Privacy and Personal Data Protection Policy

This English version of the policy is a translation provided for convenience. If it differs from the Ukrainian original, the Ukrainian version prevails.

1.GENERAL PROVISIONS

1.1. This Privacy Policy (hereinafter — the “Policy”) sets out the procedure for the collection, processing, storage, use and protection of the personal data of users of the Yummo mobile application (hereinafter — the “Application”).

1.2. The owner of the personal data and the party responsible for processing it is the Limited Liability Company “YAMMO” (hereinafter — the “Company”).

1.3. This Policy applies to all users of the Application regardless of the method of registration, place of residence or means of access to the service.

1.4. The purpose of this Policy is:

  • to ensure transparency in the processing of personal data;
  • to inform users about what data is collected and for what purpose;
  • to define users’ rights regarding their personal data;
  • to establish measures for protecting personal information.

1.5. By registering in the Application, using its features and/or continuing to use the service, the user confirms that they:

  • have read this Policy;
  • understand its contents;
  • give voluntary, informed consent to the processing of their personal data in accordance with the terms of this Policy.

1.6. The Company processes personal data on the following principles:

  • lawfulness and good faith;
  • purpose limitation of the processing;
  • data minimization;
  • proportionality;
  • security and confidentiality;
  • limitation of storage periods.

1.7. The Company processes users’ personal data solely to the extent necessary for:

  • the functioning of the Application;
  • the provision of services;
  • the personalization of content;
  • ensuring technical stability;
  • compliance with the requirements of the legislation of Ukraine.

1.8. This Policy is an integral part of the legal framework for using the Application and applies together with the Public Offer posted in the Application and/or on the Company’s official website.

2.METHODS OF REGISTRATION AND AUTHENTICATION

2.1. To use the features of the Application, the user creates an account by registering in one of the following ways:

  • with an email address (sign-in with a one-time code, no password);
  • through a Google account;
  • through an Apple account using the Sign in with Apple feature.

2.2. When registering by email, the user provides a valid email address; to sign in, the Company sends a one-time code to it.

2.3. When registering through a Google or Apple account, the Company receives and processes the data provided by the respective service, in particular the user’s email address, which is used to create the account in the Application.

2.4. The Company does not gain access to users’ passwords for third-party authentication services (Google, Apple) and does not store such data in its systems.

2.5. The data received during registration and authentication is used solely for:

  • creating and maintaining the user’s account;
  • providing access to the features of the Application;
  • identifying the user in the system;
  • ensuring the security of the account.

2.6. The Company does not process biometric data, geolocation data or other special categories of personal data in the course of registration and authentication.

2.7. All actions carried out in the Application using the user’s account are deemed to have been carried out by the user themselves, unless proven otherwise in accordance with the law.

3.CATEGORIES OF PERSONAL DATA

The Company processes users’ personal data to the extent necessary for the functioning of the Application, the provision of services and the personalization of content.

3.1. User data (parents / guardians)

The user’s personal data may include:

3.1.1. Identification and contact data:

  • email address (email);
  • user’s name (provided optionally).

3.1.2. Account data:

  • interface language;
  • system account identifiers;
  • account status.

3.1.3. Data related to use of the service:

  • subscription information (status, pricing plan, payment dates, activation history);
  • information about access to the features of the application.

3.2. Data about the child (entered voluntarily by the user)

Data about the child that may be processed in the Application includes:

  • the child’s name (at the user’s discretion);
  • date of birth and/or age;
  • sex (at the user’s discretion);
  • information about foods introduced;
  • data on dietary restrictions or particular features of the diet;
  • notes on reactions to foods;
  • food tracking data;
  • other information that the user voluntarily enters within the features of the Application.

3.2.1. The Company does not independently collect data about children beyond the information voluntarily provided by the user.

3.3. General provisions on categories of data

3.3.1. A child’s allergies, dietary restrictions and reactions entered by the user are health data (a special category of personal data). The Company processes them only to run the features of the App (the food diary and food suggestions), does not use them for advertising or marketing and does not pass them to marketing services. The Company does not process biometric data, precise geolocation, or data on racial or ethnic origin, political views or religious beliefs.

3.3.2. The volume of personal data is limited by the principle of minimum sufficiency and corresponds to the purposes of the functioning of the Application.

3.4. Plate photos. If you use food recognition from a photo, the App sends the photo of the plate to the Company’s server. Before storing the photo or passing it on for recognition, the Company removes its location and other metadata and makes it smaller. The photo is passed to Anthropic only to identify the foods on the plate (clause 9.5). If you save the foods from the photo to the diary, the photo is kept with that meal so that you can see it in the diary. The Company does not use photos for advertising or marketing and does not recognize people in them. Please take the photo so that no faces are in the frame.

4.TECHNICAL AND AUTOMATICALLY COLLECTED DATA

4.1. When you use the App, the Company may automatically collect and process technical information needed to ensure the service works correctly, securely and stably.

4.2. Technical and automatically collected data may include:

  • the user’s IP address (at the server infrastructure level);
  • technical server access logs (server logs);
  • device type and model;
  • operating system and its version;
  • App version;
  • the push device token needed to send push notifications;
  • technical device identifiers used for the correct operation of the App.

4.3. The App:

  • does not collect the user’s precise geolocation (GPS);
  • does not use cookies (as a mobile app);
  • does not carry out advertising profiling of users;
  • does not carry out behavioral advertising tracking.

4.4. Technical identifiers and automatically collected data are used solely for the following purposes:

  • ensuring the App functions;
  • maintaining technical stability;
  • detecting and fixing errors;
  • performance analytics;
  • protection against abuse and unauthorized access.

4.5. The processing of technical data is not aimed at identifying the user beyond the operation of their account.

5.PURPOSE OF PERSONAL DATA PROCESSING

5.1. The Company processes users’ personal data solely for specified, lawful and justified purposes necessary for the App to function and for services to be provided.

5.2. Personal data is processed for the purpose of:

  • registering the user and creating an account;
  • authorizing and identifying the user in the system;
  • providing access to the App’s features;
  • providing the services offered by the app’s features;
  • personalizing content, recommendations and the interface;
  • adapting information materials to the data entered;
  • enabling the subscription and access to paid features;
  • processing payments and managing subscriptions (through third-party payment services);
  • technical support for users;
  • communicating with users on matters relating to the operation of the service;
  • sending service and information messages;
  • improving the quality of the service and developing the App’s features;
  • analytics of App usage;
  • ensuring information security;
  • complying with the requirements of the applicable legislation of Ukraine.

5.3. All purposes of personal data processing are proportionate, necessary and directly related to the functioning of the App.

6.ANALYTICS AND TECHNICAL SERVICES

6.1. To ensure the App runs stably, to analyze its performance and to improve its features, the Company uses third-party technical and analytics services.

6.2. The App uses the services listed in clause 9.5, in particular Google Firebase (usage analytics and push delivery), Sentry (detecting and fixing errors) and AppsFlyer (measuring Yummo’s advertising campaigns).

6.3. The data processed through these services is exclusively technical and analytical in nature and is used only for:

  • improving the App’s functionality;
  • optimizing the user experience;
  • increasing the stability of the service;
  • fixing technical failures and errors.

6.4. In the App, the Company does not show ads, does not sell personal data and does not use a child’s health data for advertising or marketing. To measure its own advertising campaigns, the Company uses AppsFlyer, which receives data on app installs, sign-ups and subscription purchases. On iPhone the device’s advertising identifier is shared only if you allow tracking in the iOS system prompt; on Android you can reset or turn it off in the device settings.

6.5. Analytics data is processed without the user’s name or email — under a technical identifier (in pseudonymized form) — and only to the extent necessary for the purposes of this Policy.

6.6. Data processing through analytics services is carried out in line with the principles of confidentiality, data minimization and security, in accordance with the applicable legislation of Ukraine.

6.7. The website yummoapp.com (the “Website”) uses cookies. Clauses 6.2–6.5 concern the App; clauses 6.7–6.11 describe how data is processed on the Website.

6.8. Only strictly necessary cookies and browser storage work without separate consent:

  • yummo_consent — your cookie choice, 180 days;
  • pll_language — the language you read the Website in, 1 year;
  • yummo_lang (browser storage) — your choice of the Website’s language.

6.9. Only after you click “Accept” in the cookie banner does the Website load:

  • Google Analytics (cookies _ga, _ga_*, up to 2 years) — visit statistics: which pages are read and where visitors come from;
  • Google Ads (cookies _gcl_*, up to 90 days) — measuring the effectiveness of Yummo’s ads, including clicks through to the App Store and Google Play.

6.10. The legal basis for this processing is your consent. Data collected on the Website is not used for personalized advertising (remarketing). These services are provided by Google; data may be processed outside Ukraine, including in the USA, in accordance with Google’s Privacy Policy: https://policies.google.com/privacy.

6.11. If you click “Decline” or make no choice, Google Analytics and Google Ads are not loaded. You can change your decision or withdraw consent at any time with the “Cookie settings” button at the bottom of the Website; once consent is withdrawn, the Google Analytics and Google Ads cookies are deleted. You can also delete cookies in your browser settings.

7.PUSH NOTIFICATIONS

7.1. The App may send users push notifications to inform them about events relating to the operation of the service and the use of the App.

7.2. Push notifications may include, in particular:

  • information messages about updates to the App’s features;
  • service messages relating to the operation of the account;
  • reminders relating to the use of the app’s features;
  • messages needed to ensure the service works correctly.

7.3. The user has the right to opt out of receiving push notifications at any time by changing the settings on their mobile device.

7.5. Turning off push notifications may affect the service information you receive about the operation of the App and your account.

8.EMAIL COMMUNICATION

8.1. The user’s email address is used by the Company to send messages relating to the operation of the App and the servicing of the account.

8.2. Email messages may include, in particular:

  • service messages (registration, account confirmation, access recovery, password change);
  • messages about the subscription, payments and account status;
  • information messages about the operation of the service;
  • messages about technical changes or updates to the App.

8.3. The Company sends marketing emails (Yummo news, tips and offers) to registered users. You can opt out at any time with the link in every email or by writing to hello@yummoapp.com.

8.4. The user has the right to opt out of receiving marketing or advertising emails at any time by:

  • using the relevant unsubscribe link in the email; or
  • contacting the support service email address.

8.5. Opting out of marketing mailings does not affect the receipt of service and mandatory informational messages necessary for the functioning of the Application and the servicing of the account.

9. TRANSFER OF DATA TO THIRD PARTIES

9.1. General principle. The Company ensures the confidentiality of the User’s personal data and does not transfer it to third parties, except in the cases specified by this Policy and by the legislation of Ukraine.

9.2. Categories of recipients. Users’ data may be transferred to third parties solely for the purpose of ensuring the operation of the Application, in particular to the following categories of recipients:

  • Hosting providers and infrastructure suppliers (for hosting the server side, databases and ensuring the availability of the service).
  • Payment services / distribution platforms (for making and administering payments): Apple App Store and/or Google Play (as well as the payment mechanisms associated with them).
  • Analytics and technical services (for usage analytics, stability and error processing — for example, Firebase and Sentry).
  • Email services (for sending service and informational messages, as well as marketing ones, which you can unsubscribe from at any time).

9.3. Grounds for transfer. Transfer of data to third parties may be carried out:

  • if this is necessary for the performance of the agreement with the User (for example, transfer of data to payment systems in order to make a payment to provide technical support, analytics and improvement of the Application’s functionality (subject to security and confidentiality measures);
  • in the event of compliance with the requirements of the legislation of Ukraine or with the lawful requests of authorized bodies.

9.4. Principles of transfer and limitations.

  • We transfer only the minimum amount of data necessary to achieve the relevant purpose.
  • Transfer to service providers is carried out, as a rule, on the basis of agreements and/or terms that provide for confidentiality and data protection requirements.
  • Apple and Google (within the App Store/Google Play and “Sign in with Apple”/Google account) may process certain data as independent controllers in accordance with their own policies; the Company does not control such processing outside the functionality of the Application.

9.5. List of services. The Company uses the following services, each only for the stated purpose:

  • Amazon Web Services — servers, database and files of the App, and sending service emails such as sign-in codes (Amazon SES);
  • Google Firebase — usage analytics (in-app events, a technical identifier) and push delivery (device token);
  • Sentry — detecting and fixing errors (technical crash data, including the request during which it happened; account ID; IP address);
  • AppsFlyer — measuring Yummo’s advertising campaigns (install, sign-up and purchase data; advertising identifier — see clause 6.4);
  • RevenueCat — managing subscriptions (purchase data, a random identifier);
  • eSputnik (Reteno) — email and push messages: email, name, phone number if you gave one, the child’s first name, date of birth, sex and feeding stage, subscription status and purchases, app opens;
  • Google Workspace — our email (the messages and requests you send us);
  • Anthropic — recognizing foods in a photo of the plate (the photo, without its metadata). Anthropic acts as a processor under its contract with the Company and does not train its models on these photos;
  • Google, Apple, the App Store and Google Play — signing in with your account and paying for the subscription. They act as independent controllers (clause 9.4).

On the Website, Google Analytics and Google Ads run only with your consent (clauses 6.7–6.11).

10.DATA STORAGE

10.1. Place of storage. Users’ personal data is stored in a database hosted on Amazon Web Services (AWS) servers.

10.2. Access control. Access to personal data is limited and controlled: it is held only by authorized employees and/or engaged contractors of the Company to the extent necessary to perform their functions (the “need-to-know” principle). The Company also takes the necessary technical and organizational measures to protect data from unauthorized access, loss, damage or disclosure.

10.3. Purpose-based use. Data is processed and stored solely for purposes related to the functioning of the Application (in particular authorization, personalization, provision of the subscription, technical stability and communication), in accordance with this Policy.

11.DATA PROTECTION

11.1. General approach. The Company implements the necessary technical and organizational measures to protect Users’ personal data from accidental loss, unlawful destruction, unauthorized access, alteration, disclosure or other unlawful use, in compliance with confidentiality and security requirements.

11.2. Technical security measures. Depending on the nature of the data and the risks, the Company applies, in particular, the following measures:

  • access control to infrastructure and databases (restriction of access rights);
  • journaling (logging) of technical events and monitoring of stability/errors;
  • measures to protect against unauthorized access at the level of the server infrastructure;
  • data backup to minimize the risks of loss (more details — in section 12).

11.3. Organizational measures.

  • Access to personal data is granted only to authorized employees and/or contractors of the Company to the extent necessary to perform their functions.
  • The Company maintains internal rules and procedures for working with data and monitors compliance with the confidentiality regime.

11.4. Important disclaimer. No method of storing or transferring data can guarantee absolute security. At the same time, the Company makes reasonable efforts to ensure an appropriate level of data protection, taking into account the nature of the processing and the risks.

12.BACKUP

12.1. Backup procedures. The Company carries out regular backup of data for the purpose of:

  • ensuring the continuity of the Application’s operation and restoring the availability of the service in the event of technical failures;
  • protecting against loss or damage to data as a result of errors, infrastructure failures or other incidents.

12.2. Access to backups. Access to backups is limited and controlled and is granted only to authorized persons to the extent necessary to perform their functions (the “need-to-know” principle).

12.3. Use of backups. Backups are used solely to restore data and/or to keep the service running, and are not used for any other purposes incompatible with this Policy.

13.ACCOUNT AND DATA DELETION

13.1. Initiating account deletion. The User may initiate deletion of their account within the App’s functionality (where such an option is available) or contact the Company via the contact for personal data protection matters: contact@yummoapp.com.

13.2. Consequences of account deletion. After an account is deleted:

  • access to the account is blocked, and the User loses the ability to use functionality that requires authorization;
  • the User’s personal data is deleted or anonymized in accordance with this Policy and within the periods set out in Section 14;
  • data stored in backups may remain there temporarily until the next overwrite/update cycle, but is not used for any purposes other than restoring the service, and is subject to deletion/overwriting as part of standard backup procedures (see Section 12).

13.3. Exceptions. The Company may store certain data longer if this is necessary to comply with legal requirements (in particular, regarding financial reporting) or to protect the rights and legitimate interests of the Company (for example, in the event of disputes).

14.DATA RETENTION PERIODS

14.1. General retention period. Personal data is stored for as long as necessary to achieve the processing purposes defined in this Policy, and within the periods established by the legislation of Ukraine.

14.2. After account deletion. If an account is deleted, the User’s personal data is deleted or anonymized within 30 (thirty) calendar days from the date of account deletion.

14.3. Exceptions to the retention periods. The Company may store certain categories of data longer than stated in clause 14.2 if this is necessary:

  • to comply with legal requirements (in particular, regarding financial/tax reporting and confirmation of payments);
  • to establish, exercise or defend the Company’s legal claims (for example, in the event of disputes);
  • in the form of anonymized (de-identified) data — for example, analytical information that does not allow a specific User to be identified.

14.4. Backups. Data may be temporarily stored in backups in accordance with backup procedures (see Section 12) and is deleted/overwritten as part of standard backup cycles.

14.5. Plate photos. A plate photo is kept for as long as at least one food from it is in the diary. It is deleted when you delete the meal or the last food from the photo, when you remove the photo from the meal (“Remove photo” on the meal’s edit screen), and right after you ask to delete your account, without waiting 30 days. A photo whose foods you did not save to the diary is deleted within 25 hours.

15.USER RIGHTS

15.1. General rights. The User has rights in relation to their personal data under the legislation of Ukraine, in particular the right:

  • to receive information about the processing of their personal data and to access it;
  • to request correction of inaccurate or outdated data;
  • to request deletion of personal data in the cases provided for by law and by this Policy;
  • to request restriction of the processing of personal data in the cases provided for by law;
  • to withdraw consent to data processing — in cases where the processing is based on consent (withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal);
  • to opt out of marketing messages at any time.

15.2. How to exercise these rights. To exercise their rights, the User may contact the Company via the contact for personal data protection matters: contact@yummoapp.com (see Section 19).

15.3. Identifying the request. To protect data, the Company may ask for additional information to confirm the identity of the person making the request and/or that the request relates to the relevant account.

15.4. Managing communications.

  • The User may not be able to opt out of service email messages (for example, about registration, security or payments), as they are necessary to provide the service.
  • The User may opt out of marketing email mailings at any time (via the instructions in the email or by contacting the Company).
  • Push notifications can be turned off in the device settings (see Section 7).

16.PROCESSING OF CHILDREN’S DATA

16.1. Who enters the child’s data. The App is intended for use by parents/the mother/other legal representatives (guardians). Data about the child is entered directly by the User.

16.2. Voluntary nature and purposes. Data about the child (in particular, name, date of birth/age, sex, foods introduced, dietary restrictions, notes on reactions to foods, and food tracking data) is entered voluntarily and is used solely to personalize the functionality and content of the App (for example, to generate recommendations and display information in line with the parameters entered).

16.3. Responsibility for accuracy. The User confirms and agrees that they have the proper authority as the child’s legal representative and are responsible for the accuracy and currency of the data they enter about the child.

16.4. No commercial exploitation. The Company does not commercially exploit children’s data, does not create advertising profiles, and does not carry out behavioral tracking of children for targeted advertising.

17.INTERNATIONAL DATA TRANSFERS (FUTURE-PROOF)

17.1. Possibility of processing outside Ukraine. Given the use of cloud infrastructure and technical/analytics services, Users’ personal data may be processed (stored and/or transferred) outside Ukraine — solely to the extent necessary to keep the Application running.

17.2. Safeguards for an adequate level of protection. In the event of a cross-border transfer (international processing), the Company takes measures to ensure an adequate level of protection of personal data, in particular it:

  • transfers data only where there are grounds provided for by law and by this Policy;
  • where possible, concludes agreements/terms with service providers that set out confidentiality and security obligations;
  • applies technical and organizational data protection measures in line with this Policy and internal procedures.

17.3. Link to acceptance of the terms. By using the Application, the User confirms that they have read this Policy and agree to the terms of personal data processing, including the possibility of cross-border processing within the limits set by this Policy.

18.CHANGES TO THE PRIVACY POLICY

18.1. Right to amend the document. The Company has the right to change or supplement this Privacy Policy from time to time, or to issue it in a new version.

18.2. How Users are notified. The Company may notify the User of changes to the Privacy Policy, in particular by:

  • push notifications in the Application;
  • a notice in the profile/interface of the Application;
  • sending a message to the email address provided by the User;
  • any other method the Company considers sufficient.

18.3. Effective date. A new version of the Privacy Policy takes effect from the moment it is published in the Application and/or on the Company’s website, unless the relevant version expressly states otherwise.

18.4. Acceptance of changes. Continued use of the Application after a new version of the Privacy Policy takes effect means that the User has read the updates and agrees to them.

19.CONTACT FOR THE RESPONSIBLE PERSON (DATA PROTECTION CONTACT / DPO)

19.1. Contact for personal data protection matters (DPO / Data Protection Contact):
contact@yummoapp.com

19.2. Official communication channel with the Company (general inquiries/support):
hello@yummoapp.com

20.ADDITIONAL INFORMATION FOR USERS IN THE EU, EEA AND UK (GDPR)

20.1. If you are in the European Union, the European Economic Area or the United Kingdom, the EU General Data Protection Regulation (GDPR) and the UK GDPR also apply to the processing of your data. Where this section differs from other sections of this Policy, this section applies to you.

20.2. The controller is YAMMO LLC, EDRPOU code 45183471, Akademika Filatova St. 1/22, office 13, Kyiv 01042, Ukraine; contact@yummoapp.com.

20.3. Legal bases:

  • the account, running the App, the subscription and service messages — performance of our contract with you (Art. 6(1)(b) GDPR);
  • the child’s profile and the food diary — legitimate interests, yours and ours, in running the features you chose (Art. 6(1)(f));
  • food recognition from a photo and the plate photo in the diary — performance of our contract with you: it is a feature you chose (Art. 6(1)(b) GDPR);
  • a child’s allergies, dietary restrictions and reactions — your explicit consent, given as the child’s parent or guardian when you enter this data for food suggestions (Art. 9(2)(a)). You can withdraw it at any time by deleting this data in the child’s profile or deleting your account;
  • analytics, error detection, security and measuring our advertising campaigns — legitimate interests (Art. 6(1)(f)). The iPhone advertising identifier is used only with your permission in the iOS prompt;
  • marketing emails and push notifications — legitimate interests (Art. 6(1)(f)), and you can opt out at any time;
  • payment records and complying with the law — legal obligation (Art. 6(1)(c)) or our legitimate interest in complying with Ukrainian law.

20.4. Your rights: to access your data and get a copy; to rectification; to erasure; to restriction of processing; to data portability (receiving your data in a machine-readable format); to withdraw consent; and to lodge a complaint with the data protection authority of the country where you live or work (in the UK, the ICO, ico.org.uk). We respond within one month, free of charge.

20.5. Right to object. You can object at any time to processing based on legitimate interests, including analytics and marketing. We stop marketing immediately and without exception. Write to contact@yummoapp.com or use the unsubscribe link in the email.

20.6. Transfers outside the EU. Some services in clause 9.5 process data outside the EU, including in the United States, and the Company itself is based in Ukraine. Such transfers rely on the European Commission’s standard contractual clauses or on the provider’s certification under the EU–US Data Privacy Framework. You can request a copy of the safeguards.

20.7. Retention periods are set out in section 14. The Company does not make automated decisions that have legal or similarly significant effects on you. The App is intended for adults — parents and guardians — and is not directed at children.