Kalo privacy policy

Last updated: 12 October 2026

Data controller

Juan Zurita Ruiz-Ruano, an individual trading as ZuritaTech (tax ID 26828689V), at Calle Alta Cartuja, 20, Granada (España). Contact: admin@zuritatech.com. Kalo never sells your data.

This policy covers the Kalo app and this website as far as Kalo is concerned. The GDPR and Spain's LOPDGDD apply and, depending on where you live, the UK GDPR, Brazil's LGPD and US state privacy laws; we extend the rights described below to everyone.

What data we process and why

• Profile (sex, age, height, weight, activity, goal): on your phone, to calculate your daily target; if you create an account and agree to the cloud, it syncs encrypted (see “Synced data”). This is health data: we process it with your explicit consent (GDPR art. 9(2)(a)).
• Meal and weight diary: on your phone only (and in your Google account's backup if you have it on), to show your progress. Explicit consent.
• Dish photos: before sending them, the app recompresses them on your phone (which removes their EXIF metadata, such as location). They are sent to our server, which forwards them to Google (Gemini, paid service) and, as a backup, to Groq (USA) to recognise the dish; the note you write and your phone's country travel with the photo. They are not stored on our server. They require your express, separate consent (health data and transfer to the USA), which you can withdraw in Profile.
• Anonymous installation identifier: phone and server, to count the day's scans and link your subscription.
• Google Play purchase token: server, to check whether you have Premium.
• Optional account (your Google or Apple account identifier and your email): only if you sign in, to sync between phones and keep your Premium.
• Synced data (profile, meals and weights; never photos): on our server, encrypted (AES-256), only if you sign in and agree to store it in the cloud. Explicit consent.
• Usage statistics and crash reports (Firebase Analytics and Crashlytics): only if you accept the consent form.
• Advertising data (Google AdMob): only on the free plan and according to the consent that applies (see “Ads and consent”). Kalo sends no health data to ads.
• Website waitlist (your email, the app, the language and the dates you signed up, confirmed and were notified): only if you sign up on this website. Purpose: sending you a single email when Kalo is out on Google Play, after you confirm your address from the email we send you.

Legal basis

Performance of the service you request (GDPR art. 6(1)(b)), for the account, syncing and purchases. Your consent (art. 6(1)(a)) for statistics, error reports and ads, which you can withdraw at any time in the app's privacy settings; withdrawing it doesn't affect earlier processing. Health data (profile, diary, weights and dish photos) is processed with your explicit consent (GDPR art. 9(2)(a)). Legitimate interest (art. 6(1)(f)) for security and abuse prevention. For the waitlist, your consent (art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in any of our emails or by writing to us.

Ads and consent

Kalo shows Google AdMob ads on the free plan, with a PG content rating. In the countries where it applies, Google's consent form (UMP / IAB TCF) is shown before requesting ads and they are only requested according to your choice. In Settings, “Privacy and consent” lets you withdraw or change your consent where applicable.

Kalo sends no health data (profile, diary, weights or photos) to ads.

Recipients and processors

We only share data with providers that supply us with a service, under contract, and don't use it for any other purpose:

• IONOS SE: hosting of our server, on a VPS in Frankfurt (Germany), within the European Union.
• Cloudflare, Inc.: delivery network and attack protection. Connections to our website and API pass through its servers, which see your IP address and technical connection data; it doesn't keep your account content.
• Google Play (Play Billing): purchases and subscriptions. Google processes payment details.
• Google AdMob and Google's consent form (UMP / IAB TCF): ads on the free plan, only according to your choice.
• Google Firebase (Analytics and Crashlytics): statistics and errors, only with your consent.
• Google Cloud / Gemini API: analysis of the dish photo, using the paid Gemini API. According to Google's terms for the paid API, Google doesn't use the content to train its models.
• Groq, Inc. (USA, Llama model): AI vision backup; if Gemini fails or times out, the photo is sent to Groq. We have accepted its data processing agreement (DPA), which sets out the applicable transfer safeguards and states that it does not use API data to train its models.
• Google Sign-In and Sign in with Apple: only to identify you if you choose to sign in.
• Amazon Web Services EMEA SARL (Amazon SES, Stockholm region, within the European Union): sending the waitlist emails.
• Backblaze, Inc. (B2 storage, USA): encrypted backups of the server (Kalo accounts and the waitlist), under its data processing agreement (DPA) with standard contractual clauses.

International transfers

Some providers (Google, and Cloudflare where involved) may process data outside the European Economic Area, for example in the US. In that case GDPR safeguards apply: the EU-US Data Privacy Framework or standard contractual clauses. Outside the EU, protection may differ from that of your country. If Gemini fails or times out, the dish photo is sent to Groq (USA), which is a transfer to the US. We have accepted its data processing agreement (DPA), which sets out the applicable transfer safeguards and states that it does not use API data to train its models.

How long we keep data

• Account and synced data: until you delete the account, which is erased immediately from the app (see “Delete account”).
• Dish photos: not stored on our server.
• Installation identifier and scan counter of users without an account, and inactive accounts: deleted after 13 months of inactivity. Encrypted server backups (daily, weekly and monthly, at Backblaze, USA) are kept for up to 12 months, so a deleted item can persist in them for up to that period; they are only restored in case of disaster.
• Waitlist: if you don't confirm your email, it is deleted after 7 days; if you do, up to 30 days after we tell you about the launch, or as soon as you unsubscribe.

Your rights and how to use them

You can access, rectify and erase your data, object to or restrict its processing, ask for portability and withdraw your consent at any time. From the app: Profile › Your account › Delete account and cloud data. More detail on the Delete account page.

For any other request email admin@zuritatech.com; we reply within one month at most. We won't discriminate against you for exercising your rights. If you're not satisfied, you can complain to the Spanish Data Protection Agency, AEPD (aepd.es) or to the authority in your country.

Grievance contact / Contacto para reclamaciones

If you live in India (Digital Personal Data Protection Act, 2023, DPDP) or want to file a complaint about how we handle your data, email admin@zuritatech.com. We will handle it and reply within 30 days at most.

Brazil (LGPD)

If you live in Brazil, the channel to exercise your rights as a data subject (LGPD) is admin@zuritatech.com. We have not appointed a data protection officer (encarregado/DPO); admin@zuritatech.com is the contact channel both for data subjects and for the National Data Protection Authority (ANPD), to which you can also complain (gov.br/anpd).

Minimum age and children

Kalo's minimum age is 16, as declared in these terms and in the Google Play listing. If the law of your country requires a higher age (for example, 15 in France or 16 in Germany), that is the minimum age that applies to you. The app has no general age screen.

Only in Brazil, India, Indonesia, South Africa and Nigeria, where the law requires age assurance or an age of majority of 18, the app asks you to confirm “I am 18 or older”. No age or date of birth is stored, only a yes; if you don't confirm it, you can't use the app. To know whether it must ask for that confirmation, the app uses your SIM, network, language and Google Play country on your own phone, without sending or storing them for that purpose.

Kalo uses the age you enter in your profile to calculate your calories. It is stored on your phone and, if you create an account and agree to store your data in the cloud, it syncs with it along with the rest of the profile (encrypted on the server, see “What data we process”).

Kalo isn't directed at anyone below the minimum age. If you think a minor has given us data, write to us and we'll delete it.

Automated decisions

Dish photo analysis is done by an AI model that suggests which dish it is; calorie calculations and your target are estimates that you review and adjust. We make no decisions that produce legal effects on you or similarly affect you.

Security

Encrypted connections (HTTPS), synced data encrypted on the server (AES-256), credentials in the phone's secure storage and logs without personal or health data. No system is infallible: if a breach affects you, we'll tell you as the law requires.

Health notice

Kalo gives estimates based on standard recipes and is not a medical device or medical advice. The result of a photo is analysed by AI and shown with a notice that it is a rough estimate: please review it. If you have or have had an eating disorder, talk to a professional before counting calories.

Changes to this policy

If we make a material change, we'll tell you in the app before it applies. The date above shows the latest revision.