Privacy & data
Privacy notice
Updated September 7, 2026
Contact the app operator
Use the form below to contact the KnowGula publisher about privacy or request the legal controller’s identity, address and processing arrangements. Controller identification and provider details require confirmation by the publisher; this notice is not a certification of compliance.
Manage account and scan dataWhat this app processes
KnowGula processes your account email and profile settings, food photos, estimated nutrients and food scores, journal timestamps, and subscription references. Food estimates linked to a person may reveal sensitive health information, even when no medical measurements are collected. We do not import CGM readings, blood tests or insulin records.
Why processing happens
Account administration and requested subscription services require information to deliver the service. Before food analysis, we ask for explicit consent to process potentially sensitive dietary information for analysis and, when signed in, to save the result. Declining does not prevent reading this notice or managing an existing account. Withdrawing consent stops new scans; it does not retroactively invalidate earlier processing. Optional marketing or research requires a separate appropriate basis.
Photos and AI services
New photos are uploaded to private storage and temporarily made accessible through signed links for AI analysis. Photos are re-encoded before upload to remove embedded metadata. Avoid faces, documents or other personal details. Private storage does not mean end-to-end encryption: the hosting and AI services must process the content. We do not promise that providers retain no copies or that model output is clinically accurate.
Service providers
The app uses Base44 for hosting, authentication, storage and AI integrations; Stripe for subscription payments; and hCaptcha for abuse prevention. These services process information needed for their role. hCaptcha can receive IP and device information. Provider locations, processing agreements, subprocessors and retention arrangements must be confirmed with the operator before relying on this app for regulated health workflows.
Browser storage and security logs
The app uses browser storage for language, appearance and checkout preferences. Scanning requires sign-in, and the free daily allowance is checked against the authenticated account. Anonymous IP-based scanning is no longer available; legacy hashed-IP usage logs may remain until deleted. Hosting, authentication, payment and security providers may keep operational logs. This version does not add optional advertising pixels or marketing analytics.
Retention and deletion
Account and scan records are retained until removed or an erasure request is processed, subject to applicable legal obligations. Deleting scan records in Settings removes journal entries but does not automatically remove uploaded files, operational logs, backups or provider copies. Legacy uploads may have used public storage. An account-erasure request is recorded for operator review and is not a claim of immediate deletion. Ask for confirmation of file removal and any retention exceptions.
Your rights
Depending on applicable law, you may request access, correction, erasure, restriction, portability and objection, and withdraw consent. Settings provides a machine-readable export of account and scan records. Use the contact form for complete access requests, correcting records or provider-held data; delete an inaccurate scan if preferred. GDPR requests are normally answered within one month, with legally permitted extensions explained. You can complain to your competent data protection authority.
International processing and security
Ask the operator about processing locations and the applicable safeguards for transfers outside the EEA. This notice does not certify particular encryption algorithms, provider certifications, signed agreements or penetration-testing schedules. No system can guarantee absolute security. Report suspected security issues privately using the form below; do not include other users’ records.
Incidents and children
Where GDPR requires it, the operator must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a qualifying personal-data breach. Affected individuals must be informed without undue delay when the breach is likely to result in a high risk, subject to statutory exceptions. The scan service is intended for people aged 16 and over, not for children’s medical management.
Important limitations
KnowGula offers educational food estimates, not medical diagnosis, treatment or blood measurements. It does not claim HIPAA certification or coverage by Business Associate Agreements. Applicable legal obligations depend on the operator, intended use, jurisdiction and actual processing—not a disclaimer. Material changes to processing require an updated notice and, where appropriate, renewed consent.
Privacy requests & security reports
Do not include food photos, medical records, passwords or payment details. Tell us which right you wish to exercise.
Sign in before sending a privacy request or security report.