On this page
  1. Data Controller
  2. Data We Collect
  3. Third-Party AI Processing
  4. How We Use Your Data
  5. Legal Bases for Processing (GDPR)
  6. Sharing of Data
  7. Data Retention
  8. Your Rights
  9. Automated Decision-Making
  10. Cookies
  11. Security
  12. International Transfers
  13. Children’s Privacy
  14. California Privacy Rights
  15. Changes to This Notice
  16. Contact

Privacy Policy

Effective Date: June 16, 2025

This Privacy Notice explains how Cacao Mobile collects and uses your personal information when you use Palmistry.

Data Controller

CACAO MOBILE SPOLKA Z OGRANICZONA ODPOWIEDZIALNOSCIA is the data controller responsible for your personal data. For privacy-related inquiries, contact us at help@cacaomobile.net.

Data We Collect

We may collect the following categories of personal data:

  • Account data: name, email address, username, and password (hashed).
  • Payment data: billing address and transaction records. Full card details are processed by our payment provider (Stripe) and not stored by us.
  • Usage data: pages visited, features used, session duration, device type, browser, and IP address.
  • Health and nutrition data: meal logs, calorie and macro targets, weight entries, food photos, and AI scan results you submit through the Service.
  • Communications: messages you send to our support team.

Third-Party AI Processing

To provide certain features, we share the following data with third-party AI service providers acting as our data processors:

  • OpenAI — receives your chat messages and health profile data (gender, age, height, weight, goal type, and desired pace of achieving your goal) to generate personalized nutrition recommendations. Per OpenAI’s API data usage policy, this data is not used to train OpenAI’s models by default and is retained short-term (up to 30 days) for abuse-monitoring purposes.
  • FatSecret — receives food photos you submit through the Service’s scanning feature, to identify meals and estimate calorie and macronutrient content.

These providers are contractually restricted from using your data for any purpose other than delivering the requested output to us.

How We Use Your Data

We use your personal data to:

  • Provide, operate, and improve the Service.
  • Process payments and manage subscriptions.
  • Verify eligibility and enforce our Terms of Service.
  • Communicate with you about your account, updates, and support requests.
  • Detect and prevent fraud, abuse, and violations of our Terms of Service.
  • Comply with applicable legal obligations.

If you are located in the EU/EEA, we process your data on the following legal bases:

  • Contract performance: processing necessary to provide the Service.
  • Legitimate interests: fraud prevention, security, and service improvement.
  • Legal obligation: compliance with applicable laws.
  • Consent: where you have given explicit consent (e.g., marketing emails).

Where we process health-related data (e.g., weight, height, age, gender, and fitness goals) to generate AI-powered nutrition recommendations, we rely on your explicit consent (Art. 9(2)(a) GDPR), which you provide when you enter this information into the Service. You may withdraw this consent at any time by deleting this data from your profile or by contacting us at help@cacaomobile.net.

Sharing of Data

We do not sell your personal data. We may share it with:

  • Service providers: payment processors (Stripe), hosting providers, analytics, and customer support tools, under strict data processing agreements.
  • Law enforcement: when required by law or to protect our legal rights.
  • Business transfers: in the event of a merger, acquisition, or asset sale, subject to continued privacy protections.

Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. After account deletion, we may retain certain data for up to 90 days for backup and legal compliance purposes, after which it is permanently deleted.

Data shared with third-party AI providers (OpenAI, FatSecret) is retained according to their respective data retention policies, which are generally shorter-term and used only for abuse-monitoring or service-delivery purposes. Refer to the Third-Party AI Processing section above for details.

Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data (“right to be forgotten”).
  • Object to or restrict certain processing activities.
  • Request data portability.
  • Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, contact us at help@cacaomobile.net. We will respond within 10 days.

Automated Decision-Making

The Service uses automated processing, including AI, to generate personalized meal plans and nutrition recommendations based on the data you provide. This processing does not produce legal or similarly significant effects concerning you, and you are free to disregard, modify, or ignore any AI-generated recommendation. You may request human review of how your data is used to generate recommendations by contacting help@cacaomobile.net.

Cookies

We use cookies and similar tracking technologies to operate and improve the Service, remember your preferences, and analyze usage. You can control cookies through your browser settings.

Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), hashed password storage, and access controls. No method of transmission is 100% secure; we cannot guarantee absolute security.

International Transfers

Your data may be processed outside your country of residence. Where we transfer data internationally, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for EU data).

Children’s Privacy

The Service is not directed to individuals under 18 years of age, and we do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

California Privacy Rights

If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and limit the use of your Sensitive Personal Information (which may include health-related data you provide). To exercise these rights, contact help@cacaomobile.net. We do not sell or share personal information as defined by the CCPA.

Changes to This Notice

We may update this Privacy Notice periodically. We will notify you of material changes by email or via a prominent notice on the Service. Continued use after changes constitutes acceptance.

Contact

For privacy questions or complaints, contact us at: help@cacaomobile.net