At a glance.
- You give us your email, a password, and photos / descriptions of your meals. We use these to give you AI-generated nutritional feedback and a daily score.
- Your photos and descriptions are stored by us in the UK / EU, on AWS, and analysed by OpenAI under their API business terms - not used to train OpenAI's models.
- We do not sell your personal data, do not share it with advertisers, and do not use it to train any AI model.
- You can export your data from Profile → Export, delete your account from Profile → Delete account, and contact our Data Protection Officer at privacy@aliqa.app.
- Your health data belongs to you, not to us.
- The score Aliqa shows you is AI-generated and approximate. You can edit any meal in the App and the score will recompute - that is your right to human review of automated decisions under UK GDPR Article 22.
This Policy covers the Aliqa Food-Log iOS app, the universal-link host at app.aliqa.app, the auth SPA at login.aliqa.app, and the marketing site at www.aliqa.app. It is written to satisfy:
This Policy is published in English; the English version is the legally governing version.
The data controller for the Service is Agile Projects Ltd, a company registered in England and Wales, trading as "Aliqa". Our registered office is at Langley House, 53 Theobald Street, Borehamwood, England, WD6 4RT, United Kingdom; you can reach the privacy team at privacy@aliqa.app (privacy-specific) or support@aliqa.app (general).
| Role | Contact |
|---|---|
| UK / EU privacy team (and Article 27 representative if later required) | privacy@aliqa.app |
| Data Protection Officer (appointed voluntarily, given that we process special-category health data on a structured basis) | privacy@aliqa.app, addressed to "Aliqa DPO" |
| Singapore PDPA Data Protection Officer under Section 11 of the PDPA | privacy@aliqa.app, addressed to "Aliqa DPO" |
| California CCPA / CPRA contact | privacy@aliqa.app |
We organise the personal data we hold about you into Default data (necessary to operate the Service for you) and Optional data (only if you choose to provide it).
| Data | Purpose | Lawful basis (UK / EU GDPR) |
|---|---|---|
| Email address | Account identity, login, transactional email, password reset | Contract performance - Art. 6(1)(b) |
| Password (stored as a bcrypt hash; never in plaintext) | Authenticate you | Contract performance - Art. 6(1)(b) |
| Time zone, language preference | Show the day boundary correctly, localise the UI | Contract performance - Art. 6(1)(b) |
| Legal-acceptance record (verbatim disclaimer text, Terms / Privacy / disclaimer version, age-attestation timestamp) | Evidence of informed consent | Legal obligation - Art. 6(1)(c); legitimate interests - Art. 6(1)(f) |
| Sign-up code (if used) | Controlled beta access | Contract performance - Art. 6(1)(b) |
| Admin scopes (internal staff only) | Administrative authorisation | Legitimate interests - Art. 6(1)(f) |
The food-log data set inevitably reveals information about your diet, eating habits, and inferred metabolic patterns. Under UK GDPR / EU GDPR Article 9, dietary data combined with the AI-generated daily score is treated as data concerning health because, taken together, it can suggest a health condition or wellbeing trajectory. We therefore process this data only with your explicit consent under Article 9(2)(a) at signup.
| Data | Purpose | Lawful basis |
|---|---|---|
| Meal photos you upload | Input to the AI pipeline; your visible meal history | Article 6(1)(b) contract + Article 9(2)(a) explicit consent |
| Manual meal descriptions and corrections | Input to the AI pipeline; your editable record | Article 6(1)(b) + Article 9(2)(a) |
| AI-generated food items, tags, portion descriptors | Core output. You can edit any of these at any time; day scores recompute on edit. This is how we satisfy the right to contest an automated decision under UK GDPR Article 22. | Article 6(1)(b) + Article 9(2)(a) |
| AI-generated daily scores, weekly reviews, recommendations | Provide the Service | Article 6(1)(b) + Article 9(2)(a) |
| Clarification questions and your answers | Improve accuracy of the analysis for the meal you logged | Article 6(1)(b) + Article 9(2)(a) |
| Frequent-foods / meal-guide preferences | Personalise the experience | Article 6(1)(b) |
| Streaks, badges, daily-score history | Engagement features | Article 6(1)(b) |
You can withdraw your Article 9 consent at any time by deleting the relevant content (or your account) in Profile → Delete. Withdrawal does not affect the lawfulness of processing before withdrawal.
Push-notification tokens (APNs) if you opt in; email preferences (weekly review, daily score, meal reminders). We send transactional email (verification, password reset, weekly review, trial-end reminder, renewal reminder) to fulfil the contract. You can disable optional notifications in Profile → Notifications and Profile → Emails.
| Data | Purpose | Lawful basis |
|---|---|---|
| APNs push token | Deliver opted-in notifications | Consent - Art. 6(1)(a); UK PECR; EU ePrivacy Directive |
| Marketing email opt-in | Send product updates if you opted in | Consent - Art. 6(1)(a) |
| Transactional email (verification, password reset, billing reminders) | Fulfil the contract / comply with consumer-law reminder duties | Contract - Art. 6(1)(b); legal obligation - Art. 6(1)(c) |
When you subscribe through the Apple App Store, Apple processes the payment. We do not receive your credit-card number or full payment details. Apple shares with us a subscription status (active / trial / expired / cancelled), a receipt / transaction identifier tied to your Apple ID, and billing-lifecycle events (renewal, cancellation, refund, billing issue). We keep these so we know whether to grant you access. Lawful basis: contract performance - Art. 6(1)(b); legal obligation (tax / accounting) - Art. 6(1)(c).
| Data | Purpose | Lawful basis |
|---|---|---|
| IP address, approximate region (recorded at our API gateway for a short period) | Security, abuse prevention, geo-routing | Legitimate interests - Art. 6(1)(f) |
| App version, OS version, device model | Support and crash diagnosis | Legitimate interests - Art. 6(1)(f) |
| Endpoint, latency, AI token-cost telemetry (no payload) | Operate the Service efficiently | Legitimate interests - Art. 6(1)(f) |
We keep a short audit record of data-export and account-deletion events to evidence compliance.
Photos taken by your phone may contain EXIF metadata - including GPS coordinates, capture time, and device model. Our App strips GPS coordinates from photos before they leave your device; we keep the capture timestamp because it is needed to assign a meal to the correct day. If you upload a photo that we detect is not a photo of food or drink, we may delete it without notice, in line with §6 of our Terms of Use.
We work with a small number of sub-processors. Each is bound by a written data-processing agreement (UK GDPR Article 28, equivalent EU/EEA, PDPA Section 26).
| Sub-processor | Country of establishment | Activity | Data categories | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | Luxembourg (operations in UK / EU regions) | Hosting, RDS database, S3 meal-image storage, API gateway logging | Account data, food-log data, photos, technical logs | Stored in UK / EU; no transfer outside UK / EEA in the default flow |
| OpenAI Ireland Limited (and OpenAI OpCo, LLC for API processing) | Ireland / United States | Vision analysis (GPT-4.1 mini), tagger, scoring, weekly-review text generation. API only - OpenAI does not train its models on API inputs or outputs by default. | Photos and meal descriptions; AI prompt/response content; an internal user identifier (not your email) | EU‑US Data Privacy Framework; SCCs (2021/914) + UK IDTA Addendum |
| Apple Distribution International Limited | Ireland (App Store EU); USA (APNs) | App Store delivery, StoreKit billing, Sign in with Apple (if used), push notifications via APNs | Apple ID transaction identifier, push token | Apple-controlled; Apple's own Privacy Policy applies to data Apple holds about you |
| Transactional email provider | UK / EU | Sends verification, password reset, weekly review, trial-end and renewal reminders | Email address, message content, delivery telemetry | Stored in UK / EU |
A change to this list is a material change to this Policy; we will notify you in advance under §10.
We may also disclose limited information to: professional advisers (lawyers, accountants, auditors) under confidentiality; public authorities if required by law or to protect rights, property, or safety; or a successor entity in a merger, acquisition, or insolvency (your rights will not be materially reduced).
We do not share your personal data with advertisers, data brokers, or any third party for their own marketing purposes.
| Category | Retention |
|---|---|
| Account record (email, preferences) | Until you delete your account, plus 30 days disaster-recovery window |
| Meal photos (S3) and food entries (DB) | Until you delete them, or within 30 days of account deletion |
| AI analyses, day scores, weekly reviews | Same as the underlying meal |
| Clarification tasks, reprocess jobs | Until completed or abandoned, then 90 days |
| Transactional-email delivery logs | 30 days |
| API access logs | 30–90 days (security) |
| Marketing email preferences (where you opted in) | Until you opt out, plus 30 days |
| Push-notification token | Until invalidated by Apple, or until you opt out |
| Billing records received from Apple | 7 years (UK / EU tax & accounting) |
| Data-export / deletion audit records | 2 years |
| Inactivity rule | If your account has had no activity for 10 years, we will delete or fully anonymise it on a routine basis. |
Aggregated, fully anonymised statistics (from which you cannot be re-identified, even by combination with other data we hold) may be kept indefinitely to improve the Service. We treat pseudonymised data (data linked to an internal user ID but stripped of direct identifiers) as personal data and apply the retention rules above.
Wherever you live, we will honour the following requests to the extent we reasonably can:
We will respond within 30 days (extendable by a further two months for complex requests, with notice). We may need to verify your identity before responding. If we refuse or restrict your request, we will tell you why and how to complain. You can complain to your local data-protection authority - see §6.2.
If you are in Singapore, Agile Projects Ltd is the organisation responsible for your personal data under the PDPA. You have an access right (Section 21), a correction right (Section 22), and the right to withdraw consent to processing that relied on consent. You can complain to the Personal Data Protection Commission (pdpc.gov.sg). PDPA contact: privacy@aliqa.app (addressed to "Aliqa DPO"), Agile Projects Ltd, Langley House, 53 Theobald Street, Borehamwood, England, WD6 4RT, United Kingdom.
Local supervisory authorities: UK - the Information Commissioner's Office; France - the CNIL; other EEA states - your national supervisory authority. French users can exercise their right to give post-mortem instructions regarding their personal data under Article 85 of the French Loi Informatique et Libertés; contact privacy@aliqa.app.
You have rights under the CCPA / CPRA including the right to know, to delete, to correct, and to opt out of "sale" or "sharing". We do not sell or share personal information within the CCPA's meaning. Exercise rights at privacy@aliqa.app. We will not discriminate against you for exercising them. We honour the Global Privacy Control signal sent by your browser as a request to opt out of any future "sharing".
The Service is not directed to children under 18 and we do not knowingly collect data from them. At sign-up we ask you to confirm you are at least 18. If you believe a child has signed up, email privacy@aliqa.app and we will remove the account.
We commit reasonable, industry-standard technical and organisational measures to protect your personal data, but no internet service can be guaranteed completely secure.
The marketing site www.aliqa.app uses Google Analytics 4 for aggregate traffic measurement only after you opt in via the consent banner; the default is reject all. The auth SPA and product SPAs use localStorage and a root-domain cookie on .aliqa.app for authentication - these are strictly necessary to keep you logged in across our subdomains. The iOS app does not set browser cookies; auth tokens are kept in the iOS Keychain. See our separate Cookies notice for the full list.
Our primary infrastructure is in the UK / EU. Limited transfers to the United States occur for: meal analysis by OpenAI (the AI sub-processor that powers the vision, tagging, scoring, and weekly-review steps); delivery by Apple (App Store, APNs, StoreKit); and some support tooling.
| Region | Transfer safeguard |
|---|---|
| UK | UK Government data-bridge for the EU‑US Data Privacy Framework; UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses; or the standalone UK IDTA |
| EEA / France | EU‑US Data Privacy Framework; Standard Contractual Clauses (Module 2 / Module 3 as applicable); supplementary measures (encryption, identifier minimisation) |
| Singapore | PDPA's transfer-limitation obligation (Section 26), met through written contracts with each sub-processor requiring a standard of protection comparable to that under the PDPA |
| Other countries | Data is processed by the sub-processors listed in §4; by using the Service you consent to the international transfer described here, to the extent consent is required in your country |
When you upload a meal photo or description we send it to OpenAI through the OpenAI API:
If you ever see an AI output you want a human to review, edit the meal in the App (see §6) or email privacy@aliqa.app.
We post the new version at /legal/privacy.html and update the "Effective" date. For material changes - for example a new sub-processor that materially changes where your data goes, a change of lawful basis, a change in retention periods, a change in your rights, or a change that adds AI training on your data - we will: give at least 30 days' advance notice in the App and by email; highlight what has changed; where required by law, ask you to re-accept at next sign-in; and give you a window to delete your account without penalty before the change takes effect.
We bump the version string on every change so you always know which wording you accepted.
Privacy questions and rights requests: privacy@aliqa.app. General support: support@aliqa.app. Postal: Agile Projects Ltd (Aliqa DPO), Langley House, 53 Theobald Street, Borehamwood, England, WD6 4RT, United Kingdom.
If you are not satisfied with our response, you can complain to: in the UK, the Information Commissioner's Office at ico.org.uk; in the EEA, your national supervisory authority (in France, the CNIL at cnil.fr); in Singapore, the Personal Data Protection Commission at pdpc.gov.sg; in California, the California Privacy Protection Agency at cppa.ca.gov.