Privacy Policy — Kcally
1. About
Kcally is operated by BCL ("Kcally," "we," "us," "our"). We build tools that help users understand calories, macros, and recipes from social videos and images, plan meals, and track goals. This Privacy Policy explains how we collect, use, share, and protect your personal data, and the rights you have.
If you are in the EU/EEA/UK, we process personal data in accordance with the GDPR/UK GDPR. For California residents, see the CCPA section.
Controller: BCL, 200 RUE DE LA CROIX NIVERT, 75015 PARIS France
Contact: sean@kcally.com
DPO (if appointed): sean@kcally.com
"Services" means our websites (kcally.com, app.kcally.com), web/mobile apps, APIs, and related online/offline offerings.
2. Scope
This Policy applies to personal data we process via the Services. It does not cover third-party sites/services we link to. Employee and contractor data are covered by a separate notice.
3. Data We Collect
A. Data you provide
Account & Profile: name, email, password, photo (optional), country, language, time zone.
Subscription & Billing: payments are processed by third parties (e.g., Stripe, Apple/Google for in-app). We don't store full card data. We may receive transaction metadata (payment status, last 4 digits, country).
Nutrition Inputs (may include health data): weight, height, age, gender, goals, diet preferences, ingredient dislikes/allergies, daily calorie target, plan dates; URLs of videos you submit; your chosen recipes/meals; grocery lists you generate.
Legal basis (EU): your explicit consent (Art. 9(2)(a)) for processing data that could indicate health (e.g., weight/goal). You can withdraw consent at any time in settings or by contacting us.
Communications & Support: email content, chat transcripts, call/video recordings (for support quality, if applicable), feedback, survey responses.
Community/Sharing: if you publish or share content (e.g., public recipe notes), it may be visible to others.
B. Data collected automatically
Technical & Usage: IP address, device identifiers, OS/browser, pages/screens viewed, features used, timestamps, crash logs, session duration, campaign parameters, and similar diagnostics.
Cookies & Similar Tech: cookies, local storage, pixels, SDKs for: essential operations, analytics, performance, and (where permitted) marketing. See Cookie Controls below.
C. Data from others
Auth/SSO providers (if enabled), app stores, analytics providers, fraud prevention.
4. Why We Use Your Data (Legal Bases)
Provide the Services (create/manage your account, run features like scan → macros/recipes, meal planner, grocery lists, reminders, device sync) — Contract; Legitimate interests.
Process payments, prevent fraud, recover debts — Contract; Legitimate interests; Legal obligation.
Support & service communications (transactional emails, security, service updates) — Contract; Legal obligation; Legitimate interests.
Research & product improvement (analytics, diagnostics, A/B testing) — Legitimate interests.
Marketing (news, offers similar to your subscription; or where required, consent) — Legitimate interests / Consent. You can opt out anytime.
Personalized content/ads (only where lawful and consented) — Consent.
Security, compliance, legal claims — Legal obligation; Legitimate interests.
Health-related features (calorie deficit calculator, goals) — Explicit consent (withdraw anytime).
5. Sharing Your Data
We share data only as needed:
Service providers / processors: hosting (e.g., AWS), analytics, email/SMS, payments (e.g., Stripe, Apple/Google), error logging, fraud prevention.
Business operations: accountants, auditors, legal and similar professionals under confidentiality.
If you choose to share: public profiles, community posts, shared plans/recipes.
Change of control: merger, acquisition, asset sale (with appropriate safeguards).
Legal & safety: to comply with law, protect rights/safety, or respond to lawful requests.
6. International Transfers
We may transfer data outside your country (including outside the EU/EEA/UK). Where required, we rely on:
- Adequacy decisions, and/or
- Standard Contractual Clauses (SCCs/UK IDTA) with supplementary measures.
You can request a copy of relevant SCCs via the contact above.
7. Retention
We keep data only as long as necessary for the purposes above, including legal/accounting requirements. Typical examples:
- Account data: life of account + up to 1 year.
- Billing records: up to 10 years (France).
- Support logs/analytics: 12–24 months (unless we need longer for security/legal reasons).
When no longer needed, we delete or irreversibly de-identify. You can request deletion at any time (see Your Rights).
8. Security
We use appropriate technical and organizational measures (encryption in transit, access controls, backups, monitoring). If we discover a breach affecting you, we'll notify you and regulators as required by law.
9. Your Choices & Rights
A. EU/UK Rights
You can request access, rectification, erasure, restriction, objection, and data portability. For health/special data, you can withdraw consent anytime. We'll verify identity and respond within legal timeframes. You may lodge a complaint with your Supervisory Authority (e.g., CNIL in France).
B. California (CCPA/CPRA)
You have rights to know/access, delete, correct, and opt out of sale/sharing, and not to be discriminated against for exercising rights. We do not knowingly sell personal information, including of minors under 16.
10. Children
Kcally is not directed to children under 13 (US) and under the digital consent age in your country (up to 16 in the EU). If we learn we collected data from a child in violation of law, we'll delete it. Parents may contact us to review/delete a child's data.
11. Cookies & Tracking
Use our Cookie Preferences to accept/decline non-essential cookies. Browser/DNT signals aren't consistently honored across providers; we rely on our consent tool for EU/UK users.
12. No Medical Advice
Kcally provides informational nutrition insights only. We don't provide medical, dietary, or fitness advice. Always consult a qualified professional for health decisions.
13. Changes
We may update this Policy. If we make material changes, we'll update the "Effective Date."