Privacy Policy
Last updated: 24 October 2026
This policy explains what data the FotoMeal app and the fotomeal.com website process, why, for how long, with whom, and what your rights are.
1. Who is responsible for your data
ICTLAB SRL (company number 0786.829.158) publishes FotoMeal and decides how the data described here is used. For any question or request: contact@fotomeal.com. The address of the registered office is in the legal notice. We have not appointed a data protection officer: the law does not require one for our activity.
2. Data we process, why and for how long
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Photo of a meal (photo scan) | To estimate calories and macros. The photo goes through our server, then is analysed by OpenAI. | Your consent, asked in the app before the first upload (Art. 6(1)(a)) | FotoMeal does not store it: it is used for the time of the analysis. OpenAI may keep it for up to 30 days, only to detect abuse. |
| Food journal (foods, calories, macros, dates, goal) | Your day-to-day tracking. | Not transmitted: this data stays on your phone | Until you delete it or delete the app. We have no access to it. |
| Account: an anonymous identifier created at first launch, or an email and password if you create an account | To recognise you on our server and protect the photo scan from abuse. | Performance of the contract (Art. 6(1)(b)) | Until the account is deleted, which you can do from the app. The password is only kept in hashed form. |
| Scan counter (account identifier, date, number of analyses that day) | To limit the number of analyses per day. | Legitimate interest: preventing abuse and keeping the cost of the service under control (Art. 6(1)(f)) | Until the account is deleted. |
| Subscription (purchase identifier, Premium status, purchase history) | To unlock and manage Premium. Payment goes through Apple or Google: we never see your payment method. | Performance of the contract (Art. 6(1)(b)) and accounting obligations (Art. 6(1)(c)) | For the length of the subscription, then for the period the law requires for accounting. |
| Scanned barcode or food search | To find the product in Open Food Facts. | Performance of the contract (Art. 6(1)(b)) | Sent directly from your phone to Open Food Facts, with your IP address. We do not receive it. |
| Visit to fotomeal.com (IP address, browser, page requested) | To show the website and protect it. | Legitimate interest: running and securing the website (Art. 6(1)(f)) | Technical logs kept for a limited time by our host. The website uses no cookies, no audience measurement and no trackers. |
| Email you send us | To answer you. | Legitimate interest: handling your request (Art. 6(1)(f)) | For the time needed to handle your request and follow up. |
Your journal can say a lot about your health: that is why it stays on your phone.
3. What we do not do
- ❌ No ads, no advertising trackers.
- ❌ No marketing push notifications.
- ❌ No sale of personal data.
- ❌ Your photos are not used to train the AI.
- ❌ No automated decision about you: the AI estimate is a suggestion you are free to correct.
4. Who receives data
Our service providers, which process data on our behalf and on our instructions:
- Supabase (United States): the app's server, accounts and scan counter.
- OpenAI (United States): photo analysis. OpenAI may keep the image for up to 30 days, only to detect abuse, and does not use it to train its models.
- RevenueCat (United States): subscription management.
- Vercel (United States): hosting of the fotomeal.com website.
Services that decide for themselves how data is used, under their own policies:
- Apple and Google: app download and subscription payment.
- Open Food Facts (non-profit, France): public food database queried by barcode or search.
5. Transfers outside the European Union
Supabase, OpenAI, RevenueCat and Vercel are American companies: data may be processed in the United States. These transfers rely on the safeguards provided by the GDPR: the EU-U.S. Data Privacy Framework for providers certified under it, otherwise the European Commission's standard contractual clauses. You can ask us for the details.
6. Your rights
At any time, you can:
- access your data and get a copy of it;
- have it corrected;
- have it erased: delete your account from the app, and your journal by deleting its entries or the app;
- ask for the processing to be restricted;
- receive your data in a machine-readable format (portability);
- object to processing based on our legitimate interest;
- withdraw your consent to photo analysis: no photo is sent unless you start a scan, so simply stop using the photo scan. Withdrawing does not affect analyses already made.
Write to us at contact@fotomeal.com: we answer within one month. If you believe your rights are not respected, you can lodge a complaint with the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be.
7. Security
Exchanges between the app, our server and our providers are encrypted. The access key to the AI service stays on our server: it is never present in the app.
8. Changes
If this policy changes, the date at the top of this page changes too.