i love eat

Privacy Policy — i love eat

Effective date: 30 September 2026

Data controller: CHILLSTONES, UNIPESSOAL LDA

Registered address: Rua Marquês Da Fronteira Nr. 106, 3º Esq., 1070-300 Lisboa, Portugal

Contact: chill@chillstones.com

Website: iloveeat.app

1. Scope and Who We Are

This Privacy Policy explains how CHILLSTONES, UNIPESSOAL LDA (“CHILLSTONES”, “we”, “us” or “our”) processes personal data when you use the i love eat app and its related services (collectively, the “Services”). CHILLSTONES is the controller of the personal data described here, except where a third party acts as an independent controller under its own terms.

The Welcome screen presents links to this Policy and the Terms before Sign in with Apple. By choosing to continue from that screen, you acknowledge that these privacy disclosures have been made available. The app does not record a separate Privacy Policy acknowledgement. Where applicable law requires consent for a particular processing activity, we will request consent as required rather than treating acknowledgement of this Policy as blanket consent.

The Services are intended only for people aged 18 or older.

2. Personal Data We Collect

Depending on the features you use, the app processes the following categories on your device or through the identified service providers:

We configure the photo-recognition flow to remove unnecessary image metadata, including location metadata, before a sanitized image is sent for external AI recognition.

3. Food Photos and Third-Party AI Processing

When an available photo-based food-recognition request is admitted, i love eat prepares a sanitized image on your device before external AI processing. The prepared JPEG has a longest side of at most 768 pixels and quality 0.75; the preflight normalizes orientation, masks detected sensitive regions and removes image metadata before transmission. Public photo-AI transmission is currently closed; a limited authenticated TestFlight path may process eligible photos.

Food images may be sent through our authenticated backend to the OpenAI API for food-recognition functionality. Where the closed-beta Vlada Chat feature is available, an eligible bounded text dialogue may also be sent from our backend to the OpenAI API to generate a reply. The chat safety gate bypasses OpenAI for certain high-confidence safety cases; it does not guarantee that all sensitive text is withheld. Public Vlada Chat provider use remains closed pending its separate review. Both OpenAI Responses paths set store: false. OpenAI states that API data is not used to train its models unless the customer explicitly opts in. Under OpenAI’s standard API controls, abuse-monitoring logs may contain customer content, including eligible dialogue text, and may be retained for up to 30 days, unless longer retention is required by law or reasonably necessary to protect services or third parties from harm. Image inputs are also subject to safety scanning; an image detected as potentially containing child sexual abuse material may be retained for manual review.

AI outputs are estimates. i love eat applies additional server-side validation and may use authoritative food-composition sources for nutrition calculations. AI output is not medical advice or guaranteed nutritional truth.

4. How We Use Personal Data

We may use personal data:

5. Our Own AI and Machine-Learning Development

We may use User Content, including food photographs, associated labels, corrections and derived data, to create datasets and to research, evaluate, train, fine-tune, test, validate and improve CHILLSTONES’ own AI and machine-learning systems. This describes permitted purposes, not an assertion that ordinary device-local Board photographs are currently collected or retained for training. A separate optional food-photo contribution program, if introduced, will require its own affirmative choice before any eligible photograph is retained for a dataset. Where personal data is involved, we rely on an appropriate lawful basis under applicable law. Where special-category data or another situation requires consent, we will seek consent where required.

We may aggregate, de-identify or anonymize information so that it is no longer personal data under applicable law. We may retain and use genuinely de-identified or anonymized information for research, statistics, product development and AI/ML development and do not intentionally attempt to re-identify it except where required or permitted by law.

6. De-identified Food Photos in Marketing

We may use food photographs and related content that we lawfully hold in genuinely de-identified or anonymized form in CHILLSTONES’ own social-media channels, marketing, promotional, educational and illustrative materials and demonstrations of how i love eat works. This does not mean the current app uploads ordinary device-local Board photographs for marketing. We will not intentionally associate such public use with your account, name, email or other direct identifiers.

This does not authorize us to use an identifiable photograph of you, your likeness, or content that remains directly attributable to you as a testimonial or endorsement without a separate legal basis or permission where required.

7. Legal Bases for Processing in the EEA

Where the GDPR applies, our legal basis depends on the purpose and context:

Where we rely on consent, you may withdraw it at any time without affecting processing carried out lawfully before withdrawal.

8. Service Providers and Recipients

We disclose personal data only as reasonably necessary to operate the Services, comply with law, protect rights and security, or complete a corporate transaction. Our technology stack may include:

9. Analytics, Advertising and Sale of Personal Data

The current app does not transmit product-analytics events to PostHog. If product analytics is enabled after the required review, it will be limited to approved operational events and must exclude raw food photographs, raw AI prompts, raw AI responses and sensitive meal content.

We do not currently sell personal data for money. We do not currently use health- or nutrition-related personal data for third-party targeted advertising. If our advertising practices materially change, we will update this Policy and provide choices or consent required by applicable law.

Our use of de-identified or anonymized food photographs in CHILLSTONES’ own marketing is described in Section 6.

10. International Data Transfers

CHILLSTONES is established in Portugal. Some service providers may process personal data outside Portugal or the European Economic Area, including in the United States. A transfer that requires protection under applicable law must rely on an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses and supplementary technical or organizational measures. The applicable mechanism depends on the provider and processing location.

The PostHog project is configured for EU Cloud, but the current app does not send it product-analytics events. Other providers may have different processing locations and transfer mechanisms, and an EU region does not necessarily mean every category of system or operational data remains exclusively in the EEA.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining security, complying with legal obligations, resolving disputes and enforcing agreements. Retention depends on data type, sensitivity, purpose and applicable legal requirements.

The in-app account-deletion flow erases app-owned local account data and requests deletion of current account records and the Supabase Auth account. When you delete your account, we will delete or de-identify personal data associated with it in accordance with applicable law and our operational deletion processes, subject to data we must retain for legal, security, fraud-prevention or dispute-resolution purposes. Deleting the app alone does not delete the remote account; deleting an account does not itself cancel an App Store subscription.

Data that has been genuinely and irreversibly anonymized or aggregated so that it is no longer personal data may be retained for research, statistics, product development, AI/ML development and other lawful purposes. Account deletion may therefore not require deletion of information that is no longer personal data under applicable law.

Third-party processors may apply their own limited retention periods. OpenAI’s standard API abuse-monitoring retention may be up to 30 days as described in Section 3.

12. Your Privacy Rights

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of your personal data; request restriction; object to certain processing; receive data you provided in a structured, commonly used and machine-readable format; withdraw consent where processing is based on consent; and lodge a complaint with a competent supervisory authority.

To exercise a privacy right, contact chill@chillstones.com. We may need to verify your identity before completing a request. We will respond within the time required by applicable law.

If you are in the EEA, you may lodge a complaint with your local data-protection authority. For CHILLSTONES’ establishment in Portugal, the competent supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

13. Account Deletion and Choices

You may request deletion of your account and associated personal data through available in-app functionality or by contacting chill@chillstones.com. Revoking a device permission stops future access controlled by that permission but does not necessarily delete data already lawfully collected.

You manage Apple subscription cancellation through your Apple account. Deleting your i love eat account or deleting the App does not itself guarantee cancellation of an App Store subscription.

14. Security

We use reasonable technical, organizational and administrative safeguards designed to protect personal data, including access controls, authenticated backend processing and encryption in transit where supported. No system can be guaranteed completely secure, and we cannot promise absolute security.

15. Children

i love eat is not directed to children. You must be at least 18 years old to use the Services. If we learn that we have processed personal data from a person under 18 contrary to this Policy, we will take appropriate steps to remove the data and terminate the account where applicable.

16. Third-Party Services and Links

The Services may contain links to or integrations with third-party services. Their privacy practices are governed by their own policies and agreements.

17. Corporate Transactions and Legal Disclosures

If CHILLSTONES is involved in a merger, acquisition, financing, reorganization, sale of assets or similar transaction, personal data may be disclosed or transferred as permitted by applicable law and subject to appropriate safeguards.

We may preserve or disclose information where reasonably necessary to comply with law or valid legal process, protect rights, property or safety, investigate fraud or abuse, or establish, exercise or defend legal claims.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Where required by law, we will provide notice of material changes before they take effect. The effective date at the top shows when this version became effective.

19. Contact Us

CHILLSTONES, UNIPESSOAL LDA

Rua Marquês Da Fronteira Nr. 106, 3º Esq.

1070-300 Lisboa, Portugal

Email: chill@chillstones.com

Website: iloveeat.app