PIKO

Privacy Policy

Last updated: 30 July 2026

This Privacy Policy explains how KeysPro AI FZCO ("KeysPro", "we", "us" or "our") collects, uses, shares and protects information when you use the PIKO mobile application and related services (together, the "Service").

KeysPro AI FZCO is a company registered in the Dubai Multi Commodities Centre (DMCC) Free Zone, United Arab Emirates, under DMCC Licence DMCC-1017161, with its registered office at Unit No: UT-12-CO-150, DMCC Business Centre, Level No 12, Uptown Tower, Dubai, United Arab Emirates. For any privacy question or request, contact us at privacy@piko.ae.

1. Summary

  • PIKO helps you scan food and drink products, read their ingredients, and see a simple quality grade.
  • You can start using PIKO without creating an account. We use an anonymous identifier so your scan history stays with you on your device.
  • Photos you capture to identify a product are processed to extract text and are not stored on our servers.
  • We do not sell or share your personal data for cross-context behavioural advertising.
  • You can delete your data at any time from within the app or by contacting us.

2. Information We Collect

Account and authentication data. When you first open PIKO, we create an anonymous account so we can secure your requests and keep your scan history. If you choose to sign in so your data follows you across devices, we collect the identifier you sign in with — this may be your phone number (for phone/SMS sign-in), your email address, or an identifier from Sign in with Apple (including Apple's private relay email, which we store as your primary contact). We do not collect a password when you use these sign-in methods.

Scan and product data. When you scan a product, we process the barcode (GTIN), any ingredient text read from the label, and the resulting product match and quality grade. We keep a history of your scans on our servers, linked to your account, so you can revisit them and sync them across devices.

Label photos. Photos you take of a product label are stored locally on your device and, where you enable it, saved to a "PIKO" album in your device's photo library. They are sent to our systems only transiently to identify the product and read its details (see Section 3).

Voice audio. If you use voice chat to ask about a product, we capture the audio of your request and convert it to text so we can understand and answer your question.

Camera, photo and microphone access. With your permission, PIKO uses your camera to scan barcodes and capture product labels, your photo library to recognise a product from a picture you already took, and your microphone for voice chat.

Diagnostics and analytics data. With your consent where required, we collect app diagnostics (such as crash reports and performance information) and anonymous usage analytics (such as which features are used) to keep PIKO stable and to improve it. On the PIKO website, Google Analytics 4 and Google Tag Manager are optional and load only after you choose “Accept analytics” in the cookie banner. We configure these tools to avoid collecting unnecessary identifiers, and we do not attach your IP address to crash reports or record your screen.

Device and technical data. We process technical information necessary to deliver the Service, such as app version, device type and operating system, and network status.

3. How We Handle Photos and Voice

Label photos captured or selected to identify a product are sent securely to our systems and to our processing providers to extract text and recognise the product. They are processed in memory and are not written to our databases, disk or logs. A cached result may be retained for a limited period to avoid re-processing the identical image, keyed to a one-way hash of the image rather than the image itself. Photos saved to your "PIKO" album stay in your own device's photo library under your control.

Voice audio is converted to text so we can find the product you are asking about and answer your question. We do not use your recordings to build a voice profile, and we do not retain the audio beyond what is needed to produce the transcription.

Please do not submit sensitive personal information — such as health or medical details, financial information, passwords or government identifiers — through the chat or voice features. They are designed for questions about food products only.

4. How We Use Your Information

We use the information described above to:

  • Provide the core Service — identify products, read ingredients and calculate quality grades;
  • Maintain your scan history and sync it if you sign in;
  • Answer your questions about a product, including via voice chat;
  • Secure the Service and prevent abuse of cost-protected features;
  • Diagnose crashes, monitor performance and improve the app;
  • Understand which features are useful (analytics), where you have consented;
  • Communicate with you about your requests and important service changes;
  • Comply with legal obligations.

5. Legal Bases for Processing

Where the EU/UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

  • Performance of a contract — to provide the Service you request;
  • Legitimate interests — to secure, maintain and improve the Service, balanced against your rights;
  • Consent — for optional analytics and, in relevant regions, diagnostics; you can withdraw consent at any time;
  • Legal obligation — where we must retain or disclose information by law.

We also process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

6. How We Share Information and Our Sub-processors

We do not sell your personal data. We share information only with service providers ("sub-processors") who process it on our behalf, under contract, to run the Service. Our current sub-processors are:

  • Supabase — cloud database, authentication and storage for your account and scan history.
  • Replit — application hosting and delivery of the Service.
  • OpenAI — AI processing of ingredient text and product analysis, and label text recognition.
  • Anthropic — AI assistant that answers your questions about products.
  • Google Cloud — image and label text recognition (OCR).
  • Google Analytics and Google Tag Manager — optional website analytics and tag management, only when you give consent through the website cookie banner.
  • Deepgram — voice-to-text transcription for voice chat.
  • Upstash — caching and rate limiting to speed up and protect the Service.
  • Sentry — crash reporting and performance diagnostics (configured without IP collection).
  • PostHog — anonymous usage analytics (configured without session recording).
  • Open Food Facts — product reference data, made available under the Open Database License (ODbL 1.0).
  • Apple and Google — app distribution and, where you use them, sign-in.

AI providers and your permission. PIKO's scanning, voice and chat features are powered by third-party AI providers (OpenAI, Anthropic, Google Cloud and Deepgram). Before any of your data — product and label photos, voice recordings, chat messages, or scanned barcodes — is first sent to these providers, the app asks for your explicit permission and explains exactly what will be shared. You can withdraw this permission at any time in Settings → Privacy & data; AI features then stop working while the rest of the app remains usable. Each of these providers is contractually required to protect your data to at least the same standard as this Privacy Policy, processes it only on our instructions to provide the feature you requested, and does not use your data to train its models under our agreements.

We keep this list up to date as we add or remove providers. We may also disclose information where required by law, to protect our rights, or in connection with a corporate transaction, subject to appropriate safeguards.

7. International Transfers

We are based in the United Arab Emirates and use providers that may process data in other countries. Where personal data is transferred internationally, we take steps to ensure an appropriate level of protection, such as relying on providers with recognised safeguards and contractual protections.

8. Data Retention

We keep your scan history and account data for as long as your account is active. When you delete your account or your data, we delete the associated personal data from our active systems, except where we must retain limited information to comply with legal obligations or resolve disputes. Cached image-processing results expire automatically after a limited period.

9. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. You can export a copy of your scans from Settings, and you can exercise these rights from within the app (see "Deleting Your Data" below) or by contacting us at privacy@piko.ae. You also have the right to lodge a complaint with your local data protection authority.

10. Deleting Your Data

You can delete all of your data at any time:

  • In the app — open Settings and choose "Delete account" (also available under Settings → Privacy & data as "Delete account & all my data"). This clears your on-device data, removes photos from the "PIKO" album, deletes your account and all associated data from our servers — scan history, chats, subscription and notification records — and signs you out.
  • By request — visit the account deletion page at piko.ae/delete-account or email privacy@piko.ae, and we will process your request.

11. Consent for Analytics and Diagnostics

In regions that require it (including the EU and UK), optional diagnostics and analytics are off by default and only start after you give consent. In the PIKO mobile app, you can change your choices at any time in Settings, and opting out takes effect in real time. On the website, Google Analytics 4 and Google Tag Manager are loaded only after you select “Accept analytics”; you can change this choice through the “Cookie settings” link in the footer. The website stores only the consent choice in your browser. App consent choices are stored with a timestamp and the policy version.

12. Health Disclaimer

PIKO is an informational tool. Product grades and information are provided for general information only and are not medical, nutritional or dietary advice, and are not a substitute for reading the actual product label. Always check the physical packaging, especially if you have an allergy, intolerance, medical condition or other specific requirement. Do not rely on PIKO for decisions about allergens or health.

13. Children's Privacy

PIKO is rated for users aged 12 and over and is not intended for children under 12. We apply an age gate and do not knowingly collect personal data from children under 12 (or under the higher minimum age set by your local law, such as 16 in parts of the EU). If you believe a child has provided us with personal data, contact us and we will delete it.

14. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you the following rights:

  • Right to know the categories and specific pieces of personal information we have collected about you, and how we use and disclose it;
  • Right to delete the personal information we hold about you;
  • Right to correct inaccurate personal information;
  • Right to opt out of the "sale" or "sharing" of personal information;
  • Right to non-discrimination for exercising your privacy rights.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Because we do not sell or share your data in this way, there is no financial incentive to disclose. You can still exercise your other rights, including "Do Not Sell or Share My Personal Information", from Settings → Privacy in the app, or by contacting us at privacy@piko.ae. We will not discriminate against you for exercising any of these rights. You may use an authorised agent to submit a request on your behalf, and we will verify your identity before acting on a request.

15. Security

We use technical and organisational measures to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app. Your continued use of the Service after an update means you accept the revised policy.

17. Contact Us

KeysPro AI FZCO Unit No: UT-12-CO-150, DMCC Business Centre Level No 12, Uptown Tower DMCC Free Zone, Dubai, United Arab Emirates DMCC Licence DMCC-1017161 Email: privacy@piko.ae