Домат AI

Privacy Policy

App: Domat AI (iPhone)
Effective date: November 15, 2026
Last updated: November 15, 2026

This policy explains what personal data we process when you use the Domat AI mobile app ("the app"), why and on what legal basis we do so, who we share the data with, how long we keep it and what rights you have. This policy has been prepared in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés).

The app is offered on the App Store in many countries and is available in Bulgarian and English. Where other data protection laws also apply to you (for example the UK GDPR in the United Kingdom), we give you the rights described in section 12 under those laws as well.

1. Data controller

The controller of your personal data is:

  • Name: VIEVO SAS (a French simplified joint-stock company)
  • Registration number (SIREN): 131 461 626, registered in the French National Business Register (RNE)
  • VAT number: FR59 131 461 626
  • Registered office and address: 689B rue Voltaire, 01220 Divonne-les-Bains, France
  • Email: support@domatai.app

In this policy, the controller is referred to as "we" or "us".

2. Summary

  • Domat AI estimates the calories and macronutrients in your food from a photo, a text description, a barcode or a nutrition label.
  • We process your health data (for example your weight and what you eat) only with your explicit consent, which you give during the app's initial setup.
  • Your profile, food diary and photos are stored in Google Firebase on servers in the European Union.
  • For analysis, the photo or description of your food is sent through our server to Anthropic (Claude API) in the United States.
  • When you scan a barcode, only the barcode is sent to Open Food Facts.
  • For subscription statistics we use Adapty: it receives your account identifier and your App Store purchase data, but not your photos, food diary or health data.
  • Apple Health data is read only on your device and is not uploaded to our servers.
  • We do not show ads, we do not track you across other companies' apps and websites, we do not use Firebase Analytics and we do not sell your data.
  • You can delete your account and all data linked to it directly in the app.

3. What data we process

3.1. Account data

You sign in to the app with Sign in with Apple, and accounts are managed with Firebase Authentication. We receive and store:

  • a unique user identifier linked to your Apple Account;
  • your name, if you choose to share it when signing in with Apple;
  • the date and the version of the text of the explicit consent to process your health data that you give during initial setup (section 4.2), so that we can show that you gave it.

We do not ask Apple for your email address, and we never receive your Apple Account password.

3.2. Answers during initial setup

During initial setup we ask you questions to calculate your daily goals and set up the app:

  • sex and date of birth;
  • height, current weight and goal weight;
  • your goal and the pace at which you want to reach it;
  • number of workouts per week;
  • diet type;
  • the obstacles you face and what you are aiming for;
  • how you heard about the app and whether you have tried other similar apps.

3.3. Calculated daily goals

Based on your answers, the app calculates a daily goal for calories and for macronutrients (protein, carbohydrates and fat).

3.4. Food diary

  • the food and drink entries you add — for example the description, estimated calories and macronutrients, date and time;
  • the photos of food and of nutrition labels that you take or choose in the app;
  • the text descriptions of food that you enter;
  • data about products you added by scanning a barcode.

3.5. Weight log

Your weight entries and the dates you made them.

3.6. Usage counters

The number of AI analyses you have made on a given day. We use them to apply daily limits and prevent abuse.

3.7. Apple Health data (optional)

If you turn this option on and allow access in iOS, the app reads your active energy burned from Apple Health and adds it to your daily calorie goal. This data is processed only on your device — it is not sent to our servers, to Anthropic or to any other third party. You can stop access at any time in the iOS privacy settings or in the Health app.

Neither the active energy value nor the daily goal adjusted with it is stored on our servers.

3.8. Subscription data

Subscriptions are purchased and paid for through Apple (App Store). We do not receive or store your bank card or other payment details. The app checks with Apple whether you have an active subscription.

Our server does not receive or store your subscription status or transaction identifiers. Subscription statistics are kept by Adapty (section 7).

3.9. Technical and security data

  • When the app connects to our server, Google, as our infrastructure provider, processes technical data — for example IP address, request time and error messages in system logs.
  • We use Firebase App Check together with Apple App Attest to verify that requests to our server come from the genuine app on a real Apple device. We use this check solely to protect against abuse and unauthorized access.

3.10. Correspondence with us

If you write to us, we process your email address and the content of your message in order to reply.

3.11. Health data

Some of the data listed above is health data within the meaning of Article 9 GDPR ("special categories of personal data"): height, current and goal weight, rate of weight change, number of workouts per week, diet type (to the extent it reveals information about your health), the food diary (including photos and descriptions), the weight log, the calculated daily goals and active energy from Apple Health. We process it only with your explicit consent (see section 4.2).

3.12. What we do not do

  • We do not collect your location data.
  • We do not collect the device's advertising identifier (IDFA) and we do not track you across other companies' apps and websites.
  • We do not show ads and we do not use Firebase Analytics in this version of the app.
  • We do not sell or rent your personal data.

4. Purposes and legal bases

4.1. Overview

Purpose Data Legal basis
Creating and maintaining your account, Sign in with Apple account data performance of our contract with you — the Terms of Use (Art. 6(1)(b) GDPR)
Calculating daily calorie and macronutrient goals setup answers, including health data for health data — your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR); for other data (e.g. sex, date of birth) — performance of the contract (Art. 6(1)(b) GDPR)
Showing that you gave explicit consent for health data date and version of the consent text legal obligation to be able to demonstrate consent (Art. 7(1) and Art. 6(1)(c) GDPR)
Checking the minimum age (16) date of birth performance of the contract (Art. 6(1)(b) GDPR)
Keeping the food diary and weight log entries, photos, descriptions, weight your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR)
AI analysis of a photo or text description of food the photo or text you send for analysis your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR)
Looking up a product by barcode the barcode performance of the contract (Art. 6(1)(b) GDPR)
Adding active energy from Apple Health to the daily goal (on the device only) active energy your explicit consent and the permission you grant in iOS (Art. 9(2)(a) GDPR)
Providing the subscription and checking whether it is active subscription status performance of the contract (Art. 6(1)(b) GDPR)
Subscription statistics (trials, payments, renewals, cancellations) via Adapty account identifier, App Store purchase data, technical device data our legitimate interest in understanding how the business is doing and improving our offer (Art. 6(1)(f) GDPR)
Daily limits on AI analyses usage counters performance of the contract and our legitimate interest in ensuring fair use, stable operation and protection against abuse (Art. 6(1)(b) and (f) GDPR)
Security of the service, App Check, system logs technical data our legitimate interest in protecting the service and your data (Art. 6(1)(f) GDPR)
Understanding how users hear about us and how to improve the app how you heard about the app, whether you have tried other apps our legitimate interest in developing the product (Art. 6(1)(f) GDPR)
Answering enquiries and handling requests to exercise your rights correspondence performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR)
Complying with legal obligations and defending legal claims the data needed for that purpose legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR)

4.2. Explicit consent for health data

During initial setup we ask for your explicit consent to process your health data, including sending photos and descriptions of your food to Anthropic for AI analysis. You give consent with a separate checkbox that is not pre-ticked.

You can withdraw your consent at any time by deleting your account in the app or by writing to us at support@domatai.app. Because the app cannot work without health data, withdrawing consent means deleting your account and all data linked to it. Withdrawal does not affect the lawfulness of processing before it.

4.3. Do you have to provide the data?

Providing the data is voluntary. However, without account data, setup answers and consent to process health data, we cannot calculate your daily goals, keep your diary or analyze your food — that is, we cannot provide the service. Access to Apple Health is optional; the app works without it.

4.4. Automated processing

Daily goals and food estimates are calculated automatically. They are a guide for you and do not constitute automated decision-making within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

4.5. Legitimate interest

Where we process data on the basis of legitimate interest, we have assessed in advance that it does not override your interests, rights and freedoms. You can object to such processing (see section 12).

5. AI food analysis (Anthropic)

When you ask for an analysis of a photo or text description of food, the app sends the photo or text to our server (Google Cloud Functions, region europe-west3, Frankfurt, Germany), and from there to Anthropic's Claude API. The model returns an approximate estimate of calories and macronutrients, which we show in the app.

  • We send the photo or text needed for the analysis, plus the app's language (Bulgarian or English) so that you get the result in that language. We do not send your name, your account identifier or any other data that identifies you to Anthropic.
  • Anthropic processes the data on our behalf as a processor, under a data processing agreement.
  • Anthropic's servers are located in the United States. The terms of the transfer are described in section 8.
  • [FILL IN (legal fact): how long Anthropic retains API inputs and outputs, and whether it uses them to train models — according to the current commercial terms and the data processing agreement with Anthropic.]

Please do not photograph faces, documents or other personal information unrelated to food.

6. Barcode scanning (Open Food Facts)

When you scan a barcode, only the product's barcode is sent to the Open Food Facts database. We do not send your name, email or other account data. As with any internet request, Open Food Facts technically receives the IP address the request was sent from.

Product data from Open Food Facts is made available under the Open Database License (ODbL). More information: https://world.openfoodfacts.org.

7. Recipients of the data

We share data only to the extent necessary for the purposes in section 4:

  • Google (Firebase and Google Cloud) — processor acting on our behalf. We use Firebase Authentication (accounts), Cloud Firestore (database, eur3 multi-region location in Europe), Cloud Storage and Cloud Functions (region europe-west3, Frankfurt, Germany), and Firebase App Check. Privacy policy: https://policies.google.com/privacy and https://firebase.google.com/support/privacy.
  • Anthropic — processor acting on our behalf for the AI food analysis (section 5). Privacy policy: https://www.anthropic.com/legal/privacy.
  • Apple — independent controller for Sign in with Apple, App Store payments, Apple App Attest and Apple Health on your device. Privacy policy: https://www.apple.com/legal/privacy/.
  • Open Food Facts — receives only the barcode of the scanned product (section 6).
  • Adapty ([FILL IN (legal fact): the legal entity in the data processing agreement, e.g. Adapty Tech Inc., USA]) — processor acting on our behalf for subscription statistics (trials, payments, renewals, cancellations and refunds). It receives your account identifier, information about your App Store subscriptions and purchases, and technical device data (for example model, iOS version, language and IP address). It does not receive photos, your food diary or health data. Privacy policy: https://adapty.io/privacy.
  • Public authorities — where we are legally required to provide data (for example at the request of a court or a competent authority).
  • Successor — in the event of a reorganization or transfer of our business, provided that your data continues to be processed in accordance with this policy.

We do not sell your personal data or provide it for advertising purposes.

8. Transfers of data outside the European Union

The app's database, photos and server functions are located in the European Union. If you use the app outside the EU, your data is transferred to these servers in the EU.

  • Anthropic (USA). Photos and texts for AI analysis are transferred to the United States. The transfer is based on the standard contractual clauses approved by the European Commission (Art. 46 GDPR) and/or on a European Commission adequacy decision where the recipient is certified under the relevant framework (Art. 45 GDPR). [FILL IN (legal fact): state the mechanism provided for in the data processing agreement with Anthropic.]
  • Adapty (USA). Subscription data is transferred to the United States based on the standard contractual clauses approved by the European Commission (Art. 46 GDPR). [FILL IN (legal fact): confirm the mechanism in the data processing agreement with Adapty.]
  • Google. Firebase Authentication and Firebase App Check are not tied to a specific region, and Google may process the related data (identifier, your name if you shared it, and technical data) outside the EU, including in the United States. In those cases Google applies the safeguards set out in its data processing terms, including the standard contractual clauses. [FILL IN (legal fact): confirm against the Google/Firebase data processing terms for your project.]

You can request information about the applicable safeguards by writing to us at support@domatai.app.

9. Retention period

  • Account data, setup answers, daily goals, food diary and weight log, photos and usage counters — for as long as your account exists. You can delete individual entries earlier where the app allows it.
  • When you delete your account, the data is deleted from Firestore and Cloud Storage, and the usage counters and your Firebase Authentication account are deleted (see section 10). We do not keep separate backups of this data.
  • Data sent to Anthropic for AI analysis — [FILL IN (legal fact): period according to Anthropic's terms].
  • Data held by Adapty — [FILL IN (legal fact): retention period under the agreement with Adapty].
  • System logs — [FILL IN (legal fact): period set in Google Cloud Logging for the project, 30 days by default].
  • Correspondence — for as long as needed to answer your enquiry and protect our rights, but no longer than 3 years after our last message.
  • Apple Health data — we do not store it on our servers.

10. Deleting your account

You can delete your account directly in the app: Settings → Delete account. If you don't have an active subscription, the same option is also in the "⋯" menu on the subscription screen. When you delete it, we remove:

  • all your data in Cloud Firestore (profile, setup answers, goals, food diary and weight log);
  • all photos in Cloud Storage;
  • the usage counters;
  • your Firebase Authentication account.

Important:

  • Deleting the app from your phone does not delete your account.
  • Deleting your account does not cancel your App Store subscription. You cancel the subscription separately — in Settings → [your name] → Subscriptions.

11. Security

We apply appropriate technical and organizational measures to protect your data, including: an encrypted connection (HTTPS/TLS) between the app and the servers; encryption of stored data, which Google applies by default; verification of the app with Firebase App Check and Apple App Attest; keeping API keys on the server only; and limiting access to the data to the necessary minimum. No system is completely secure, but if we discover a breach affecting your data, we will notify the competent supervisory authority (CNIL) and you where the GDPR requires it.

12. Your rights

Under the GDPR you have the right:

  • of access — to get confirmation of whether we process data about you and a copy of it (Art. 15);
  • to rectification — to ask us to correct inaccurate or incomplete data (Art. 16); you can correct some of the data yourself in the app;
  • to erasure — to ask us to delete your data (Art. 17); you can also delete your account yourself (section 10);
  • to restriction of processing — in the cases set out in Art. 18;
  • to data portability — to receive the data you provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller (Art. 20);
  • to object — to processing based on legitimate interest (Art. 21);
  • to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3));
  • not to be subject to a decision based solely on automated processing that produces legal effects concerning you (Art. 22) — the app does not make such decisions;
  • to lodge a complaint with a supervisory authority (section 14) and to seek a judicial remedy.

13. How to exercise your rights

Write to us at support@domatai.app. To protect your data, we may ask for additional confirmation that the account is yours. You can also delete your account yourself, directly in the app (section 10).

We will reply without undue delay and at the latest within one month of receiving your request. For complex or numerous requests, this period may be extended by two further months, and we will let you know. Exercising your rights is free of charge unless the requests are manifestly unfounded or excessive.

14. Right to lodge a complaint

If you believe we process your data in breach of the law, you can lodge a complaint with the French supervisory authority, which is our lead authority:

Commission Nationale de l'Informatique et des Libertés (CNIL)
Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Website: https://www.cnil.fr

You can also lodge a complaint with the supervisory authority in the EU country where you live or work, or where the alleged infringement took place. In Bulgaria, this is:

Commission for Personal Data Protection (CPDP)
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Website: https://www.cpdp.bg

If you live in the United Kingdom, you can contact the Information Commissioner's Office (ICO), https://ico.org.uk.

We would appreciate it if you contacted us first so we can try to resolve the matter.

15. Minimum age

The app is intended for people aged 16 or over. We do not knowingly collect data from anyone under 16. If we learn that such a person has created an account, we will delete the account and the data. If you are a parent or guardian and believe that a child under 16 is using the app, write to us at support@domatai.app.

16. Changes to this policy

We may update this policy, for example when the app's features or the providers we use change. The current version is published at https://domatai.app/en/privacy (Bulgarian version: https://domatai.app/privacy), and the date of the last update is shown at the top. We will notify you in the app of material changes. If a change requires new consent, we will ask for it before applying the change.

17. Contact

For questions about this policy and your personal data:

VIEVO SAS
689B rue Voltaire, 01220 Divonne-les-Bains, France
Email: support@domatai.app