Privacy Policy
Last updated: October 6, 2026 · Español
1. Who is responsible for your data
Unflame (unflame.app and the Unflame mobile apps) is the data controller. Privacy contact: contact@unflame.app.
2. What Unflame Does
Unflame helps users log meals, scan food or related images, estimate nutrition and inflammation-related signals, track progress, and generate reports. The service is informational: it is not a medical device and does not replace advice from a professional.
3. Information We Collect
- Account: name, email, sign-in provider (Google or Apple) and its account identifier, or a hashed password if you register with email.
- Health and lifestyle data (a special category under GDPR art. 9): meals, meal photos, nutrients, weight, body measurements and composition, body photos for body-fat estimates if you choose to upload them, symptoms and daily check-ins (for example bloating), goals, diet, and onboarding answers.
- Genetic data, only if you order a DNA analysis and upload your raw genetic data file. We record the version and date of your specific consent.
- Your nutrition professional relationship, if you connect with one: permissions you grant, intake forms, plans, targets, consultations and reviews the professional records.
- Purchases and subscriptions: entitlement status and transaction references. We do not store full payment card numbers.
- Support: messages and files you send us.
- Technical data: IP address, device and browser, app version, session, security and error logs.
4. Why We Use It and Our Legal Basis
- To provide the service (account, meal logging, scans, reports, widgets): performance of our contract with you (GDPR art. 6.1.b).
- To process your health and genetic data: your explicit consent (art. 9.2.a). You can withdraw it at any time by deleting that data or your account; withdrawal does not affect earlier processing.
- To share your reports with a nutrition professional: only if you approve it, based on your explicit consent. You can revoke access in the app at any time.
- Payments and invoicing: performance of contract and legal tax obligations.
- Security, abuse prevention and service improvement: our legitimate interests (art. 6.1.f).
- Support and rights requests: performance of contract and legal obligations.
We do not sell your personal information or use it for personalised advertising.
5. Artificial Intelligence
To analyse meal photos and text, generate reports and answer questions about your reports, we send the necessary data to AI providers: Google (Gemini API) and OpenAI, acting as our processors. Outputs are automated estimates and can be wrong; we do not make decisions with legal or similarly significant effects based solely on them.
6. Nutrition Professionals
If you connect your account with a nutrition center or professional (by invitation or code), they can see your reports only after you approve access, and you can revoke it at any time. The professional is responsible for how they use your data in their relationship with you; Unflame processes the data they record in their dashboard on their behalf under our Professional Data Processing Terms.
7. Who We Share Data With
- Hosting and email: Hostinger.
- AI: Google (Gemini API) and OpenAI.
- Sign-in: Google and Apple.
- Payments and subscriptions: Stripe, RevenueCat, Apple App Store and Google Play.
- Your nutrition professional, only if you approve it.
- Authorities, when required by law.
8. International Transfers
Some providers (for example Google, OpenAI, Stripe or RevenueCat) may process data outside the European Economic Area, mainly in the United States. In those cases we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
9. Retention
We keep your data while your account is active. When you delete your account, we remove the account and its associated data (including meals, photos and files) from active systems. We keep only what the law requires, such as invoicing records (up to 6 years under Spanish commercial and tax law), blocked and used for that purpose only.
10. Account Deletion
You can delete your account from the app or by following these instructions. Subscriptions from the App Store, Google Play or Stripe are cancelled separately, on the platform where you bought them.
11. Your Rights
You can access, correct, delete, restrict, port and object to the processing of your data, and withdraw consent, by writing to contact@unflame.app. We may need to verify your identity. You can also complain to the Spanish Data Protection Agency (www.aepd.es) or the authority where you live.
12. Children
Unflame is not intended for children under 14. If you are under 14, you may only use it with the consent of a parent or guardian. If you believe a child has given us data without that consent, contact us and we will delete it.
13. Cookies
We use our own strictly necessary cookies to sign you in, keep your session secure and remember which referral link you arrived from. We do not use third-party advertising or analytics cookies.
14. Security
We apply technical and organisational measures suited to health data: encrypted connections, per-account and per-center access controls, and restricted internal access. No internet service can be guaranteed to be completely secure.
15. Changes
If we make important changes to this policy we will tell you in the app or by email. The date above shows the latest update.