Privacy Policy

Calorichat is a service offered by Astravia LLC, a limited liability company («LLC») formed in Wyoming, United States. Astravia LLC («we», «us», «our», or «the Company») is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our application and nutrition assistance and calorie tracking services through WhatsApp and the web platform («Service»).

By using our Service, you agree to the collection and use of information in accordance with this policy. We will not use or share your information with anyone except as described in this Privacy Policy.

We collect several types of information for various purposes to provide and improve our Service for you.

Personal information

While using our Service, we may ask you to provide certain personally identifiable information that can be used to contact or identify you («Personal Data»). Personally identifiable information may include, but is not limited to:

• WhatsApp phone number
• Email address
• Name
• Health and nutrition data you provide (weight, height, nutrition goals)
• Information about meals and foods logged
• Dietary preferences and food restrictions
• Photos of food shared with the service

Usage data

We also collect information on how the Service is accessed and used («Usage Data»). This Usage Data may include information such as your device type, your use patterns, the features you use, the time and date of your use, and other diagnostic data.

Calorichat uses the collected data for various purposes:

• To provide and maintain our Service
• To notify you about changes to our Service
• To allow you to participate in interactive features when you choose to do so
• To provide customer care and support
• To provide analysis or valuable information so we can improve the Service
• To monitor use of the Service
• To detect, prevent and address technical issues
• To personalize nutrition recommendations based on your goals, dietary preferences, and health data
• To send reminders and personalized nutrition and calorie-tracking tips
• To analyze food photos and provide nutritional information

Calorichat will retain your Personal Data only for as long as necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our agreements and policies.

Calorichat will also retain Usage Data for internal analysis. Usage Data is generally retained for a shorter period, except when used to strengthen security or improve the functionality of our Service, or when we are legally required to retain it for longer periods.

Your information, including Personal Data, may be transferred to — and maintained on — systems located outside your state, province, country, or other governmental jurisdiction where data protection laws may differ from those of your jurisdiction.

If you are located outside Colombia or the United States and choose to provide us with information, please note that we transfer data, including Personal Data, to servers and providers that may be in the United States, the European Union, Colombia, or other regions. We use providers such as Stripe, Clerk, Supabase, OpenAI, Meta (WhatsApp), PostHog, Sentry, and Logtail, whose privacy policies and safeguards we apply to the extent possible.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Calorichat will take all reasonably necessary steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

Legal requirements

Calorichat may disclose your Personal Data in good faith when we believe such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Calorichat
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

The security of your data is important to us, but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

We use Stripe, Inc. («Stripe») to process subscription payments. Charges are processed through Astravia LLC's Stripe account. When you make a payment through our platform, it is important that you understand how your personal data is processed.

Data shared with Stripe

When you make a transaction, we may share with Stripe: full name, email address, user identifier, and data necessary for the subscription. Your payment method (card) information is collected and processed directly by Stripe and is not stored on our servers. Stripe complies with PCI DSS standards. For more information see Stripe's privacy policy: stripe.com/privacy.

Base legal / Legal basis

The legal basis for sharing this data with Stripe is the performance of the subscription contract you accept when making the payment.

Stripe uses the data for: transaction processing, fraud prevention, legal compliance, and dispute and refund management.

In addition to Stripe, we use the following providers to operate the Service. Each processes data according to its own privacy policy:

• Stripe — payments and subscriptions. Policy: stripe.com/privacy
• Clerk — authentication and account management (email, name, session). Policy: clerk.com/legal
• Supabase — database and backend (profile, meals, nutrition, subscriptions). Policy: supabase.com/privacy
• OpenAI — food photo analysis and nutrition responses (images, conversation text). Policy: openai.com/policies/privacy-policy
• Meta / WhatsApp — the bot uses WhatsApp Business, the WhatsApp Cloud API to send messages, and the WhatsApp webhook to receive your messages. Phone number, messages, and photos you send are processed. Policy: whatsapp.com/legal/privacy-policy
• PostHog — product analytics (usage events, identifiers). Policy: posthog.com/privacy
• Sentry — error monitoring (error context, identifiers). Policy: sentry.io/privacy
• Logtail (Better Stack) — application logs (logs that may contain technical identifiers). Policy: betterstack.com/privacy

In compliance with the Colombian Personal Data Protection Law (Law 1581 of 2012) and, for users in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR), you have rights that include:

• Right of access: to request copies of your personal data.
• Right to rectification: to request that we correct inaccurate or incomplete information.
• Right to erasure: to request that we delete your personal data, under certain conditions.
• Right to restrict processing, under certain conditions.
• Right to object to processing, under certain conditions.
• Right to data portability: to request that we transfer your data to another organization or to you, under certain conditions.

To exercise any of these rights, contact us by email using the link at the end of this page. We will respond within 15 business days of receiving your request. Users in the EU/UK may also lodge a complaint with the relevant data protection authority.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the «last updated» date.

You are advised to review this Privacy Policy periodically. Changes are effective when posted on this page.

If you have any questions about this Privacy Policy, please contact us by email using the link below.

jhon.acosta@calorichat.com