Privacy Policy

This Privacy Policy ("Policy") describes how NSL Nutrition (Naama Sahar Levitt Nutrition) ("we", "us", or "our") collects, uses, and shares your information when you use SmartEat, including our website (smarteat.co), the SmartEat apps on iOS and Android, and related online services (together, the "Service"). This Policy also applies to Nutrition Health Academy, our companion learning app in the SmartEat family; see the Nutrition Health Academy section below for app-specific details. By using the Service, you agree to the collection and use of information in accordance with this Policy. This Policy complies with Israel's Protection of Privacy Law, 5741-1981, including Amendment 13, and the Protection of Privacy Regulations (Data Security), 5777-2017. For a plain-language summary focused on health-related data, see our Health Data Notice.

Interpretation and Definitions

Interpretation

Words with capitalized initial letters have meanings defined under the Definitions section. These definitions apply whether the terms appear in singular or plural.

Definitions

• Account: A unique account created for you to access the Service or its features.
• Application: The SmartEat mobile application.
• Country: Israel.
• Device: Any device used to access the Service, such as a smartphone, tablet, or computer.
• Personal Data: Any information relating to an identified or identifiable individual, such as name, email, or health metrics.
• Sensitive Personal Data: Health-related data we treat as sensitive. This includes meal photos, food diary entries, weight logs, Body Intelligence check-ins (mood, energy, digestion, concentration, and related wellness notes tied to meals), and data you grant from Apple Health or Health Connect (for example date of birth, height, sex, sleep, steps, and weight).
• Service: The SmartEat website (smarteat.co), the SmartEat iOS and Android apps, and related online services.
• Third-Party Service Provider: A company that processes data on our behalf. The processors we use are listed under Processors and Where Data Goes.
• Usage Data: Data collected automatically, such as device details, IP address, or interaction logs.
• You: The individual or entity accessing or using the Service.

Our Family of Apps

We operate products under the SmartEat brand, including the website, SmartEat (nutrition and wellness tracking on iOS and Android), and Nutrition Health Academy (gamified nutrition education). Unless a section specifically refers to Nutrition Health Academy, the data practices below describe SmartEat (site and apps).

Nutrition Health Academy

Nutrition Health Academy is an educational app. It does not provide medical advice and is not a health-tracking app. If you use Nutrition Health Academy, the following applies in addition to the general practices in this Policy (such as security, retention, your rights, and contact details).

What Nutrition Health Academy Collects

• Account information: Email address, display name, and authentication data from Sign in with Apple (such as a private relay email or user identifier).
• Learning progress: Mission results, scores, XP, levels, streaks, path completion, and skill progress. This is game progress data, not health or medical data.
• Optional reminders: If you enable streak reminders, your preference and chosen time are stored on your device. Reminders are scheduled locally on your device; we do not send marketing push notifications.
• Technical data: Device type, operating system version, app version, and diagnostic or crash information (if enabled).

What Nutrition Health Academy Does Not Collect

• Apple Health data, weight, meals, medical records, diagnoses, or other clinical health information.
• We do not sell your personal information or use third-party advertising in Nutrition Health Academy.
• Guest mode: If you use Guest mode, progress is stored on your device only and is not synced to our servers unless you create an account. Deleting the app in Guest mode removes that local data.

Third-Party Services (Nutrition Health Academy)

Nutrition Health Academy may use trusted providers such as Supabase (authentication and cloud sync for signed-in accounts) and Sign in with Apple. Those providers process data under their own policies. Sections below that refer to Apple Health, Firebase health integrations, or OpenAI for health insights apply to SmartEat only, not Nutrition Health Academy.

Collecting and Using Your Personal Information (SmartEat)

How We Collect Information

We collect information based on your interactions with the Service, including data you provide directly, data collected automatically, and data accessed with your consent from third-party integrations like Apple's Health app. By using the Service, you consent to our collection, processing, and storage of your data as described in this Policy. You may withdraw consent at any time by discontinuing use of the Service and requesting data deletion.

Device Permissions

The apps may ask for these permissions. You can turn them off in device settings. Some features will not work without them:

• Camera: Meal, barcode, menu, and fridge scans.
• Photo library: If you choose an existing photo to log food.
• Notifications: Reminders and service updates you enable.
• Apple Health (iOS) / Health Connect (Android): Health and activity data you grant, such as steps or weight.

Your Responsibility for Data Accuracy

You are responsible for ensuring the accuracy of any data you provide to the Service, including health data or personal information. We are not liable for any consequences arising from inaccurate or incomplete data provided by you.

Types of Data Collected

Personal Data

We may collect the following Personal Data when you use the Service:

• Identifiers: Name, email address, phone number, and login credentials.
• User Content: Data you upload to the app.

Sensitive Personal Data

We treat the following as sensitive health data, whether you enter it in the app or grant access from Apple Health or Health Connect:

• Meal photos and scans: Photos and related text or barcodes you use to log food.
• Food diary: Meals, recipes, portions, calories, and macros you save.
• Body Intelligence: Check-ins you log such as mood, energy, digestion, bloating, concentration, and how those notes relate to meals.
• Weight logs: Weight you enter or that we read with your consent from Apple Health or Health Connect.
• Apple Health (iOS), if you grant access:
  • Date of Birth: To personalize recommendations based on age.
  • Height: To calculate metrics like BMI.
  • Sex: To tailor health insights to sex-specific needs.
  • Sleep Data: To analyze sleep patterns and provide wellness insights.
  • Steps: To track daily activity and movement goals.
  • Weight: To monitor progress toward weight management goals.
• Health Connect (Android): Health and activity data you grant, such as steps.

If you turn on Face ID, Touch ID, or another device lock (PIN, pattern, or Android biometrics), the app uses the lock already on your device to unlock locally. We do not collect, receive, or store your face, fingerprint, or other biometric templates. We only store a setting that device unlock is on.

Usage Data

Usage Data is collected automatically and may include:

• Device information (e.g., IP address, operating system, browser type).
• Interaction logs (e.g., pages visited, time spent, features used).
• Diagnostic data (e.g., crash reports, performance metrics).

Use of Your Personal Data

We use your data to:

• Provide health tracking, personalized insights, and recommendations.
• Authenticate users securely, including optional local device unlock. We do not store biometric templates.
• Enhance app functionality and user experience through analytics.
• Communicate with you about updates, subscriptions, or support inquiries.
• Comply with legal obligations under Israeli law.
• Leverage OpenAI APIs to personalize health insights (e.g., AI-driven recommendations).

Sharing of Your Personal Data

We may share your data with:

• Third-Party Service Providers: The processors listed under Processors and Where Data Goes, including Firebase (Google), OpenAI, Google Analytics, Crashlytics, Apple and Google billing, and Open Food Facts. They process data on our behalf for the purposes described there. Review their privacy policies before using the Service.
• Legal Authorities: If required by law or to protect our rights, property, or user safety.
• Business Transfers: In the event of a merger, acquisition, or sale, your data may be transferred, with notice provided.

We do not sell or share your health data with third parties for marketing purposes.

Cookies and Tracking Technologies

The Service uses cookies and similar technologies to enhance your experience, analyze usage, and improve functionality. Cookies are small files stored on your device that help remember your preferences and settings.

Types of Cookies We Use

• Essential: Necessary for core functionality (security, routing, session integrity).
• Functional: Remember your choices (e.g., language, dismissing consent banners).
• Analytics: Aggregated usage statistics to improve content and performance (e.g., Google Analytics via gtag/Google Tag Manager).

Legal Basis and Consent

For Essential cookies, our legal basis is legitimate interests (site operation and security). For Analytics cookies, we rely on your consent. A consent banner may be shown; until you consent, only Essential and Functional cookies are active.

Retention Periods

• Session cookies are deleted when you close the browser.
• Persistent cookies may be stored longer (typically up to 13 months) unless you delete them sooner.

Managing Cookies

• Adjust your choice in the consent banner (if shown again), or request a reset at [email protected];
• Block/delete cookies in your browser settings (see your browser's help pages);
• Opt out of Google Analytics via browser tools and/or your Google account settings.

Disabling Essential cookies may affect site functionality.

Third-Party Cookies and Providers

Some cookies are set by third parties when we integrate their services. Those providers process data under their own policies.

Provider / Domain	Purpose	Type	Typical Duration
Google Analytics / .google.com, .googletagmanager.com	Aggregated visit statistics	Analytics	Up to 13 months
Firebase (Google) (if web authentication is used)	Sign-in session support, security	Essential	Session / up to 13 months

See also: Google Privacy Policy.

Do Not Track Signals

There is no standardized response to browser "Do Not Track" signals. We will monitor developments and update this Policy if standards emerge.

Cookie Questions

If you have questions about cookies or want to change your choices, contact [email protected].

Crash and Diagnostic Data

We collect crash reports and diagnostic information via Firebase Crashlytics, including device details (e.g., device model, OS version, app version) and error reports. This data is used solely to:

• Identify and fix bugs and malfunctions;
• Improve app stability and performance.

Crashlytics uses installation-level identifiers and technical diagnostic information. We do not intentionally attach your SmartEat profile or food diary to crash reports. This data is not used for advertising or cross-app tracking.

Data Protection Mechanisms

We implement robust security measures to protect your data, including:

• Encryption: Data is encrypted in transit (SSL) and at rest.
• Access Controls: Only authorized personnel can access your data, based on role.
• Regular Audits: We review our practices to prevent unauthorized access.
• Secure Storage: Health data is stored securely, with processing often occurring locally on your device.

While we strive to ensure data security, no system is infallible. You use the Service at your own risk.

Data Breach Notification

If a data breach may affect your Personal Data, we will notify you promptly as required by Israeli law, using the contact information you provided. When the law requires it, we will also notify the Privacy Protection Authority. We are not liable for damages resulting from a breach unless caused by our gross negligence or willful misconduct.

Retention of Your Personal Data

We retain your data only as long as needed to provide the Service or meet legal duties. After you delete your account, we erase it except where a row below requires a longer period.

Data	How long we keep it
Account, food diary, meal photos, and other health data	Until you delete the account (or we delete it after 120 days of inactivity, as described below)
Backups	Up to 30 days after deletion
Crash logs (Crashlytics)	About 90 days
Analytics	Up to 13 months
Invoices and tax records	Up to 7 years

Processors and Where Data Goes

NSL Nutrition is based in Israel and is the controller of your personal data. The Service is not hosted only in Israel. Account data and app traffic are processed on Google Cloud / Firebase. Our Cloud Functions run in the European Union (Belgium). Google may also process data in the United States and/or the European Union. When you use AI features, inputs are sent to OpenAI, which processes them in the United States and may use other OpenAI processing regions.

We use these processors for SmartEat. We do not list tools we do not use.

Processor	What is sent	Where it is processed
Firebase (Google) - Auth, Firestore, Cloud Functions, hosting	Account, meals, logs, and other data you save in the app	Google Cloud, typically the United States and/or the European Union
OpenAI	Photos, text, barcodes, and related context needed for AI features	United States (and other OpenAI processing regions)
Google Analytics	Site usage after you consent to analytics cookies	Google, typically the United States and/or the European Union
Firebase Crashlytics (Google)	Crash and diagnostic reports	Google Cloud, typically the United States and/or the European Union
Apple App Store (StoreKit)	iOS subscription and purchase data	Apple, typically the United States and other Apple regions
Google Play Billing	Android subscription and purchase data	Google, typically the United States and/or the European Union
Open Food Facts	Barcode lookups for packaged foods	European Union (Open Food Facts)

By using the Service, you consent to these transfers, including processing in Israel, the United States, and the European Union, even if your region has different data protection laws. If you do not consent, discontinue use and request data deletion at [email protected].

See also: Google Privacy Policy, OpenAI Privacy Policy, Open Food Facts, Apple Privacy Policy.

Delete Your Personal Data

You have the right to delete your data. To do so:

• Use in-app account settings to delete specific data or request account deletion.
• Contact [email protected] to request full data deletion.

Uninstalling the app does not delete your account. If you remove the app without deleting the account in the app or by emailing support, your data stays with us until you delete it in the app or write to [email protected].

If an account stays inactive for 90 days, we send a warning email. If you do not log in again, we may permanently delete the account and personal data after 120 days of inactivity (about 30 days after that email). Paid subscribers are not deleted for inactivity. Opening the app and logging in keeps the account active.

We may retain certain data if required by law or for legitimate business purposes (e.g., resolving disputes).

Business Transactions

If we are involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your data is transferred and becomes subject to a different Privacy Policy.

Your Privacy Rights in Israel

Under Israel's Protection of Privacy Law, 5741-1981, including Amendment 13, you have the following rights:

• Access: Request access to your Personal Data and health data.
• Correction: Request corrections to inaccurate data.
• Deletion: Request deletion of your data, subject to legal obligations.
• Withdraw Consent: Revoke consent for health data access via your device settings.

To exercise these rights, contact [email protected]. We will respond within the legally required timeframe. You may also complain to the Privacy Protection Authority.

Children's Privacy

The Service is for users aged 17 and over. We do not knowingly collect data from anyone under 17. If we discover such data, we will delete it promptly. Contact [email protected] if you believe data from someone under 17 was collected.

Links to Other Websites

The Service may link to third-party websites (e.g., icon/media providers). We are not responsible for their privacy practices. Review their privacy policies before interacting.

Disclaimer of Warranties

To the fullest extent permitted by Israeli law, we provide the Service "as-is" without warranties, express or implied, regarding the security, accuracy, or availability of your data. We disclaim liability for any data breaches or service interruptions, though we take reasonable measures to protect your information.

Changes to This Privacy Policy

We may update this Policy to reflect changes in our practices or legal requirements. Continued use of the Service after updates indicates your acceptance. Review this Policy periodically in the app's settings.