Privacy Policy

At eSmart Bin, we are on a mission to make everyday waste sorting simple, so that more of what we throw away gets a second life. Our app suggests the right bin or disposal stream for an item in seconds — and the photos and descriptions you scan are used only to classify them, unless you choose to send one to us in a correction.

This privacy policy (the "Policy") explains how eSmart Bin ("eSmart Bin", "we", "us" or "our") processes the personal information of the people who use our app and related services (our "Users"), and of anyone else we interact with in operating our business. It applies to the eSmart Bin mobile application (the "App") and the account, support and web services that link to this Policy (together, the "Services"). Our Service Terms govern your use of the Services and should be read together with this Policy. Some laws call the information this Policy covers "personal data"; in this Policy we use "personal information" to mean the same thing. The company providing the Services, and how to reach us, are set out in Section 15.

1. WHO CAN USE OUR SERVICES

The Services are intended only for adults aged 18 or over and are not directed to children. Before an account is created, Users confirm that they are at least 18 and accept these documents; we record that confirmation, the document version and the date. We do not ask for or store dates of birth. Providing a false age is a breach of the Service Terms, and we close any account we find belongs to a person under 18. If you believe a person under 18 has used the Services, contact privacy@esmartbin.com and we will delete their information promptly.

2. HOW YOUR SCANS ARE CLASSIFIED

To classify an item, the App sends a reduced copy of your photo (at most 512 pixels on its longest side, with location and camera metadata removed — never the original file) or your typed description, over an encrypted connection, to our classification service. That service passes only the photo or description, with our instructions to the AI model, to our third-party AI service providers, located in the United States and Singapore, and returns the suggested bin to the App. Your name, email address, account and device identifiers and IP address are not sent to them. We do not store or log scan photos or descriptions sent for classification. Our third-party AI service providers do not use them to train AI models, but may keep them for a period set by their own terms, for purposes such as security, abuse prevention and legal compliance. Scan photos and descriptions are not shared with advertising partners, and classification needs an internet connection. The App may keep a temporary working copy of a camera image in its own private storage on the User's device; that copy is deleted when the scan ends.

We keep only two things from a classification: the result (Section 3), and anything a User deliberately chooses to send us (Section 3).

3. INFORMATION WE COLLECT FROM USERS

• Account and sign-in information. When you continue with Apple (not available in the Android app), continue with Google, or sign up with email, we receive the name, email address, provider account identifier and verification status, together with authentication and session security events. Apple may supply a private relay email address instead of your real one. We never receive your password; email credentials are handled by our identity provider and are not stored by us.
• Classification results. For each completed classification we may receive the item and material category, the suggested bin, a confidence indication, whether camera or text was used, the date, time and time-zone offset, and related technical events — we do not keep the photo or the description (Section 2). These are linked to the User's account and a random installation identifier and support scan allowances, credits, statistics, streaks, abuse prevention and troubleshooting.
• Feedback and corrections. A User who sends a correction or feedback provides what they submit: their text, the classification context, the photograph from the classification being corrected, and up to two further images they choose to attach. A submission is linked to the User's account, name and email address — it is not anonymous. If you do not want the photograph sent, do not send the correction. Please do not submit faces, identity documents, number plates, health information or another person's information.
• Reminders and notifications. The device's time zone; if you set up pickup reminders, your reminder settings (your bins, their colours, pickup days and reminder times); and, when notifications are allowed for the App, the device's push token, which we use to send that device your reminders and messages about your account.
• Device, usage and security information. A random installation identifier; device model, platform and operating-system version; device country (on iOS, the Region setting; on Android, the SIM card's country, or the region of the device's language where there is no SIM); IP address and request data generated when the App communicates with our systems, and the approximate location — city, state or region, and country — that we derive from that IP address when the App starts and keep with the installation record (the address itself is not kept for this); credits, promotional-allowance and rewarded-advertising activity; and fraud, abuse and security records. Other settings, sign-in material and local history remain on the User's device and are not visible to us.
• Website contact form. If you write to us through the form on our website, we receive what you type — your name, email address, a subject and your message — and up to three images you choose to attach. The submission travels from your browser to our own API, which Microsoft hosts for us, and is stored there so that we can read it and reply. Like any web request, the submission also carries the IP address and technical request data your connection presents, which Microsoft, as the host of our API, necessarily sees; we do not store it with your message. We use it only to answer you and to keep a record of the correspondence; it is not linked to an App account unless you tell us which account you mean. Please do not attach faces, identity documents, number plates, health information or another person's information.
• Webpages. Our website sets no cookies, stores nothing on your device and measures nothing; the two sign-in pages described in the next item are the only exception, and it is explained there. There is no analytics, no advertising technology and no cross-site tracking, so there is nothing to ask your permission for and no cookie banner to click. Every file the site needs — its typeface, its images and its app-store badges — is served from our own domain, so our pages themselves send nothing to any other company when they load. Two things sit outside that. On an iPhone or iPad, Safari may show its own App Store banner above our pages; to do so, Safari — not our site — asks Apple for the App's listing, under Apple's privacy policy, and we receive nothing from it. And the requests you start yourself: by following a link, by sending us a message through the contact form described above, or by signing in on one of the sign-in pages described next. Our web host, GoDaddy, records ordinary server logs for each request, which necessarily include the IP address your connection presents, purely to serve the pages and protect the site against abuse; we do not use those logs to build a profile of you or combine them with anything else. The App is different and is described in the rest of this Section.
• Sign-in pages. Two pages on our website ask you to sign in: the account-deletion page (Section 11) and the invitation page that a participating organisation's join link or QR code opens (Terms of Use, Section 10). Both load Microsoft's sign-in library from our own domain and keep your sign-in session — and, on the invitation page, the invitation code and your consent tick — in your browser's session storage only until you close the tab; nothing is set for tracking. When you choose to continue, your browser talks to Microsoft, our identity provider, to sign you in or to create your account, and then sends the resulting sign-in token to our own API, which Microsoft hosts for us, so that we can act on your account. On the invitation page that means we record the account (with the version and date of the Terms and this Policy you accepted), the organisation whose invitation you used, the credits granted, and the date and time of each attempt, which we keep to prevent abuse. Like any web request, these carry the IP address and technical request data your connection presents.

Health-adjacent categories. The disposal categories include Medical Waste, so scanning a medicine packet or similar item means that category and the App-generated item description reach us linked to the account. A photo or description of such an item is sent to our third-party AI service providers for classification like any other scan (Section 2). We do not use this information to infer anything about anyone's health, to select advertising, or for anyone's marketing. Users who prefer that we not receive it can simply not scan the item, or give a general typed description instead, and can ask us to delete any such record at any time.

4. DEVICE PERMISSIONS

• Camera — requested only for camera classification. Users who refuse or revoke it can continue with description-based classification. Scan photos are sent for classification as described in Section 2; we keep one only if you include it in a correction.
• Photos — feedback attachments use the operating system's photo picker; we receive only the photos a User selects, never their library.
• iOS tracking (ATT) — a User who asks the App not to track will not be tracked in the Apple-defined sense, and AdMob does not receive the IDFA. Classification is unaffected.
• Android — advertising identifiers are controlled through the in-App advertising controls and the device's settings.

5. HOW WE USE THE INFORMATION WE COLLECT

We use personal information to: create, secure and administer accounts; provide Service functions such as allowances, credits, statistics and streaks; review and respond to feedback and — where the User agrees or the law otherwise permits — improve our classification technology using material Users deliberately submitted; measure and improve the performance and reliability of the Services; display and secure advertising (Section 6); prevent fraud, abuse and security incidents; comply with law; and establish, exercise or defend legal claims.

Where the law that applies to you requires a legal basis, we rely on performance of our contract with you, your consent (which you may withdraw at any time, as easily as you gave it), our legitimate interests, and our legal obligations; the regional schedule for your region (Section 12) states the basis for each purpose where its law requires that detail. Information that has been irreversibly anonymised is no longer personal information, and we may use it without restriction.

Automated classification. Classifications are generated by third-party AI models (Section 2). Results are automatically generated suggestions; they can be wrong, they have no legal or similarly significant effect on any person, and we make no such decisions about our Users. We do not use facial recognition, biometric identification or biometric templates, and we never attempt to identify a person in an image. We do not sell or provide personal information to anyone to train artificial-intelligence models, and we improve our own classification technology only with material Users deliberately submit through feedback (Section 3) — which any User can ask us to stop using and to delete at any time. Messages and images sent through the website contact form are never used for this.

6. ADVERTISING

The App shows advertising through Google AdMob. When an ad is requested, the Google Mobile Ads SDK can collect the User's IP address (which indicates approximate location), device and advertising identifiers where available and permitted (the Android Advertising ID, the app-set ID, and on iOS the IDFA only where tracking is allowed), ad interactions, and diagnostics. Google and the advertising parties identified in the consent interface use this information to deliver, measure and secure advertising and — only where the User's choices and the law permit — to personalise it. See Google's Privacy Policy and how Google uses data from partner apps.

Where the law that applies to you requires your opt-in consent, the App either asks before any ad is requested (through Google's consent interface or, in a few countries, its own question), or keeps personalised advertising switched off unless you switch it on at Profile → Allow personalised ads; on iOS it also asks for Apple's tracking permission. Elsewhere, personalised advertising can be switched off at any time at Profile → Allow personalised ads (and, where it is offered, Profile → Ad privacy options). In some countries, including Australia and Canada, it is off unless the User switches it on; for this the App goes by the device's region settings or SIM card, not by the User's location. Refusing personalisation never affects classification, though non-personalised ads may still be shown and still involve limited technical processing (such as IP address) to deliver and protect the ad.

We never send advertising providers a User's name, email address, photographs, descriptions, feedback or classification results. We do not serve personalised advertising to anyone under 18.

7. REASONS WE SHARE INFORMATION

We share personal information only as needed for the purposes described in this Policy: with Microsoft, our identity, hosting and storage provider (including for messages sent through the website contact form), which acts on our instructions; with GoDaddy, which hosts the pages of our website and, as any web host must, sees the IP address of each request in its server logs; with third-party AI service providers, which receive scan photos and descriptions only to return a classification (Section 2); with Google, for the AdMob advertising described in Section 6 — for the step of storing or reading the advertising identifier on a device in the EEA, UK and Switzerland we are joint controllers with Google, and Google is otherwise an independent controller for its advertising services; with Apple and Google in their roles as sign-in providers, app marketplaces and notification services; with professional advisers under confidentiality; with authorities where disclosure is required by law or valid legal process, or is necessary to protect rights, safety or security; and with a successor in a merger, acquisition or asset sale, in which case this Policy continues to apply to the transferred information. Providers acting for us are bound by contract to process personal information only on our instructions and to keep it secure.

We do not sell personal information for money, and we are not a data broker. Where a User permits personalised advertising, the sharing of identifiers with Google may be characterised as a "sale", "sharing" or "targeted advertising" under some laws — Section 10 explains how to opt out.

8. INTERNATIONAL DATA TRANSFERS

We are established in India, and our providers process personal information in India and in the other countries where they operate. Scan photos and descriptions sent for classification go to our third-party AI service providers in the United States and Singapore (Section 2). Where the law that applies to you requires a transfer safeguard, we use a legally recognised mechanism such as an adequacy decision or approved standard contractual clauses; details are available on request at privacy@esmartbin.com.

9. STORAGE PERIOD

We keep personal information only as long as needed for the purposes described in this Policy. Account and classification-result records are kept while the account is open and are deleted or irreversibly de-identified within 30 days of a verified deletion request. Feedback submissions are deleted with the account, or earlier on request. Messages sent through the website contact form, including any attached images, are kept only for as long as we need them to answer you and to keep a record of the correspondence, and are deleted on request at any time. We keep a minimal record that a deletion occurred, together with security, fraud, tax and legal records, only for the period the law requires; backups are isolated and overwritten on rotation, with deletion reapplied if a backup is restored. We do not keep scan photos or descriptions sent for classification; our third-party AI service providers may keep them for a period set by their own terms (Section 2). Anything you include in a correction is kept with that feedback submission, as described above.

10. YOUR RIGHTS AND CHOICES

Depending on where you live, you may have the right to access, correct, delete and receive a copy of your personal information; to restrict or object to processing; to withdraw consent; to opt out of the sale or sharing of personal information, targeted advertising and profiling; to appeal a decision we make about your request; and to complain to your privacy regulator or a court. To exercise any right, use the controls in the App or email privacy@esmartbin.com; we will verify the request, respond within the period the applicable law requires, and never treat you less favourably for exercising a right.

Advertising opt-out. Switch off Profile → Allow personalised ads, use Profile → Ad privacy options, decline iOS App Tracking Transparency, or use your Android advertising settings. Our webpages do not sell or share personal information and do not serve targeted advertising, so there is currently nothing for a Global Privacy Control signal to switch off; should that ever change, we will honour the signal before any such processing begins. Mobile operating systems do not currently deliver such a signal to apps, and if one becomes available we will honour it. We do not respond to legacy browser "Do Not Track" headers. Advertising providers may collect information about your activity over time and across other apps and websites, as described in Section 6.

11. DELETING YOUR ACCOUNT

• In the App: Profile → scroll to the bottom → Delete Account.
• Online: esmartbin.com/delete-account — sign in with the same Apple, Google or email method.
• By email: support@esmartbin.com from the address on your account.

Deletion covers the account and the personal information linked to it, subject to Section 9. It does not delete information held independently by a sign-in provider, app marketplace or advertising provider (use their controls — for Apple, see "Sign in with Apple" in your Apple account settings; for Google, see Manage links between your Google Account & apps from other developers), copies of scan photos or descriptions that a third-party AI service provider keeps under its own terms (Section 2), information kept only on the device, or any marketplace subscription.

12. REGIONAL INFORMATION

Where the law of a region requires additional information — such as a local representative, a named officer or additional rights — we publish a regional privacy schedule alongside this Policy; where one exists for your region it applies in addition to this Policy and prevails on points governed by that region's law. The Services are offered only in countries where we have enabled them. Any term of this Policy does not apply to the extent it is incompatible with the mandatory law that applies to you.

13. SECURITY

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls and logging, and we bind our providers to security obligations. No system is completely secure; if a breach occurs we will investigate, mitigate and notify as the applicable law requires. Report suspected unauthorised account use to privacy@esmartbin.com.

14. CHANGES TO THE POLICY

We may update this Policy when the Services or legal requirements change, and will update the date above. If a change is material we will notify Users in the App or by email before it takes effect, and obtain consent where the law requires it. Earlier versions are available on request.

15. CONTACT INFORMATION

The Services are provided by ESMART BIN GLOBAL LLP (LLPIN ACV-6643), which is the controller of the personal information described in this Policy. Our registered office and full company details are published in our Legal Notice.

Privacy matters: privacy@esmartbin.com · Everything else: support@esmartbin.com. If you are not satisfied with our response to a complaint, you may complain to the privacy regulator or court available to you.