Privacy Policy

Calibr8 Nutrition is a service of CALIBRATE Ltd (КАЛИБРЕЙТ ЕООД), UIC 208715859, with its registered seat in Shumen, Bulgaria. CALIBRATE Ltd is the data controller responsible for your personal information. We provide evidence-based adaptive nutrition tracking through our web application.

Contact: support@calibr8nutrition.com

Account Information: Email address, name, and authentication credentials when you create an account.

Profile Data: Age, gender, height, and activity level to calculate your nutritional needs.

Health & Body Data: Weight, body fat percentage, and body measurements you choose to log. This is classified as special category data under GDPR and requires your explicit consent.

Nutrition Logs: Food intake, meal timing, and calorie/macro tracking data you record.

Voice Clips (optional): If you use voice meal logging, a short recording of your speech is processed to produce the text description of your meal. The clip is transcribed in memory and never stored on our servers; see AI-Powered Features below for details.

Usage Data: How you interact with the app, feature usage patterns, and device information for service improvement.

We do not collect data from third parties. All personal data comes directly from you.

Certain data you provide (weight, body fat, body measurements, and health-related dietary preferences) is classified as "special category data" under GDPR Article 9.

We only process this health-related data with your explicit consent, which you provide during account creation.

You can withdraw consent for health data processing at any time by deleting your account or contacting us. Withdrawing it also stops the AI coaching, voice and label-reading features, which cannot run without it.

This data is used solely to provide personalized nutrition recommendations and track your progress.

Service Delivery: Calculate personalized calorie and macro targets, generate meal recommendations, and track your progress toward goals.

Account Management: Authenticate your identity, manage your subscription, and communicate important service updates.

Service Improvement: Analyze anonymized, aggregated usage patterns to improve features and user experience.

Support: Respond to your questions and provide customer assistance.

We do not use your data for automated decision-making that produces legal or similarly significant effects.

Consent (GDPR Article 6(1)(a)): For processing your health data, body measurements, and sending optional marketing communications.

Contract Performance (GDPR Article 6(1)(b)): For providing the nutrition tracking service you signed up for.

Legitimate Interests (GDPR Article 6(1)(f)): For service improvement, security monitoring, and fraud prevention, where these interests do not override your rights.

For special category health data, we rely on explicit consent under GDPR Article 9(2)(a).

We never sell your personal data. Period.

Service Providers: We share limited data with trusted providers who help us operate the service: Supabase (database hosting, EU region), Vercel (web hosting), Stripe (payment processing), Resend (transactional email delivery), Google Analytics 4 (anonymized usage analytics), and Sentry (error monitoring).

AI Providers: The coaching, voice and label-reading features send data to Anthropic, Voyage AI, OpenAI, Groq, ElevenLabs and fal.ai. AI-Powered Features below sets out what each one receives.

All service providers are bound by data processing agreements and can only use your data to provide services to us.

Legal Requirements: We may disclose data if required by law, court order, or to protect our legal rights.

Your data is primarily stored in the European Union (Supabase EU region).

Some service providers may process data in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

By using our service, you acknowledge these transfers necessary to provide the service.

Active Accounts: We retain your data for as long as your account remains active and you use our services.

Deleted Accounts: When you delete your account, we remove your personal data within 30 days. Some anonymized, aggregated data may be retained for analytics.

Legal Requirements: We may retain certain data longer if required by law (e.g., financial records for tax purposes).

Backups: Database backups rotate on a 7 day schedule, so deleted data leaves backups within 7 days. Uploaded files such as photos are stored separately from database backups and are removed directly when your account is deleted.

Access: Request a copy of the personal data we hold about you.

Rectification: Correct any inaccurate or incomplete data.

Erasure: Request deletion of your data ("right to be forgotten").

Data Portability: Receive your data in a structured, machine-readable format.

Withdraw Consent: Revoke consent for health data processing at any time.

Object: Object to processing based on legitimate interests.

Restriction: Request limited processing in certain circumstances.

To exercise these rights, contact us at support@calibr8nutrition.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

For privacy inquiries, data requests, or concerns:

Email: support@calibr8nutrition.com

We aim to respond to all requests within 30 days.

Coach chat: Our in-app AI coach runs on Anthropic's Claude API (model claude-sonnet-5). So that it can answer you in context, we send your message together with a personalized summary of your profile: your first name, goal, sex, diet type and any allergens you have listed, your calorie and macro targets, your recent weight and body fat figures, your intake over the last 14 days, and your latest weekly check-in. This includes health data.

The legal basis for sending health data to our AI providers is your explicit consent under GDPR Article 9(2)(a), which you give when you create your account. Without an active consent record, these features do not run.

Knowledge search: Before the coach answers, the text of your question goes to Voyage AI, which ranks the passages of our nutrition knowledge base that best match it and screens the message for attempts to manipulate the model. Voyage AI receives your question, not your name, email or profile.

Automated insights: Your daily and weekly coaching insights are written by Claude on a schedule, without you opening a conversation. That request carries your targets, the food names you typed, your weight trend, your training days and your check-in history; the weekly one also carries your body fat estimate and any free-text answer you gave to an earlier insight. Your name and email are not included.

Voice logging: Your short voice clip is sent to a speech-to-text provider to produce the transcript you then review and confirm. We use OpenAI as the primary provider, with Groq and ElevenLabs as automatic fallbacks, so one clip may be sent to more than one of them if the first does not answer. Only the audio and your app language are sent; your name and email are not included. The clip is transcribed in memory and no audio recording is written to our servers or backups.

Meal descriptions: When you describe a meal in free text, or confirm a voice recording, that description is sent to Groq to be resolved into foods and quantities. Only the text of the description is sent.

Label photos: When you photograph a nutrition label, the photo is sent to Anthropic's Claude to read the printed values. No account, profile or health data travels with it. A photo you attach to a food you submit is stored in our media storage for as long as that food entry exists.

Meal share cards: The photo you choose to share is sent to fal.ai to remove its background. No account or health data is included in this request.

Training and retention at the providers: Anthropic is contractually barred from training its models on what we send it, and OpenAI and Groq do not use API data for training by default. Providers may hold content briefly for abuse monitoring and service reliability before discarding it.

All of these providers process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses in each provider's data processing agreement; ElevenLabs additionally holds EU-US Data Privacy Framework certification.

Withdrawing consent: You can withdraw at any time by emailing support@calibr8nutrition.com or by deleting your account. We then stop sending your data to these providers and the AI features stop working: the coach, voice logging, label reading and the automated insights. Anything already sent before you withdrew cannot be recalled.

You can review the privacy practices of these providers at anthropic.com/privacy, openai.com/privacy, groq.com/privacy-policy, voyageai.com/privacy, elevenlabs.io/privacy and fal.ai/privacy.