Privacy policy

1. Data controller

Malika Barré, MB infosystems, Rue de l'Euchette 30, 2605 Sonceboz-Sombeval, Switzerland.

This policy explains, in accordance with the Swiss Federal Act on Data Protection (FADP), what data WaistLog processes, why, and what your rights are.

2. Data we process

Depending on your use of the Service:

• account data: email address, password (stored only in encrypted form), name or username, avatar, language;
• profile and health data you enter: date of birth, sex, height, activity level, weight, waist circumference, target weight, food diary, recipes and typical meals. These data relate to your health: they are particularly sensitive and are processed only with your consent;
• questions sent to Companeo (AI) and, for the analysis of a day, the relevant meals;
• subscription and payment data: plan, dates, amounts and payment references (your card data are processed by Stripe and are not transmitted to us);
• technical data: IP address, date and time of connection, login attempts, administration action log, browser;
• messages you send us via the contact form.

3. Purposes and legal bases

We process your data to: provide the Service and manage your account (performance of the contract); calculate your summaries and display your tracking (your consent, for health data); respond to your questions and requests; manage subscriptions and payments; ensure the security of the Service and prevent abuse; comply with our legal obligations; display advertisements in the free version. We do not sell your data and do not make fully automated decisions having legal effects on you.

4. Service providers and recipients

We use service providers that process data on our behalf:

• hosting: o2switch (France);
• payments: Stripe;
• anti-robot protection at login and registration: Cloudflare Turnstile;
• Companeo (artificial intelligence): a third-party AI provider (currently Groq), to whom your questions are transmitted to generate the response;
• advertisements (free version): a possible advertising partner, which may use cookies or similar technologies;
• email sending: the messaging service of our host.

We do not transmit your data to other third parties, except where required by law.

5. Transfers abroad

Some service providers are located outside Switzerland, notably in France and the United States. Where the country does not offer a level of protection recognised as adequate, we ensure appropriate safeguards (for example standard contractual clauses or the Swiss–US Data Privacy Framework where the provider is certified).

6. Cookies

The Service uses cookies necessary for its operation: session cookie (login), language cookie, and security elements (anti-robot protection). We do not use audience measurement tools. If advertisements are displayed, the advertising partner may place its own cookies; you can refuse or delete them in your browser settings.

7. Retention period

We retain your data for as long as your account is active. If you delete your account, your personal data are deleted, subject to data that the law requires us to keep (for example payment records) and backup copies, which are overwritten after a limited period. Technical logs are retained for a limited period.

8. Security

We take reasonable technical and organisational measures: encrypted connection (HTTPS), encrypted passwords, limitation of login attempts, restricted access to data. No system is infallible: in the event of a data security breach presenting a high risk to you, we will inform you and, if necessary, inform the Federal Data Protection and Information Commissioner (FDPIC).

9. Your rights

You have the right to request access to your data, their rectification, their deletion, the provision of your data in a common format (portability), as well as to object to processing or withdraw your consent at any time (for the future). From your profile, you can modify and export your data and delete your account. For any other request, use our contact form; we will respond within 30 days.

10. Children

The Service is intended for persons aged at least 16. If you believe a child has transmitted data to us, contact us so that we can delete them.

11. Modifications

We may update this policy, for example if the Service evolves. The applicable version is the one published on this page, with its update date.