Privacy Policy

Karl: Kcal Tracker and Habits

1. Data Controller

OPCMEDIA UG (limited liability)
Fabrikzeile 21
95030 Hof
Germany

Represented by the Managing Director:
Ben Zeitzer

Email: info@opcmedia.de

2. General information on data processing

We take the protection of your personal data very seriously. Your data is processed in accordance with the General Data Protection Regulation (GDPR) and the applicable national data protection laws. Personal data is any data that can be used to identify you personally.

The use of the app "Karl: Kcal Tracker and Habits" requires the creation of a user account.

3. Collection and processing of personal data

3.1 Registration and user account

A registration is required to use the app. The following data is collected: Email address and Password (stored encrypted).

Purpose: Provision of a user account
Legal basis: Art. 6 Para. 1 lit. b GDPR

3.2 Profile data

The following data can be provided voluntarily: Date of birth / Age, Gender, Body height.

Purpose: Personalization of app functions
Legal basis: Art. 6 Para. 1 lit. b GDPR

3.3 Health data (special categories of personal data)

The following data is processed as part of the use of the app: Body weight and weight progress, Blood pressure values, Nutrition data (calories, meals, water intake), Fitness goals, Training logs, Habits.

These data constitute special categories of personal data pursuant to Art. 9 GDPR. The processing is carried out exclusively on the basis of your express consent according to Art. 9 Para. 2 lit. a GDPR. Without this consent, the use of the app is not possible.

3.4 Usage data

The following data can be processed when using the app: Activity level, App interactions.

Purpose: Ensuring and improving the functionality of the app
Legal basis: Art. 6 Para. 1 lit. f GDPR

3.5 AI Features (Artificial Intelligence) and Data Processing (OpenAI)

The app offers features based on artificial intelligence (e.g., the "Karl AI Coach" / AI Chat and automatic image analysis of meals).

To provide these features, we use the API of OpenAI (Provider: OpenAI Ireland Limited, Merrion House, 1-2 Merrion Street, Dublin 2, Ireland or OpenAI, L.L.C., 3180 18th St, San Francisco, CA 94110, USA).

  • Data Processing: When you use the AI chat, upload images for analysis, or use voice input for logging food and meals, the input data (chat content, photos, transcribed text) is transmitted to OpenAI to generate the response or analysis.
  • Anonymity: No personal identification data of yours (such as name, email address, password, or your app user ID) is transmitted to OpenAI. The transmission is anonymous or pseudonymous.
  • Use of Data by OpenAI: According to OpenAI's terms of use, data transmitted to OpenAI via the API is not used to train OpenAI models. The data is stored by OpenAI for abuse control purposes for a maximum of 30 days and then deleted.
  • Data Transfer to Third Countries: Processing of data may take place in the United States (USA). OpenAI ensures an adequate level of data protection by complying with the EU-U.S. Data Privacy Framework and/or through the use of EU Standard Contractual Clauses.
  • Legal Basis: The processing of this data is based on the performance of a contract (Art. 6 Para. 1 lit. b GDPR), as this processing is necessary to provide the AI functionality requested by you.

4. Hosting and contract processing

Our app uses Supabase as a backend service provider for hosting the database and authentication.

Server location: Frankfurt am Main (EU). A processing agreement has been concluded with Supabase in accordance with Art. 28 GDPR.

Legal basis: Art. 6 Para. 1 lit. b GDPR

5. Use of Google Fonts

This app uses Google Fonts, which are loaded from Google servers. Your IP address may be transmitted to Google during this process.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland

Legal basis: Art. 6 Para. 1 lit. f GDPR

6. App Permissions

  • Camera: Access to the camera is required for barcode scanner for food logging and AI photo analysis of meals. Access is only carried out during active use.
  • Microphone: Access to the microphone is required for voice input for logging food and meals (Speech-to-Text). Audio data is processed exclusively for conversion into text (transcription) and is not permanently stored on our servers.
  • Photos / Gallery: Access for selection of a profile picture.
  • Notifications: The app uses local notifications for reminders.

No transmission of photo, audio, or notification data to external servers occurs, unless explicitly noted otherwise (such as for AI analyses).

7. Data transfer

A transmission of personal data to third parties only occurs if this is necessary for contract fulfillment, a legal obligation exists, or you have given your express consent. Except for the processing by OpenAI described in Section 3.5, no transmission to third countries outside the EU occurs.

8. Storage period

Your personal data will be stored as long as your user account exists or legal retention obligations exist. After deletion of the account, your data will be deleted unless legal retention obligations prevent this.

9. Your rights

You have the right at any time to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) according to GDPR.

To exercise your rights, please contact: info@opcmedia.de

10. Withdrawal of your consent

You can withdraw your consent at any time with effect for the future.

11. Right to lodge a complaint with the supervisory authority

You have the right to complain to a data protection supervisory authority.

Competent authority: Bavarian State Office for Data Protection Supervision (BayLDA)

12. Data security

We use appropriate technical and organizational measures to protect your data from loss, misuse, or unauthorized access.

13. No automated decision-making

No automated decision-making according to Art. 22 GDPR takes place.