Informativa sulla Privacy

1. Introduction

Kcaly (“we,” “us,” or “our”) operates the website at kcaly.ai and the Kcaly nutrition tracking service (the “Service”). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.

By using Kcaly, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Data We Collect

2.1 Account Information

• Phone number (used for authentication via WhatsApp OTP)
• Display name, height, weight, age, gender, and activity level (provided during onboarding)
• Nutrition goals and preferences

2.2 Meal & Nutrition Data

• Meal descriptions and food photos sent via WhatsApp
• AI-generated nutritional analysis (calories, protein, fat, carbs)
• Meal timestamps and history

2.3 Usage Data

• Dashboard interactions and feature usage
• Device type and browser information (basic analytics)

2.4 Payment Data

Payments are processed by Paddle (our payment provider). We do not store credit card numbers or banking details. Paddle may collect billing information directly. See Paddle's Privacy Policy for details.

3. WhatsApp Data Processing

Kcaly integrates with WhatsApp to receive meal descriptions and photos from you. When you send a message to our WhatsApp bot:

• Your message is processed through the WhatsApp Business API (provided by Meta)
• We receive only messages you send directly to our bot number
• Food photos are processed by AI for nutritional analysis and then stored securely
• We do not access your other WhatsApp conversations, contacts, or media

Important: WhatsApp is not a HIPAA-compliant platform. Do not use Kcaly to transmit sensitive medical information. Kcaly is a nutrition tracking tool, not a medical service.

4. How We Use Your Data

We use your information to:

• Provide and maintain the nutrition tracking service
• Analyze meals and generate nutritional breakdowns
• Display your nutrition analytics and progress
• Generate personalized meal plans and insights
• Process subscription payments (via Paddle)
• Send service-related notifications via WhatsApp
• Improve the accuracy of our AI models
• Respond to support requests

We do not sell, rent, or share your personal data with advertisers or third-party marketers.

5. Data Storage & Security

Your data is stored securely using industry-standard encryption at rest and in transit. We use:

• HTTPS/TLS for all data transmission
• Encrypted database storage
• Secure authentication via JWT tokens
• Limited access controls for internal team members

While we implement reasonable security measures, no method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.

6. Third-Party Services

We use the following third-party services:

• WhatsApp Business API (Meta) — message processing and delivery
• Paddle — payment processing and subscription management
• Vercel — web application hosting
• Railway — API server hosting

Each third-party service has its own privacy policy. We encourage you to review their policies.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the right to:

• Access — request a copy of your personal data
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data
• Portability — request your data in a machine-readable format
• Restriction — request restricted processing of your data
• Objection — object to data processing based on legitimate interests

To exercise any of these rights, contact us at privacy@kcaly.ai.

8. Cookies

Kcaly uses essential cookies to maintain your authentication session (keeping you logged in). We do not currently use advertising cookies, third-party tracking cookies, or analytics cookies.

If we introduce non-essential cookies in the future, we will update this policy and request your consent.

9. Children's Privacy

Kcaly is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

10. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription or request account deletion, we will delete your personal data within 30 days, except where we are required by law to retain certain information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

privacy@kcaly.ai