Privacy

Ketolio is the data controller for the personal data processed in the app. This means we are responsible for ensuring that the data is processed in accordance with applicable privacy legislation, and that you can contact us about your data processing.

Account and profile information: email address, name, phone number, selected language, keto-ratio target and other settings you provide during profile setup.

Health and nutrition data: meal plans, foods you register, recipes, saved meals, macro calculations, keto-ratio history and statistics. This data is linked to your account and is considered health data under GDPR when it relates to a medical diet for GLUT1 deficiency syndrome.

Payment information: for subscriptions, we store only the last four digits of your card number and billing status. Complete card information is processed exclusively by our payment provider (Stripe) and is never stored on Ketolio's servers.

Usage data: information about how you use the app (login times, features used, device information) is collected for technical operation and improvement of the service.

Images: if you use the scan feature to analyze nutrition labels, the image is uploaded temporarily for analysis and is not permanently stored unless you save the food to your library.

We process your personal data based on the following legal grounds under GDPR Art. 6:

• Consent (Art. 6(1)(a)): for creating an account, profile setup and using features that require registration.
• Contract performance (Art. 6(1)(b)): for delivering the service you subscribed to, including meal registration and statistics.
• Legitimate interest (Art. 6(1)(f)): for technical operation, security, bug fixing and improvement of the service, insofar as this does not override your interests.
• Legal obligation (Art. 6(1)(c)): for retaining billing data in accordance with accounting law.

For health data that may be linked to GLUT1 treatment, GDPR Art. 9 requires explicit consent. This consent is given when creating an account and can be withdrawn at any time.

We use your data to:

• create and maintain your user account;
• deliver the service — register meals, calculate macros, keto-ratio and calories;
• store your foods, recipes, meal plans and saved meals;
• generate statistics and trends for your own follow-up;
• process payments and manage subscriptions;
• send notifications about trial period, billing and important updates;
• improve the app's functionality and user experience;
• secure the platform against abuse and unauthorized access;
• fulfill legal requirements, including accounting obligations.

You yourself: You always have access to your own data. Other users do not have access to your data — Row-Level Security ensures that each user only sees their own foods, meals, recipes and subscriptions.

Data controllers at Ketolio: A limited number of people with administrator access may inspect data for technical needs, customer support or security reasons. All such access is logged and follows strict internal guidelines.

Data processors (subcontractors): We use the following third-party services as data processors, established with data processing agreements in accordance with GDPR Art. 28:

• Base44 — platform for app hosting, database and authentication (EU-based infrastructure).
• Stripe — payment processing. Only the last four digits of the card and billing status are stored with us.
• AI providers — for Keto Coach and image analysis of nutrition labels. Images are sent temporarily and not stored with the provider.
• External food databases (Matvaretabellen, Open Food Facts, European databases) — only for searching and displaying nutrition data, no personal data is shared.

We never sell, rent or trade personal data to third parties for marketing purposes.

If personal data is processed by providers outside the EEA (for example AI providers in the USA), we ensure that the transfer takes place with appropriate safeguards, including Standard Contractual Clauses (SCC) approved by the EU Commission, and that the recipient is bound by GDPR.

You can request a copy of the applicable security measures by contacting us.