Privacy Policy

1. Who We Are

The Berosh app is operated by:

Beroshapp – Halil Zınar Düzgün
Johann-Strauß-Straße 12, 82008 Unterhaching, Germany
E-mail: info@beroshapp.com · Phone: +49 172 5740559

For all privacy-related requests — including data access, correction, deletion, objection or complaints — contact us at the address above.

2. What Data We Collect and Why

We only collect data that is necessary to provide the app's features. The table below gives a complete overview.

Required and voluntary data: account data is needed to create your account and provide the app. All health and diet data is voluntary — without it the app works in a generic mode.

3. Camera and Microphone Access

Camera

Berosh requests camera access when you use the fridge scan, recipe from a photo, photo food log, or barcode scanner features. The camera is activated only when you explicitly tap the scan button. Photos from the fridge scan, recipe from a photo and photo food log are transmitted to OpenAI's API for analysis and are deleted from our servers within 30 minutes at the latest. The barcode scanner reads the code on your device: only the barcode number is sent, through our server, to Open Food Facts to look up the product — no image leaves your device. Images are never used for advertising, profiling, or any purpose other than the feature you initiated.

You can revoke camera permission at any time in your device Settings. Revoking permission disables the scan features but does not affect other app functionality.

Microphone

Berosh requests microphone access when you use the voice food diary feature. Recording starts only when you tap the record button and stops when you stop it, after 30 seconds at the most. The recording is transmitted to OpenAI's speech-to-text API (gpt-4o-mini-transcribe) for transcription and is deleted from our servers within 30 minutes at the latest.

You can revoke microphone permission at any time in your device Settings.

4. Dietary and Health Data

Some of the information you enter is special category data under Art. 9 GDPR: your allergies, health goals, body metrics, and water-intake data (health data), and any cultural or religious dietary preferences you select (which may reveal religious or philosophical beliefs). We process this special category data only on the basis of your explicit consent under Art. 9(2)(a) GDPR, which we request separately during onboarding, at the point where the data is collected. You can withdraw this consent at any time in the app's settings (Art. 7(3)); withdrawal deletes the affected data and disables the related personalisation, without affecting the lawfulness of processing before withdrawal. If you do not give this consent, the app still works in a generic mode, without allergy or cultural personalisation. General app functions rely on Art. 6(1)(b) (contract performance); the explicit consent above is the additional Art. 9 condition required for this special category subset. We process this data exclusively to provide the meal planning and nutrition tracking features you have requested, and we do not sell, share, or use it for any purpose beyond the core app functionality, nor share it with advertisers, data brokers, or any third party not listed in Section 5 of this policy.

If you use the food diary, the foods you log can indicate your diet or health; we use them only for the features you use (for example your meal plan and weekly report) and protect them like the data above.

5. Processors and Other Recipients

We use the following processors to operate the app. Each is engaged under a data processing agreement (Art. 28 GDPR), together with EU Standard Contractual Clauses (SCCs) where data is transferred outside the EU/EEA.

Other recipients (independent controllers): Apple and Google (app stores, billing, and Sign in with Apple / Google) and Open Food Facts (receives only the barcode number you scan, no personal data).

6. Data Retention

We retain your personal data only for as long as your account is active or as required to provide the service. Specific retention periods:

• Account and profile data: retained until you delete your account
• Meal log and nutrition data: retained until you delete your account or manually delete individual entries in the app
• AI-scan photos (fridge scan, meal photo-log, recipe from a photo) and voice recordings: deleted right after AI processing — at the latest within 30 minutes
• Data sent to OpenAI: OpenAI may keep it for up to 30 days to detect abuse, then deletes it; it is not used to train AI models
• AI nutrition assistant conversations: stored only on your device, separately for each account; deleted when you clear the chat or delete your account
• Meal plans and weekly reports: kept until you delete your account
• Guest tables (saved menus): kept until you delete the table or your account
• Recipe review photos: kept until you delete the review or your account
• Consent records: kept for as long as your account exists, as a compliance record
• Crash and error reports: automatically deleted after at most 90 days
• App error logs: automatically deleted after 90 days
• IP address: automatically deleted after 2 days; when you request a copy of your data (right to data portability, Art. 20), the IP address stored with that request is removed after 30 days
• Website waitlist: deleted after launch; to be removed earlier, write to info@beroshapp.com
• Subscription records: retained in anonymised or pseudonymised form for the period required by German commercial and tax law (§ 147 AO, § 257 HGB — up to 10 years)
• Subscription details (country, store, price, renewal status, date of the last renewal reminder): kept until you delete your account
• RevenueCat: your customer record is deleted when you delete your account
• Resend: e-mail content and delivery logs are kept for 30 days

7. How to Delete Your Account

You can delete your account and all associated personal data directly within the app:

• Open the app → Profile → Delete Account
• Confirm the deletion prompt
• Your account, profile, meal data, and any recipe reviews and review photos will be permanently and irreversibly deleted within 30 days

If you have an active subscription, cancel it through the App Store or Google Play before deleting your account. Deleting the account does not automatically cancel an active subscription, and you may continue to be charged until you cancel separately.

Deleting your account also deletes your customer record at RevenueCat. If a store subscription keeps renewing, the store's renewal can create a new, anonymous RevenueCat record — another reason to cancel first.

You can also request account deletion by e-mail: info@beroshapp.com

8. Children's Privacy

Berosh is not directed at children. Under German law (BDSG in conjunction with GDPR Art. 8) and the Telecommunications Digital Services Data Protection Act (TDDDG), the digital age of consent in Germany is 16 years. Children under 16 may not use Berosh without verifiable parental or guardian consent. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data without parental consent, please contact us at info@beroshapp.com and we will delete it promptly.

9. Security

All data in transit is encrypted using TLS 1.2 or higher. Data at rest in Supabase is encrypted at the storage level. We apply Row Level Security (RLS) policies so that users can only access their own data. We review and update our security measures on an ongoing basis. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the BayLDA within 72 hours and, where required, affected users without undue delay (GDPR Art. 33–34).

10. International Data Transfers

Your data is primarily stored in the EU (Frankfurt, Germany) via Supabase. Where data is transferred to providers in the USA (OpenAI's US affiliates via OpenAI Ireland, RevenueCat, Resend, Cloudflare, Expo), the transfer is based on EU Standard Contractual Clauses (SCCs) pursuant to GDPR Art. 46(2)(c); where a provider is certified under the EU–US Data Privacy Framework, that adequacy decision applies as well. You can request a copy of the safeguards at info@beroshapp.com.

11. Your Rights Under GDPR

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Correct inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your personal data
• Right to restriction (Art. 18): Ask us to restrict processing of your data in certain circumstances
• Right to data portability (Art. 20): Receive your data — including your recipe reviews — in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at info@beroshapp.com. We answer within one month; where necessary this can be extended by two further months (Art. 12(3) GDPR) — we will tell you why.

Automated decisions

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR). AI suggestions are proposals you are free to use or ignore.

12. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (GDPR Art. 77). The authority competent for our registered address in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach, Germany
www.lda.bayern.de

13. Changes to This Policy

We update this Privacy Policy when features, providers or the law change, and update the "Effective" date at the top of this page. If we make material changes — for example new purposes, new recipients or new transfers outside the EU — we will tell you in the app or by e-mail before they take effect and explain what changes for you. Where a change needs your consent, we will ask for it separately; we never treat continued use as consent.

14. Contact

Beroshapp
E-mail: info@beroshapp.com
Phone: +49 172 5740559
Contact form: beroshapp.com/contact