Privacy Notice

1. Who is responsible

Jose Antonio Villazon Maroney ("we", "us") operates CalSnapp and acts as the data controller for the personal data processed through the service.

2. Data we collect

• Account data: email, authentication identifiers, language preference.
• Content you submit: meal photos, scan results, chat messages with the AI coach.
• Usage data: scans performed, streaks, device and browser information, IP address, basic telemetry needed to keep the service reliable and secure.
• Subscription data: plan, status, and environment. Payment details (card number, billing address) are collected directly by Paddle and never by us.

3. Why we use it (purposes and legal bases)

• Provide the service (account, scans, history, AI coach) — performance of a contract.
• Process payments and manage subscriptions — performance of a contract.
• Security, fraud prevention, and abuse detection — legitimate interests.
• Improve and debug the service — legitimate interests.
• Comply with legal obligations — legal obligation.
• Optional marketing emails — consent (you can withdraw at any time).

4. Who we share data with

• Paddle, our Merchant of Record, for the sale of subscriptions, payment processing, subscription management, tax compliance, and invoicing.
• Infrastructure and AI providers (cloud hosting, database, authentication, AI model providers) that process data on our behalf under written agreements.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

We do not sell your personal data.

5. International transfers

Your data may be processed in countries outside your own, including outside the UK/EEA. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We retain account, scan, and chat data for as long as your account is active, and for a reasonable period afterwards to comply with legal, accounting, and security obligations. After that, data is deleted or anonymised. You can request deletion at any time.

7. Your rights

Subject to local law, you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. UK/EEA users have the right to lodge a complaint with their supervisory authority. We respond to verified requests within one month.

8. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and authentication — to protect your data. No system is perfectly secure, but we treat security as a priority.

9. Cookies and similar technologies

We use strictly necessary cookies and local storage (for authentication, language preference, and session continuity). We do not use advertising cookies. Any analytics cookies, if added, will be loaded only with your consent.

10. Contact

Privacy questions or rights requests: Jose Antonio Villazon Maroney — support via the app.