Privacy Policy

This Privacy Policy is issued by the legal entity that operates the iNutrio application. All references to "iNutrio", "we", "us", or "our" in this document refer to BITRY LTD.

Governing Law

BITRY LTD is incorporated in England and Wales and is subject to the laws of the United Kingdom, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a UK-registered company providing services to US users, we also comply with applicable US federal and state privacy laws, including the California Consumer Privacy Act (CCPA) and COPPA.

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts of England and Wales, except where mandatory local consumer protection laws in the user's jurisdiction require otherwise.

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 What We Do NOT Collect

• We do not collect your precise GPS location
• We do not access your camera or photo library without explicit user action
• We do not collect payment card numbers (handled by Apple Pay / Google Pay)
• We do not sell personal data to data brokers or ad networks
• We do not collect data from users under 13 years of age
• We do not collect social security numbers or government IDs

3.1 Health Data We Process

• Body metrics: Height, weight, age, and weight change over time
• Dietary needs: Allergies, food intolerances, dietary restrictions (e.g., gluten-free, diabetic-friendly)
• Health goals: Weight loss/gain targets, calorie targets derived from TDEE calculation
• Nutrition logs: Daily food intake and calorie consumption records
• Voluntarily disclosed medical context: If you select "Manage a Condition" (e.g., diabetes, high cholesterol) — used solely to personalise meal suggestions

3.2 Legal Basis for Processing Health Data

Under UK GDPR Article 9, we process special category health data on the basis of your explicit consent (Article 9(2)(a)). You provide this consent when you complete the onboarding flow and input your health information. You may withdraw consent at any time by deleting your account.

3.3 How We Protect Health Data

• Stored in Firebase Firestore with strict server-side security rules — only authenticated users can access their own data
• All transmissions use TLS 1.3 encryption
• Data sent to OpenAI for meal plan generation is pseudonymised — we send profile attributes, not your name or email
• Health data is never shared with insurers, employers, lenders, or data brokers
• Health data is never used to train AI models without separate explicit consent

3.4 Medical Disclaimer

3.5 Apple Health / Google Fit (Optional)

If you choose to connect Apple Health or Google Fit, we may read weight data to keep your plan accurate. This is entirely optional, requires your explicit device-level permission, and can be disconnected at any time from your device's Health settings. We do not write data back to Health platforms without your knowledge.

What We Will Never Do With Your Data

• Sell your personal information to any third party
• Share your health data with insurance companies, employers, or lenders
• Use your data for political profiling or targeting
• Share individual user data with advertisers (only aggregated, anonymised statistics)
• Use your AI chat messages for any purpose beyond generating your response
• Transfer your data to any country without adequate legal safeguards

BITRY LTD uses the following trusted sub-processors and third-party services to operate iNutrio. We share only the minimum data necessary and have Data Processing Agreements (DPAs) or equivalent contractual safeguards in place with each.

BITRY LTD does not sell, rent, or trade your personal information. We share data only in the following strictly limited circumstances:

6.1 Sub-Processors (Service Providers)

We share data with the third-party vendors listed in Section 5, solely to operate iNutrio. Each vendor is bound by a Data Processing Agreement (DPA) or equivalent contractual mechanism, prohibiting them from using your data for any other purpose.

6.2 Legal Requirements

We may disclose your data if required by law, court order, or lawful request by public authorities. This includes:

• Compliance with a legal obligation under UK, EU, or US law
• Requests from law enforcement with appropriate legal authority
• Protecting the rights, property, or safety of BITRY LTD, our users, or the public

Where legally permitted, we will notify you of such requests before complying.

6.3 Business Transfers

If BITRY LTD undergoes a merger, acquisition, restructuring, or insolvency proceeding, your personal data may be transferred to the acquiring entity. We will provide at least 30 days' advance notice via email and/or in-app notification. You will have the right to delete your account before any such transfer takes effect.

6.4 Aggregated & Anonymised Data

We may share aggregated, anonymised statistics (e.g., "65% of users prefer high-protein plans") with business partners or the public. This data cannot be reverse-engineered to identify individual users.

6.5 With Your Explicit Consent

Where you use our in-app share feature to post your meal plan or progress to social media, you consent to that specific disclosure. Shared content includes a "Generated by iNutrio" watermark. You control what is shared and when.

How to Delete Your Account & Data

You can permanently delete your account through two methods:

• In-app (fastest): Profile → Settings → Delete Account → Confirm deletion
• By email: Send a request to ceo.bitry.io@gmail.com with subject line "Account Deletion Request" from your registered email address

Upon confirmed deletion, all personal data is permanently removed from active systems within 30 days. Financial records required for UK tax compliance are retained for 7 years in anonymised form.

How to Exercise Your Rights

Most controls are available in-app under Profile → Settings. For formal data requests, email ceo.bitry.io@gmail.com. BITRY LTD will respond within 30 days (extendable to 60 days for complex requests, with notice).

We may need to verify your identity before fulfilling requests. We will never charge a fee for reasonable requests.

Notification Controls

• In-app: Profile → Settings → Notifications
• Device-level: Settings → Apps → iNutrio → Notifications (Android) or Settings → Notifications → iNutrio (iOS)

Advertising Opt-Out

• Android 13+: Settings → Privacy → Ads → Delete advertising ID
• iOS 14.5+: Settings → Privacy & Security → Tracking → Disable "Allow Apps to Request to Track"
• Upgrade to PRO: PRO subscribers are completely excluded from all advertising data collection

BITRY LTD does not knowingly collect personal information from children under 13 years of age. We comply with the US Children's Online Privacy Protection Act (COPPA). iNutrio is not marketed to or designed for children under 13.

During onboarding, users provide their age. If a user indicates they are under 13, the app will:

• Immediately block account creation
• Discard all data entered in that session without saving
• Display a clear age restriction notice

If we become aware that we have inadvertently collected data from a child under 13, we will delete that data promptly. Parents or guardians who believe a child under 13 has registered should contact us immediately at ceo.bitry.io@gmail.com.

Users Aged 13–17

For teenage users, we recommend parental involvement. Parents may request to review, modify, or delete their minor child's account data by contacting ceo.bitry.io@gmail.com with documentation establishing the parental relationship.

Technical Safeguards

• Encryption in transit: TLS 1.3 for all data between app and servers
• Encryption at rest: Firebase Firestore uses AES-256 encryption at rest
• Authentication: Firebase Authentication with secure session tokens; no passwords stored by BITRY LTD
• Firestore Security Rules: Server-side database rules enforce that users can only access their own data — not client-side only
• API Security: OpenAI API calls are made server-to-server via Firebase Cloud Functions — API keys are never exposed in the mobile app binary
• No plaintext passwords: Firebase Authentication handles all credential management

Organisational Safeguards

• Access to production data is restricted on a strict need-to-know basis
• All sub-processors are bound by Data Processing Agreements
• Regular review of Firebase security rules and API configurations

Data Breach Notification

In the event of a personal data breach that poses a risk to users' rights and freedoms, BITRY LTD will:

• Report the breach to the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware, as required by UK GDPR Article 33
• Notify affected users without undue delay where the breach is likely to result in high risk to their rights
• Notification will be sent to the email address registered on your account

Legal Basis for UK → US Transfers

The United Kingdom is not in the EU post-Brexit, but the UK GDPR imposes similar transfer restrictions. The United States does not have a blanket UK adequacy decision. We rely on the following mechanisms for lawful transfer:

• UK International Data Transfer Agreements (IDTAs): Our agreements with Firebase (Google), OpenAI, and RevenueCat incorporate UK-approved IDTAs or the UK Addendum to the EU Standard Contractual Clauses, which are the appropriate transfer mechanism post-Brexit
• UK-US Data Bridge: Where applicable, we rely on the UK Extension to the EU-US Data Privacy Framework for transfers to certified US organisations
• Adequacy: For transfers to other countries where the UK has issued an adequacy regulation, we rely on that adequacy finding

Firebase Infrastructure

Firebase data centres are certified under ISO 27001, SOC 1, SOC 2, and SOC 3 standards, providing strong independent assurance of data protection practices. Google's Data Processing Terms include the UK IDTA.

Your Rights Regarding Transfers

You may request details of the specific transfer mechanisms we use for any particular sub-processor by contacting ceo.bitry.io@gmail.com. You may also request a copy of the relevant contractual safeguards.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional privacy rights. These rights are in addition to the general rights described in Section 8.

Your CCPA/CPRA Rights

• Right to Know: Know what personal information we collect, use, and disclose, including the specific pieces of information collected
• Right to Delete: Request deletion of personal information we have collected
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: Opt out of the sale or sharing of personal information for cross-context behavioural advertising
• Right to Limit Sensitive Personal Information: Limit use of sensitive personal information (including health data) to necessary purposes
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising CCPA rights

Do Not Sell or Share My Personal Information

BITRY LTD does not sell your personal information. BITRY LTD does not share your personal information for cross-context behavioural advertising. You do not need to submit an opt-out request — we do not engage in these practices.

Personal Information Categories Collected (Past 12 Months)

Submitting a CCPA Request

California residents may submit requests by emailing ceo.bitry.io@gmail.com with subject "CCPA Privacy Request". We will respond within 45 days (extendable to 90 days with notice). We will verify your identity before processing requests. Requests are free of charge (up to two per 12-month period).

UK GDPR Rights Summary

Under the UK GDPR and Data Protection Act 2018, you have the rights listed in Section 8 of this policy (access, rectification, erasure, portability, objection, restriction, withdraw consent). These rights are enforceable against BITRY LTD as the data controller.

Data Controller

BITRY LTD is the data controller for all personal data processed in connection with iNutrio. BITRY LTD is registered/required to register with the UK Information Commissioner's Office (ICO) as a data controller.

Legal Bases for Processing (UK GDPR Article 6 & 9)

• Article 6(1)(b) — Contract: Processing necessary to provide the meal planning service you signed up for
• Article 6(1)(a) — Consent: Push notifications, advertising, health data
• Article 6(1)(f) — Legitimate Interests: Product analytics, fraud prevention, security (balanced against your rights)
• Article 6(1)(c) — Legal Obligation: Tax and financial record retention under UK law
• Article 9(2)(a) — Explicit Consent: Special category health data processing

Right to Lodge a Complaint

If you believe BITRY LTD has not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the UK supervisory authority:

We encourage you to contact us first at ceo.bitry.io@gmail.com — we aim to resolve all privacy concerns directly and promptly.

BITRY LTD may update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. When changes are made:

• The "Last Updated" date at the top of this page will be revised
• Material changes (those that significantly affect your rights or how we use your data): we will notify you via push notification and/or prominent in-app banner at least 7 days before the changes take effect
• Minor changes (clarifications, typo corrections, new sub-processor additions): we will update this page without separate notification, but the "Last Updated" date will change
• Previous versions of this policy are available on request by emailing ceo.bitry.io@gmail.com

Your continued use of iNutrio after the effective date constitutes acceptance of the updated policy. If you do not agree, you may delete your account before changes take effect.

Version History

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact BITRY LTD:

Registered Company Details

Quick Request Links

UK Supervisory Authority

If you are not satisfied with our response to a privacy concern, you have the right to contact the UK Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113.