Privacy Policy

Effective 9 November 2026

This Policy explains what personal data VeraLens (“we”) processes when you use CalFoto AI, why we use it, and your rights. It is designed for GDPR (EU/EEA) and App Store / Google Play requirements.

1. Controller

The data controller is VeraLens, for the CalFoto AI app. Contact: contact.calfotoai@gmail.com.

2. Data we collect

• Account: email, Apple or Google identifiers, time you accepted the terms.
• Waiting list, if you join on the website before the app is available: email, optional first name, and the language of the page you submitted (Romanian or English).
• Profile: name, age/date of birth, sex, height, weight, calorie and macro goals, preferences.
• Log: nutrition estimates, workouts, water, steps, and notes you enter. Meal and progress photos stay on your device; we do not store them in our database. On the device, meal photos stay until you delete the meal, the app, or the device data.
• Device: platform, app version, identifiers needed for sign-in and purchases.
• Payments: Apple or Google confirm subscription status (via the store and, if used, RevenueCat). We do not store your card number.
• Apple Health (optional, iPhone): only if you grant access, we read workouts and steps and may write workouts you log in the app. We do not use HealthKit data for advertising.
• Health Connect (optional, Android): only if you grant access, we read workouts and steps and may write workouts you log in the app. This data stays on your phone and is not used for advertising.

3. Why we process data

• To provide your log, sync nutrition data, AI photo analysis, goals, and support.
• To send one launch announcement to people who join the waiting list, in the language they chose.
• To run your account, Premium subscription, and usage limits.
• To comply with law (including valid authority requests) and protect the service from abuse.

4. GDPR legal bases

• Performance of a contract (providing the app you request).
• Consent (for example Apple Health or Health Connect, marketing emails if you opt in, certain analyses).
• Legitimate interests (security, improving the service, within the law).
• Legal obligation (accounting, authority requests, where applicable).

5. AI analysis and photos

When you scan a meal, the photo is sent once to Google Gemini and Groq (via Cloudflare Workers) to estimate foods and nutrients. We do not keep a copy of the photo on our servers or in the CalFoto database. After analysis, the image remains only on your phone. We do not keep it in our cloud. On the device it stays until you delete the meal, the app, or the device data. Do not upload images of other people without a basis, or prohibited content.

We do not sell your photos. Nutrition results (calories, macros, food names) may sync with your account. Photos themselves are not synced to the cloud.

6. Who we share with

We do not sell personal data.

Processors: cloud infrastructure and database (Supabase); Google Gemini and Groq for food-image analysis (via Cloudflare Workers); Apple/Google for sign-in and payments; RevenueCat for subscription status where used. Apple Health and Health Connect data stays on device for sync and is not used for advertising.

Apple and Google receive payment data and, at Sign in, the identity data you choose to share.

7. Transfers outside the EEA

Some providers may process data outside the EEA. Where required, we use appropriate safeguards (for example Standard Contractual Clauses).

8. Retention

We keep account and nutrition-log data while you use the service. Meal photos are stored only on your device, not in our cloud. After account deletion we delete or anonymize account data within a reasonable time, except what we must keep by law (for example store transaction evidence). Waiting-list addresses are deleted after that launch announcement is sent, or earlier if you ask us to remove them.

9. Security

We use encrypted connections, access control, and specialized hosting. No internet transmission is 100% secure.

10. Children

We do not knowingly collect data from children under 16. If we learn such an account exists, we delete it. Parents can contact contact.calfotoai@gmail.com.

11. Your rights

You may access, rectify, erase, restrict, object, port data, and withdraw consent. You can delete your account in Profile or email us.

You may lodge a complaint with a supervisory authority (in Romania: ANSPDCP — dataprotection.ro).

12. Waiting list

The public waiting list stores only what you type on that form: your email, an optional first name, and whether you used the Romanian or English page. That language choice is how we decide which launch email to send. The legal basis is your consent, given by the checkbox. Email contact.calfotoai@gmail.com to access or delete the address. Joining the list does not create an app account.

13. Changes

We may update this Policy. The date at the top shows the current version. Continued use after a material change means you have been informed of the new version.