Privacy Policy

1. Scope

This Privacy Policy describes how Calorate collects, uses, stores, discloses, retains, and deletes personal data when you access or use our website, applications, calculators, food search tools, and related services worldwide.

For this notice, Calorate is the data controller or equivalent responsible party for the personal data it determines how to process. If a local law requires a different controller or representative, the applicable local arrangement takes precedence. Questions and requests can be sent to [email protected].

2. Data We Collect

Depending on the features you use, we may process account and contact details, device and usage data, support communications, profile details such as age, sex, height, weight and goals, food searches, meals, calorie and nutrient records, hydration, and activity information.

3. Health Data We Access and/or Collect

Nutrition information and body measurements, as well as pregnancy, menstrual-cycle, or breastfeeding information, may be health-related or sensitive data. AI features may send coach messages and history, meal photos, nutrition records, goals, and some profile or preference data to the Google Gemini API to generate the response you request.

4. Why We Use Data

We use data to provide and personalize the service, generate AI responses, secure accounts, answer support requests, and meet legal obligations.

5. International Privacy Rights and Legal Bases

The legal basis depends on the circumstances and may include contract performance, legal obligations, legitimate interests, or consent where required. Additional conditions apply to health and other sensitive data. You may exercise your rights or withdraw consent by contacting us; withdrawal does not affect processing that was lawful before withdrawal.

6. Sharing of Data

We may share data with providers that supply service infrastructure and features. For AI features, relevant requests and content are sent to the Google Gemini API. Calorate currently uses the unpaid Gemini API service. Under Google’s terms for unpaid services, Google may use prompts and responses to improve its products and may have them reviewed by humans; Google says not to submit personal or sensitive information to Unpaid Services. The service plan may change. We do not sell data.

7. Data Retention

We retain data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required by law or reasonably necessary for security, fraud prevention, dispute resolution, or legal claims.

Our standard retention approach is as follows:

• Account and profile data, if an account feature is available: retained while the account remains active and for the period needed to complete a verified deletion request, unless a longer retention period is legally required.
• Health-related and calculator input data: retained only for as long as needed to provide the requested feature or respond to a related request. Some inputs may be processed only in the browser; this does not mean that every input is stored by Calorate.
• Support and request records: typically retained for up to 24 months after the relevant matter is closed to document and resolve prior requests.
• Technical logs and security records: typically retained for up to 12 months, unless longer preservation is required for abuse prevention, incident investigation, or legal compliance.
• Aggregated or de-identified analytics: may be retained for a longer period because they no longer directly identify an individual.

8. How Users Can Delete Their Data

Users may request deletion of personal data and health data by emailing [email protected] from the email address associated with the account or by otherwise providing sufficient information for verification.

Once a request is verified, we will normally respond within the period required by applicable law and, where practicable, within 30 days. We will delete or anonymize relevant data unless certain records must be retained for legal, tax, security, fraud-prevention, or dispute-resolution purposes.

If only part of the data can be deleted immediately, we will explain what was deleted, what must be retained, and the reason for that retention. Backup systems may retain data for a limited rolling period before secure overwrite or deletion occurs.

9. Cookies and Similar Technologies

We use browser storage and similar technologies for essential preferences such as language and theme, for manager-session security, and for core site functionality. We may use analytics or other non-essential technologies only where permitted and, where required, after obtaining your consent. You can manage cookies and browser storage through your browser settings, although some features may not function properly if essential storage is disabled.

10. Data Security

We implement reasonable technical and organizational measures intended to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. However, no storage or transmission method is completely secure, and absolute security cannot be guaranteed.

11. Children's Privacy

Calorate is not directed to children under 13, or the higher minimum age required in your jurisdiction. We do not knowingly collect personal data from children in violation of applicable law. If you believe a child has submitted personal data to us, contact us so that we may review and take appropriate action.

12. International Transfers

Google and other providers may process data outside your country. The processing location and applicable transfer mechanism depend on the provider and service configuration. Transfers from Türkiye must also meet applicable KVKK requirements.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If material changes are made, we will update the effective date on this page and, where appropriate, provide additional notice. The updated policy applies from its effective date and does not change how we lawfully processed data before that date.

14. Contact

If you have questions regarding this Privacy Policy, your data, international privacy rights, KVKK-related requests, or deletion requests, contact us at [email protected].

Contact for Privacy and Deletion Requests

Email: [email protected]

Please include your account email and a clear description of your request so we can verify and process it.