Privacy policy

Last updated: June 17, 2026

Qalzy Ltd

Registered Address: 128 City Road, London EC1V 2NX, UK

Company No: 14914986

Last Updated: June 3, 2026

Introduction

At Qalzy Ltd ("Qalzy", "we", "us", or "our"), protecting your personal data is fundamental to how we operate. Our product, the Qalzy smart kitchen scale and companion app, is designed to help you understand what you eat. We recognise that food and nutrition data is personal, and we are committed to being transparent about what data we collect, why we collect it, how we use it, and your rights over it.

This Privacy Policy ("Policy") applies to all personal data Qalzy processes when you:

Visit our website at https://qalzy.com and any subdomains ("Site");
Purchase, register, or use the Qalzy smart kitchen scale ("Device");
Download and use the Qalzy mobile or web application ("App"); or
Contact us for customer support or any other purpose.

Together, the Site, Device, App, and related services are referred to as the "Services".

Who we are: Qalzy Ltd is incorporated under the laws of the United Kingdom, with registered office at 128 City Road, London EC1V 2NX, United Kingdom. For the purposes of UK GDPR and EU GDPR, Qalzy Ltd is the data controller of your personal data.

Data Protection Contact (DPC): Kostantinos Koukoravas

Data Protection contact: For any questions or requests about this Policy or your personal data, please contact the DPO at info@qalzy.com.

If you have a question or complaint that we have not resolved to your satisfaction, you have the right to contact your local supervisory authority. For UK residents, this is the Information Commissioner's Office (ICO) at ico.org.uk. For EU residents, this is your national data protection authority. For US residents: Certain US states (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Texas, Utah, and Virginia) give you the right to appeal a decision we make in response to your data rights request. If you are unsatisfied with our response, you may submit a complaint to your state Attorney General's office.

1. Data We Collect

We collect the following categories of personal data, depending on how you interact with our Services:

1.1 Account and Contact Information

Full name, email address, and password when you register for a Qalzy account.
Billing name and address when you make a purchase.
Phone number, if you choose to provide it for support purposes.

1.2 Profile and Health-Related Information

Physical attributes you optionally provide, such as age, biological sex, height, and weight, used to calculate personalised nutritional estimates.
Dietary preferences, allergen information, or health goals you choose to add to your profile.
Meal logs, food entries, portion weights, and recipes you create or scan using the Device and App.
Nutritional totals and trends calculated from your logged data (e.g., estimated daily calorie and macronutrient intake).

1.3 Device and Usage Data

Data transmitted by your Qalzy Device, including weight measurements, timestamps, images captured by you using your Qalzy Device
account data, and connectivity metadata (e.g., Wi-Fi or Bluetooth pairing logs).
App usage data, including screens viewed, features used, session duration, and in-app interactions.
Device identifiers, operating system type and version, app version, and browser type.

1.4 Transaction and Payment Data

Order details, including items purchased, order value, shipping address, and order history.
Payment is processed by third-party payment processors (e.g., Stripe, Apple Pay, Google Pay, Shopify Payments, Daily Grabs, Inc. d/b/a Portless, Openborder Inc, Redo Tech Inc). Qalzy does not store your full payment card number. We receive only a payment token and summary information (e.g., last four digits, card type, billing postcode).

1.5 Communications Data

Messages, emails, or live chat records when you contact our support team.
Survey responses, reviews, or feedback you voluntarily provide.

1.6 Cookies and Tracking Data

Information collected via cookies, pixel tags, and similar technologies when you visit the Site. See Section 15 (Cookie Policy) for full details.

1.7 Third-Party Integration Data

If you choose to connect the Qalzy App with third-party platforms (e.g., Apple Health or Health Connect), we may receive or share data with those platforms according to your permissions and their own terms. Such integrations are always opt-in.

2. How We Collect Your Data

We collect personal data:

Directly from you, when you create an account, place an order, log meals, complete onboarding, contact support, or respond to surveys.
Automatically, via the Device and App during normal use, and via cookies and tracking technologies on the Site.
From third parties, such as payment processors confirming completed transactions, app stores (Apple App Store, Google Play) providing download and purchase records, or analytics providers helping us understand how the Services are used.
From third-party integrations, such as Apple Health or Health Connect, when you have granted permission to share data between platforms.

3. Legal Bases for Processing (UK GDPR / EU GDPR)

We only process your personal data where we have a valid legal basis to do so. The table below sets out our lawful bases for each category of processing:

Processing Purpose	Legal Basis
Creating and managing your account	Contract — necessary to perform our contract with you
Processing and fulfilling your order	Contract — necessary to perform our contract with you
Providing the Device and App features (nutrition tracking, AI recognition, meal history)	Contract — necessary to deliver the Services you have requested
Processing health-related or dietary data you enter (Article 9 data)	Explicit Consent — we ask for your consent during onboarding; you may withdraw at any time Article 6 basis: Contract — necessary to deliver the Services you have requested
Sending you service communications (order confirmations, app updates, account alerts)	Contract / Legitimate Interests — necessary to provide the Services
Improving and developing our Services (including AI model improvements using aggregated, anonymised data)	Legitimate Interests — our interest in developing better products, balanced against your privacy rights
Sending you direct marketing emails	Consent — we ask for your opt-in; you may unsubscribe at any time
Analytics and performance monitoring	Legitimate Interests — understanding how the Services perform and are used
Fraud prevention and security	Legitimate Interests / Legal Obligation
Complying with applicable law (e.g., tax records, legal claims)	Legal Obligation
Responding to law enforcement or court orders	Legal Obligation / Vital Interests (where required)

Withdrawing consent: Where we rely on consent as our legal basis, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before you withdrew consent. To withdraw consent, use the settings in the App or contact info@qalzy.com.

4. How We Use Your Data

We use your personal data for the following purposes:

4.1 Providing and Operating the Services

Registering and managing your account.
Processing, fulfilling, and shipping orders for the Device.
Enabling the App to read weight measurements from the Device and generate nutritional estimates.
Displaying your meal logs, recipe history, and nutritional trends.
Providing customer support.

4.2 Personalisation

Customising nutritional targets and recommendations based on the physical attributes and goals you provide.
Improving AI food recognition accuracy using your feedback within the App.

4.3 Service Improvement and Research

Analysing aggregated, de-identified usage patterns to improve the App, AI models, and food recognition features.
Conducting internal research to develop new product features.
Using external nutrition databases and third-party food composition services to estimate nutritional values for foods. These providers receive technical query information but do not receive information that directly identifies you.
We do not use identifiable personal data to train AI models or conduct research without your explicit consent.

4.4 Marketing and Communications

Sending you order and shipping confirmations, account security notices, and Service updates (these are not marketing and cannot be opted out of while your account is active).
Sending you promotional emails, product news, and offers, only if you have opted in.
Targeted advertising on third-party platforms (e.g., Meta, Google), only where you have consented, or where permitted under applicable law and our Cookie Policy.

4.5 Compliance and Protection

Meeting our legal and regulatory obligations.
Investigating and preventing fraud, misuse, or abuse of the Services.
Exercising or defending legal claims.

5. Cookies and Tracking Technologies

We use cookies and similar technologies (such as pixel tags and local storage) on our Site and, where applicable, within the App and related Services. Full details — including the types of cookies we use, our consent approach, how long they last, and how to manage or delete them — are set out in Section 15 (Cookie Policy) of this document.

6. How We Share Your Data

Qalzy does not sell your personal data. We share personal data only as described below:

6.1 Service Providers (Data Processors)

We work with trusted third-party companies that process personal data on our behalf, under our instructions and under data processing agreements. These include:

Cloud infrastructure and hosting (e.g., Amazon Web Services — see Section 9 for international transfers)
Payment processors (e.g., Stripe, Shopify Payments)
Email and marketing automation platforms (e.g. Klaviyo)
Customer support tooling (e.g. Intercom)
Analytics providers (e.g., Google Analytics)
AI/ML processing used to power food recognition features
3PL, returns, Tax and duty compliance partners (e.g. Openborder, Daily Grabs Inc, Redo Tech Inc.)
Storefront hosting and commerce platform (Shopify), which provides our online store infrastructure, checkout, payment, and order management services. Shopify processes your personal data in accordance with its own privacy policy and data protection obligations.

All service providers are required to process your data only for the purposes we specify, to maintain appropriate security, and to comply with applicable data protection law.

6.2 Third-Party Integrations (Your Choice)

If you connect the App to a third-party platform (e.g., Apple Health, Health Connect), we will share the data you select with that platform. These transfers are always subject to your permission and the third party's own privacy policy. Qalzy is not responsible for how third parties handle data once received.

6.3 App Store Operators

Purchases made through the Apple App Store or Google Play are processed by those platforms under their own terms. We receive limited purchase confirmation data from app stores.

6.4 Legal Requirements and Law Enforcement

We may disclose personal data if required to do so by applicable law, regulation, court order, or valid governmental request. We will notify you of such requests where we are legally permitted to do so, and we will challenge requests we believe to be overly broad, unclear, or legally invalid.

6.5 Business Transfers

In the event of a merger, acquisition, sale of assets, or other corporate restructuring, your personal data may be transferred to the relevant successor entity. We will notify you of any such transfer and of any changes to this Policy.

6.6 Professional Advisors

We may share personal data with lawyers, accountants, auditors, and insurers where reasonably necessary for the services they provide to us, and subject to confidentiality obligations.

7. Your Rights

Under UK GDPR and EU GDPR, you have the following rights in relation to your personal data:

Right & What it means:

Right of access: Request a copy of the personal data we hold about you

Right to rectification: Ask us to correct inaccurate or incomplete data

Right to erasure ("right to be forgotten"): Ask us to delete your personal data, subject to legal retention obligations

Right to restriction: Ask us to pause processing of your data in certain circumstances

Right to data portability: Receive your data in a structured, machine-readable format, where technically feasible

Right to object: Object to processing based on legitimate interests, including direct marketing

Right to withdraw consent: Withdraw consent at any time where consent is the legal basis

Rights related to automated decision-making: Request human review of any wholly automated decisions that significantly affect you

How to exercise your rights: Email info@qalzy.com or write to our registered address. We will respond within one calendar month of receiving your request (or two months where the request is complex, with prior notice). We will not charge a fee for requests, unless they are manifestly unfounded or excessive.

We may need to verify your identity before processing your request to protect your privacy.

If you are unhappy with how we have handled your request, you have the right to lodge a complaint with a supervisory authority:

UK: Information Commissioner's Office (ICO) — ico.org.uk
EU: the supervisory authority in your EU country of residence.

8. Data Retention

We retain your personal data for as long as is necessary for the purposes described in this Policy, or as required by law.

Data Category & Retention Period:

Account and profile data: Until account deletion, plus up to 30 days for backup purge

Meal logs and nutritional data: Until you delete individual entries

Order and transaction data: 7 years from the date of transaction (UK tax and accounting law)

Customer support communications: 2 years from the date the support ticket is resolved; or for the duration of your active account if the issue remains unresolved. Communications relevant to a live legal dispute may be retained for up to 6 years from the date of the incident.

Marketing consent records: Until consent is withdrawn

Device usage and analytics data (aggregated/anonymised): May be retained indefinitely once it no longer identifies you

When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are legally required to retain it for a longer period (e.g., financial records).

We may retain personal data for longer where necessary to establish, exercise, or defend legal claims.

You can request deletion of your account via the App settings or by emailing info@qalzy.com.

9. International Data Transfers

Qalzy Ltd is based in the United Kingdom. Our cloud infrastructure is hosted on Amazon Web Services (AWS), which processes your data on servers located in the UK, EU, and the United States.

Whenever we transfer personal data outside the UK or EEA to countries that do not provide an equivalent level of data protection, we ensure appropriate safeguards are in place, including:

UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs) with all relevant service providers; or
Transfers to countries subject to a UK or EU adequacy decision.

You can request a copy of the safeguards in place for international transfers by contacting info@qalzy.com.

10. Data Security

We implement technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

Encryption of data in transit (TLS/HTTPS) and at rest.
Strict access controls and role-based permissions for staff.
Regular security assessments and vulnerability testing.
Pseudonymisation or anonymisation of data used for analytics and AI model improvement.

No security system is entirely infallible. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and we will notify affected individuals without undue delay where required by law.

11. Children's Privacy

The Services are not directed at, and are not intended for use by, children under the age of 16 (or the applicable age of digital consent in your country, if higher). We do not knowingly collect personal data from children.

If you believe a child under the applicable age has provided us with personal data without appropriate parental or guardian consent, please contact us at info@qalzy.com and we will delete that data promptly.

12. Third-Party Links and Integrations

The Site or App may contain links to third-party websites or services (e.g., partner retailers, Apple Health, Health Connect, nutrition databases). Qalzy is not responsible for the privacy practices of these third parties. We recommend that you review the privacy policy of any third-party service before using it or connecting it to your Qalzy account.

13. AI Features and Automated Processing

The Qalzy App uses AI-based food recognition and nutritional estimation to provide the core features of the Service. This involves automated processing of images and weight data to identify foods and estimate nutritional values.

These automated features produce estimates, not definitive nutritional facts. We are not a medical device and our outputs are not medical advice. See also our Terms and Conditions.
We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects on you.
We use aggregated and de-identified data to improve our AI models. We do not use identifiable data for model training without your explicit consent.
If in the future we wish to use identifiable personal data to train our AI models or for research purposes, we will ask for your explicit consent in the App before doing so. We will clearly explain what data will be used and for what purposes. You may withdraw this consent at any time in your App settings, after which we will stop using your identifiable data for those training or research purposes.

14. Marketing Communications

We will send you promotional emails and product updates only if you have opted in to receive them either at the point of account creation, at checkout, or subsequently via your account settings.

You can unsubscribe from marketing emails at any time by:

Clicking the "Unsubscribe" link at the bottom of any marketing email, or
Updating your preferences in the App or on the Site; or
Emailing info@qalzy.com.

You cannot unsubscribe from transactional and service messages (e.g., order confirmations, shipping updates, security alerts) while your account is active, as these are necessary for the provision of the Services.

15. Cookie Policy

We use cookies and similar tracking technologies (such as pixels and local storage) on our Site and within our Services. This section explains what these technologies are, how we use them, and how you can control them.

15.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website or use an app. They help websites remember your preferences and understand how you interact with our Services. Similar technologies include pixel tags, web beacons, and local storage, which function in comparable ways.

15.2 Categories of Cookies We Use

We use the following categories of cookies:

(a) Strictly Necessary Cookies

These cookies are essential for the Site and Services to function. They enable core features such as security, account login, shopping cart functionality, and fraud prevention. These cookies cannot be disabled as they are required for the Services to operate.

(b) Functional Cookies

These cookies allow us to remember your preferences and settings (such as language, region, and display choices) to provide a more personalised experience. Disabling them may affect how the Services function.

These cookies help us understand how visitors use our Site — for example, which pages are visited most, how long users stay, and where they come from. This information is collected in aggregate form and helps us improve our Services. Analytics cookies are only placed with your consent.

(d) Marketing and Advertising Cookies

Marketing and Advertising Cookies: Used to deliver relevant adverts on platforms including Meta (Facebook/Instagram), measure campaign effectiveness, limit ad frequency, and track conversions. This includes the Meta Pixel. Placed only with consent.

15.3 Cookie Consent

When you first visit our Site, you will be presented with a cookie consent banner. You can choose to:

Accept all cookies (including analytics and marketing);
Reject all non-essential cookies; or
Manage your preferences to enable or disable individual cookie categories.

Strictly necessary cookies are always active and do not require your consent. For all other categories, we will not set cookies until you have given your explicit consent.

You can withdraw or change your consent at any time by clicking the "Cookie Preferences" link in the footer of our Site.

15.4 How Long Do Cookies Last?

Cookies may be:

Session cookies: deleted automatically when you close your browser; or
Persistent cookies: remain on your device for a set period (typically between 30 days and 2 years) or until you delete them manually.

15.5 How to Manage or Delete Cookies

In addition to our cookie consent tool, you can control cookies through your browser settings. Most browsers allow you to:

View and delete existing cookies;
Block cookies from specific or all websites;
Be notified before a new cookie is set.

Please note that blocking cookies — especially strictly necessary ones — may affect the functionality of our Site and Services. Instructions for managing cookies in common browsers are available via the browser provider's support pages.

Do Not Track / Global Privacy Control: Some browsers have a 'Do Not Track' (DNT) or 'Global Privacy Control' (GPC) feature that lets you signal to websites that you do not want your online activities tracked. If you activate these signals, our Marketing and Analytics cookies will be deactivated for your session. Please note that if you delete your cookies or use a different browser or device, you will need to reconfigure your settings.

15.6 Third-Party Tracking Technologies

We use third-party analytics and advertising services on our Site that may set their own cookies and tracking technologies to collect data about your use of our Site and other websites. These services include:

• Meta Pixel (Meta Platforms, Inc.): We use the Meta Pixel to measure the effectiveness of our advertising campaigns on Facebook and Instagram, track conversions, and build Custom Audiences for retargeting. The Meta Pixel may collect data such as pages visited, actions taken, and device information, and may associate this with your Facebook/Instagram account if you are logged in. Meta's use of this data is governed by Meta's Privacy Policy (facebook.com/privacy/policy). You can opt out of Meta's interest-based advertising at facebook.com/ads/preferences.

• Analytics Services: We use analytics tools (e..g Google Analytics, Meta Analytics, Mixpanel) to understand how visitors use our Site (e.g., pages visited, session duration, traffic sources). Data is collected in aggregate where possible.

We do not control these third parties' use of tracking technologies, and their practices are governed by their own privacy policies. We do not share your personal data with advertising partners in a way that identifies you by name without your explicit consent.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our Services, data processing practices, or applicable law. When we make material changes, we will:

Post the updated Policy on the Site with a new "Last Updated" date;
Send you an email notification to the email address associated with your account; and/or
Display an in-App notification.

Your continued use of the Services after the effective date of any update constitutes your acceptance of the revised Policy, to the extent permitted by law. Where applicable law requires your explicit consent for certain changes, we will seek it.

Previous versions of this Policy are available on request by emailing info@qalzy.com.

17. Jurisdiction-Specific Privacy Rights

In addition to the rights described throughout this Policy, residents of certain countries and US states have additional rights under local law. This section describes those additional rights and how to exercise them.

17.1 United States - California and US State Privacy Rights (CCPA/CPRA)

This section applies to residents of US states with comprehensive privacy laws, including California, Colorado, Virginia, Texas, and other states with similar legislation.

Categories of personal information we collect: We collect the categories of personal information described in Section 1 of this Policy, including personal identifiers, commercial information, health and nutrition data (which is treated as Sensitive Personal Information), internet and network activity data, and inferences drawn from this information.

We do not sell your personal information, and we have not done so in the preceding 12 months.

Your rights as a US resident include:

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the third parties with whom we share it.

Right to Delete: Request deletion of your personal information, subject to certain exceptions.

Right to Correct: Request correction of inaccurate personal information.

Right to Opt Out of Sale or Sharing: We do not sell your personal information. However, we do use Meta Pixel and similar technologies, which may constitute "sharing" of personal information for cross-context behavioural advertising under CCPA/CPRA. To opt out of this sharing, you may: (1) submit a request to info@qalzy.com with the subject line "Opt Out of Sharing", (2) use our cookie consent tool to disable Marketing cookies, or (3) opt out directly via Meta's Ad Preferences at facebook.com/ads/preferences.

Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of your Sensitive Personal Information (health and dietary data) to the purposes of providing the Services you have requested.

Right to Non-Discrimination: We will not deny you goods or services, charge you different prices, or provide a different level of quality as a result of you exercising any of these rights.

To exercise these rights, please email info@qalzy.com with the subject line "US Privacy Rights Request". We will respond within 45 days of receiving your request. If we need additional time, we will inform you within the initial 45-day period. You may also appeal our decision by emailing us with the subject line "US Privacy Rights Appeal".

17.2 Canada: PIPEDA and Quebec Law 25

If you are a resident of Canada, your personal information is collected, used, and disclosed in accordance with Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial laws including Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

We collect, use, and disclose your personal information with your knowledge and consent, except where applicable law permits otherwise. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may mean we are unable to continue providing some or all of the Services to you.

Quebec residents have the following additional rights under Law 25: the right to be informed of any automated processing used to make decisions based on your personal information; the right to be informed of any profiling of you for commercial purposes; and the right to request de-indexation (removal) of personal information that presents a serious injury risk.

When we transfer your personal information outside Canada, we ensure that it receives a comparable level of protection by assessing the privacy laws in the recipient jurisdiction and, where required, by putting in place contractual or other safeguards. You may request information about our cross-border transfer safeguards by contacting us at info@qalzy.com.

To exercise any of your rights under Canadian privacy law, please contact us at info@qalzy.com. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, for Quebec residents, the Commission d'acces a l'information (www.cai.gouv.qc.ca).

17.3 Australia: Privacy Act 1988 and Australian Privacy Principles

If you are located in Australia, your personal information is handled in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Overseas transfers (APP 8): Some of the personal information we collect may be disclosed to overseas recipients, including our cloud infrastructure provider (Amazon Web Services, located in the US and EU) and other service providers. Before disclosing your personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to your information. By using the Services, you acknowledge that we may transfer your personal information overseas as described in Section 9 of this Policy. In some cases, Australian Privacy Law may not require an overseas recipient to protect your information in the same way as the APPs.

You have the right to access and seek correction of personal information we hold about you. To make a request, please contact us at info@qalzy.com. We will respond within a reasonable time and, in any case, within 30 days. If we refuse access or correction, we will provide reasons in writing.

If you believe we have breached the APPs, you may lodge a complaint with us first by emailing info@qalzy.com. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

17.4 New Zealand: Privacy Act 2020

If you are located in New Zealand, your personal information is handled in accordance with the Privacy Act 2020 and the Information Privacy Principles (IPPs) contained within it.

Overseas transfers (IPP 12): We may transfer your personal information to countries outside New Zealand, including the United Kingdom, European Union, and United States, as described in Section 9 of this Policy. We take reasonable steps to ensure that overseas recipients are required to protect your personal information in a way that is, overall, comparable to the protections required under New Zealand law.

You have the right to access and request correction of personal information we hold about you. To make a request, please contact us at info@qalzy.com. We will respond within 20 working days as required under the Privacy Act 2020.

If you have a concern about how we handle your personal information, please contact us first at info@qalzy.com. If you are not satisfied with our response, you may lodge a complaint with the New Zealand Privacy Commissioner at www.privacy.org.nz.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us: