1. Controller
The controller is Hugo Daniel Parrales López, an individual based in San Salvador, Republic of El Salvador.
Hugo Daniel Parrales López also acts as the data protection delegate. For privacy, consent withdrawal, incidents, or free ARCO-POL rights requests, email hugo@parrales.es.
2. Data we process
We process only the data needed to provide and protect the service, depending on the features you choose.
- Account and contact: first and last name, email, user ID, and credentials protected by WordPress. We cannot view your password in readable form.
- Body profile and goals — sensitive data: sex, age, height, current and target weight, activity, calorie goal, time zone, BMI, BMR, and derived estimates.
- Wellness logs — sensitive data: meals, calories, macronutrients, weight, optional body-fat percentage, body measurements, favorites, and progress history.
- GLP-1 log — sensitive health data: medication entered by the user, dose, interval, dates, observed effects, side effects, and notes. Kcalories does not prescribe or validate treatment.
- AI content: food descriptions, hints, and meal photos you choose to analyze.
- Buddy feature: linking code, display name, and a comparison of consumed calories against the daily goal.
- Technical data: IP address, date, device or user agent, language, time zone, security events, and logs needed to prevent abuse and diagnose failures.
3. Why we use data
Applicable grounds include providing the requested service, your separate express consent for sensitive data and required transfers, legitimate interests in security and technical improvement, and legal obligations. You may withdraw consent by emailing hugo@parrales.es; withdrawal does not affect prior processing or data that must be kept under another legal basis.
The primary framework is El Salvador’s Personal Data Protection Law, Legislative Decree No. 144, together with mandatory rules that apply based on the user’s location.
You are not required to provide sensitive data. If you do not grant that consent, you may still view public content, but you cannot create a personal account or use features that depend on those data.
- Create and manage your account, authenticate you, and sync the web and app.
- Save your records and show calculations, charts, comparisons, and trends.
- Analyze food by text or photo when you request the AI feature.
- Enable an optional comparison with someone you trust.
- Recover passwords, answer support, and communicate important service changes.
- Protect Kcalories, limit abuse, maintain technical logs, and meet legal duties.
4. Photos, text, and artificial intelligence
When you use artificial intelligence analysis, the Kcalories server sends the selected photo or description and the required instruction to a specialized external provider to estimate foods, calories, and macronutrients. Your name and email are not included in that request.
The photo is processed temporarily and is not added to a Kcalories media library or kept by Kcalories as a permanent file; you can review the result before saving nutrition data. The provider is instructed not to create application state from submitted content. Temporary security and abuse-monitoring logs may still exist for a customary maximum of 30 days unless different controls or legal obligations apply.
Do not upload faces, documents, third-party data, or images you have no right to process. AI estimates may be wrong and must always be reviewed.
5. Data shared with a buddy
The Buddy feature is optional and requires a linking code. Once linked, both accounts can see the display name and a daily comparison of calories against the goal. Email, photos, GLP-1 notes, weight, measurements, and detailed meal lists are not shared. Either person can unlink at any time.
6. Advertising and public analytics
Kcalories may use Google AdSense on the homepage, articles, and other public pages. Advertising is not inserted into the native app or authenticated areas where you view or enter health and wellness information. Private account data is not given to advertisers or used to personalize ads.
On public pages, Google and its partners may use cookies, IP address, and device information to measure, limit, and serve ads only after applicable consent choices. Visitors in the EEA, UK, or Switzerland will be shown a Google-certified consent platform before eligible advertising. See the Cookie policy.
7. Providers and transfers
Current primary processors are BanaHosting for WordPress hosting, database, email, and backups on United States infrastructure; an international provider specializing in artificial intelligence for requested text or photo analysis; and Google for AdSense and its consent platform on public pages only. Links provide contact channels and privacy details where applicable.
Some providers may process data outside El Salvador. Reasonable contractual and technical safeguards are used where applicable. We do not sell, rent, or trade personal data. We may disclose information only under a valid legal duty or to protect people, security, and rights.
If a processor receiving personal data changes, we will update this policy and obtain new authorization when the purpose or transfer requires it.
8. Retention and deletion
- Account and records: while you keep the account. In-app deletion removes the WordPress account and associated production records immediately.
- Sessions: tokens expire after no more than 90 days and are also invalidated on logout or account deletion.
- Backups: restricted or encrypted rotating copies may remain for up to 30 days and are not restored for ordinary use.
- Technical logs: normally up to 90 days, longer only for a security incident or legal duty.
- Support: up to 24 months after the request closes, unless law or a valid deletion request requires otherwise.
- Artificial intelligence processing: Kcalories requests that no application state be stored; standard abuse-monitoring logs may still remain for a customary maximum of 30 days, subject to provider controls and legal obligations.
9. Your choices and rights
You can review and correct profile information, delete individual records, unlink a buddy, and permanently delete your account. You may also exercise the ARCO-POL rights free of charge: access, rectification, cancellation, objection, portability, erasure, and restriction, and withdraw consent.
Email hugo@parrales.es from the address linked to your account, describing the right you wish to exercise and information needed to locate the account. We may request limited identity verification. We will respond within 20 business days, with one justified extension where the law allows. You can also review the account-deletion instructions.
10. Security
We use HTTPS, token authentication, WordPress credential storage, request limits, and access controls. No system is absolutely secure. If we identify a personal-data breach, we will document it, take corrective action, and make legally required notifications within the applicable maximum period of 72 hours after becoming aware of it.
11. Minimum age
Public content can be viewed without an account. Accounts and personal logging features are intended for people 18 or older. We do not knowingly collect data from minors. If you believe a minor created an account, contact us so it can be reviewed and deleted.
12. Changes and contact
We may update this policy when features or providers change. We will publish the effective date and provide reasonable notice of material changes. Contact: hugo@parrales.es, San Salvador, El Salvador.