where legally required, affected users without undue delay in accordance with Articles 33–34 GDPR and applicable U.S. state breach-notification laws.
The Services are operated from the United States and are directed at users in the United States. We do not target, market to, or monitor the behavior of individuals in the European Union or the United Kingdom, and we have not appointed a representative there under Article 27 of the EU or UK GDPR. If you access the Services from outside the United States, you do so on your own initiative, and your Personal Data will be transferred to and processed in the United States, where data protection laws may differ from those in your country. If EU or UK data protection law nonetheless applies to any of our processing, the rights described in Section 8 are available to you and you may contact us at the address above.
If you believe our processing of your Personal Data infringes applicable law, you may lodge a complaint with your state Attorney General (Section 9) or, where EU/UK law applies, your supervisory authority (Section 8), in addition to contacting us.
The Site uses cookies and similar technologies. Strictly necessary cookies (security, load balancing, session integrity) are used without consent, as permitted by the EU ePrivacy rules. Any non-essential cookies (e.g., analytics) are set only with your prior consent, which you can give, refuse, or withdraw at any time via the cookie banner or the "Cookie Settings" link in the Site footer. For details of the specific cookies used, their purposes, and durations, see our separate [Cookie Policy].
We may update this Policy from time to time. The "Effective Date" at the top shows when it was last revised. For material changes — such as new purposes of processing, new categories of data, or new categories of recipients — we will provide prominent advance notice (for example, by in-app notice or email) and, where the change relies on consent, we will seek it before the change takes effect. Prior versions are available on request. Your continued use of the Services after a change takes effect constitutes acknowledgment of the updated Policy, but never a substitute for consent where consent is legally required.
Calm, clear safety answers for the people and pets you love.
Mavalo provides AI-generated guidance for general informational purposes only. It is not medical, veterinary, or professional advice and may be inaccurate — always verify independently and consult a qualified professional for any health or safety decision. In an emergency, contact emergency services right away.
© 2026 Mavalo. Made with care for families everywhere.