Privacy Policy

1. Data controller

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you that the controller of your personal data is:

• Company name: Zylaris Software, S.L.
• Tax ID (CIF): B75957613
• Registered address: Calle Melchor Cano, 1, 28008 Madrid, Spain
• Contact email: hojaria.app@gmail.com
• Website: hojaria.com

(hereinafter, "Zylaris", "we" or "the Controller")

2. Scope

This Privacy Policy governs the processing of personal data carried out by Zylaris through the Hojaria mobile application and its associated services.

By downloading, installing, registering for or using the App, you accept the practices described in this Privacy Policy. If you do not agree, please do not use the App.

3. What personal data we collect

3.1. Data you provide directly

• Account data: name, email address and, where applicable, the profile picture associated with your Google account if you choose to sign in with Google.
• Password: stored in encrypted form via Firebase Authentication. Zylaris has no access to your password in plain text.
• Preferences and settings: nutritional goals, notification preferences and any other settings you configure in the App.
• User-generated content: logs of plants consumed, photos of dishes you choose to upload, and the dates and times of those logs.

3.2. Data we collect automatically

• App usage data: screens visited, actions performed, time of use. We use this information in aggregate form to improve the App.
• Device data: device type, operating system and version, language and regional settings.
• Unique identifiers: internal identifier generated by Firebase to associate your data with your account.
• Crash reports: if the App closes unexpectedly on iOS, Firebase Crashlytics (Google) generates a technical report (device model and state, and the point in the code where the error happened) so we can fix it. It does not include the content of your logs. App usage data is collected through Firebase Analytics (Google).

3.3. Premium subscription data

If you purchase a Premium subscription:

• Subscription status: plan type (monthly or annual), start and renewal dates, payment status.
• Transaction identifier: provided by the Apple App Store or Google Play Store.

3.4. Photos of dishes

When you take a photo of a dish for automatic plant detection:

• The image is transmitted to our servers and then to Anthropic, PBC (provider of the Claude AI model) for analysis.
• Images are not stored permanently on our servers or Anthropic's. They are deleted after analysis.
• Only the textual result of the analysis (the list of detected plants) is stored in your account, not the original photo.

3.5. Health data (Apple Health and Health Connect)

Connecting to Apple Health (iOS) or Health Connect (Android) is optional and only happens if you authorise it. In that case:

• Reading: the App reads your daily steps so you can see your physical activity next to your plant-based eating in your weekly summary and your profile, as a complement to following a healthy diet. On iOS it also reads your hours of sleep for the same summary. This data is processed on your device and is not sent to our servers.
• Writing: for each plant you log, the App saves an estimated serving with its approximate nutritional value (energy, fibre, protein, carbohydrates, fat and sugars) to Health, as well as each glass of water you log. If you remove a log in the App, it is also removed from Health.
• Health data is never used for advertising, is not sold and is not shared with third parties.
• You can withdraw permission at any time from the Apple Health settings or the Health Connect app. Data the App wrote to Health stays on your device, under your control.

4. Purposes of processing

5. Data retention

• Account and usage data: for as long as your account remains active. If you delete your account, your data will be deleted within a maximum of 30 days, unless we are legally required to retain it.
• Billing data: 6 years from the last transaction (tax obligation).
• Photos of dishes: not retained. They are deleted after analysis.
• Support data: 2 years from the last interaction.

6. Data recipients

Your personal data may be shared with the following service providers acting as data processors:

International transfers to the USA are carried out under the Data Privacy Framework (DPF) or through Standard Contractual Clauses approved by the European Commission.

We do not sell your personal data to third parties under any circumstances.

7. Your rights

As a data subject, you have the following rights:

• Access: to know what data of yours we process
• Rectification: to correct inaccurate data
• Erasure (right to be forgotten): to request the deletion of your data
• Objection: to object to the processing of your data
• Restriction: to request the restriction of processing
• Portability: to receive your data in a structured format
• Withdraw consent at any time

How to exercise your rights

Send an email to hojaria.app@gmail.com from the address associated with your account, indicating the right you wish to exercise. We will respond within a maximum of one month.

Deleting your account

You can delete your account and all your data at any time from the App, under Profile → Delete account. If you no longer have the App installed, follow the instructions on this page.

Complaints to the supervisory authority

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): aepd.es. If you are in the UK, you may also contact the Information Commissioner's Office (ICO): ico.org.uk

8. Data security

We apply appropriate technical and organisational measures to protect your data:

• HTTPS/TLS encryption for all communications
• Password encryption at rest (Firebase Authentication)
• Firestore data encryption at rest
• Strict access rules (Firestore Security Rules)
• Periodic review of access and permissions

9. Minors

The App is intended for people over 14 years of age. Users under 14 may not use the App without the prior consent of their parents or legal guardians.

10. AI-powered plant detection

When you use the dish photo feature:

1. The image is transmitted encrypted to our servers and to Anthropic, PBC for analysis using Claude.
2. Anthropic processes the image solely to return a list of detected plants.
3. Neither Zylaris nor Anthropic stores the image after processing.
4. Anthropic does not use the images to train its models.
5. Only the textual result is kept in your account.

If you do not agree with this processing, you can enter plants manually without using the photo feature.

11. Changes to this Policy

We may update this Privacy Policy. When we make substantial changes, we will notify you through the App or by email, and we will publish the updated version with its modification date.

12. Governing law

This Policy is governed by Spanish law. Any dispute shall be submitted to the jurisdiction of the Courts and Tribunals of Madrid.