This privacy policy applies to the Fitto.ai app for mobile devices, together with any related services operated by Samipan Bandyopadhyay (collectively, the "Application"). Samipan Bandyopadhyay is hereby referred to as the "Service Provider".
Information Collection and Use
The Application collects information when you download and use it. This information may include:
Information automatically collected
- Your device's Internet Protocol (IP) address
- The pages of the Application you visit, and the time and date of your visit
- The time spent on the Application
- Your mobile operating system
Information you provide
- Account details: your email address and name
- Profile details used to estimate your nutritional needs: age, weight, height, and gender
- Meal photographs that you choose to capture or upload for AI analysis
How meal photos are used
When you choose to analyze a meal, the photo you capture or upload is sent to Google's Gemini AI service (Google Generative AI, operated by Google LLC) to estimate the food items, calories, and macronutrients. This is described in detail in the "Artificial Intelligence and Third-Party AI Processing" section below. No other personal data is sent to Google for this purpose, and the Application asks for your explicit consent before sending your first photo.
Cookies and tracking technologies
The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, or service delivery. Where required by applicable law, the Service Provider will obtain consent before using non-essential tracking technologies.
Your Rights
You may request access to, correction of, or deletion of your personal data held by the Service Provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the Service Provider at mszsamip@gmail.com.
Your California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. To exercise your CCPA/CPRA rights, contact the Service Provider at mszsamip@gmail.com.
Artificial Intelligence and Third-Party AI Processing
The Application's core feature analyzes photos of your meals to estimate their calories and nutritional content. To do this, when you choose to capture or upload a meal photo, that image is transmitted to Google's Gemini AI service (Google Generative AI), operated by Google LLC, which analyzes the image and returns estimated food items and nutrition information.
- What is shared: only the meal photo you choose to analyze. No other personal data (your name, email, profile details, or location) is sent to Google for this purpose.
- Purpose: to identify foods in the image and estimate calories and macronutrients.
- Consent: the Application asks for your explicit consent before sending your first photo for AI analysis. You may decline, and the AI analysis feature will not be used.
- Third-party protection: Google processes this data in accordance with the Google APIs Terms of Service and the Google Privacy Policy, which provide data protection equivalent to that described in this policy.
Third Party Access
When you use the AI meal-analysis feature, the meal photo you submit is shared with Google's Gemini AI service as described in the "Artificial Intelligence and Third-Party AI Processing" section above. Aside from this, only aggregated, anonymized data is periodically transmitted to external services to help the Service Provider improve the Application. The Service Provider may share your information with third parties in the ways that are described in this privacy statement.
International Data Transfers
The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the Service Provider will use appropriate mechanisms.
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions or other legally recognized transfer mechanisms
- Your consent, where required and legally permitted
Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.
The Service Provider may disclose User Provided and Automatically Collected Information:
- as required by law, such as to comply with a subpoena, or similar legal process;
- when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
- with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.
Opt-Out Rights
You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.
To request deletion of your personal data, to withdraw consent, or to exercise any of your rights, contact the Service Provider at mszsamip@gmail.com. You can also delete your account in the app; see how to delete your account.
Data Retention Policy
The Service Provider retains personal data based on its necessity for the stated purposes:
- User Provided Data: Retained for the duration of your use of the Application plus 12 months thereafter, unless longer retention is required by law
- Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance
- Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
- Data required for legal compliance: Retained as long as required by applicable law
You may request deletion of your personal data, subject to any legal obligation to retain it. If you want the Service Provider to delete User Provided Data submitted through the Application, please contact them at mszsamip@gmail.com. Please note that some User Provided Data may be required for the Application to function properly.
Children
The Application is not intended for children under 16 years of age, or such higher age as required by applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.
The Service Provider does not knowingly collect personally identifiable information from children. The Service Provider encourages all children to never submit any personally identifiable information through the Application and/or Services. The Service Provider encourages parents and legal guardians to monitor their children's Internet usage and to help enforce this Policy by instructing their children never to provide personally identifiable information through the Application and/or Services without their permission. If you have reason to believe that a child has provided personally identifiable information to the Service Provider through the Application and/or Services, please contact the Service Provider (mszsamip@gmail.com) so that they will be able to take the necessary actions. If you are under 16 years of age, your parent or guardian must provide consent on your behalf where permitted by law.
Security
The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.
Data Breach Notification
If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.
Changes
The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.
Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at mszsamip@gmail.com.
This privacy policy is effective as of .
Your Consent
Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.
Contact Us
If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at mszsamip@gmail.com.