This Notice explains how Timothy Alan Nice ("we", "us") handles personal data when you use CarbCue. We act as the data controller for your account and meal data.
1. Data we collect
- Account data — your email, display name, and password hash (via our authentication provider).
- Family profile data — names and ages you choose to add for the family members you log meals for.
- Meal data — photos you upload, AI carb estimates, your edits, meal type, and timestamps.
- Usage & device data — basic logs (IP, timestamps, the model used) for security, abuse prevention, and product improvement.
- Billing data — name, billing address, and tax info are collected by Paddle, our Merchant of Record. We do not see your card numbers.
2. Why we use it
- To provide CarbCue (contract performance).
- To improve estimates and prevent abuse (legitimate interests).
- To process payments and comply with tax obligations (legal obligation).
- To send service emails (legitimate interests).
3. Who we share data with
- Hosting & infrastructure providers that run our database and file storage.
- AI providers that we route meal photos through to generate carb estimates. Photos are sent for analysis and are not used to train third-party models.
- Paddle as Merchant of Record for sales, subscription management, payments, tax compliance, and invoicing.
- Legal advisors and authorities where required by law.
4. Children's data and family profiles
CarbCue accounts belong to adults. Family profiles you add — for yourself, a partner, a child, or any family member you log meals for — may include name and age, and are treated as health-adjacent data stored only under your account with strict access controls. If you add a profile for a minor, you confirm you are their parent or legal guardian.
5. Retention
We keep your data while your account is active. You can delete family profiles and individual meals at any time. If you delete your account, we remove or anonymize your personal data within 30 days, except where retention is required by law (e.g. tax records held by Paddle).
6. Your rights
You can request access, correction, deletion, restriction, portability, or objection regarding your personal data. Contact us through the support address in your billing receipt. If you are in the UK or EEA, you also have the right to lodge a complaint with your local supervisory authority.
7. Security
We apply industry-standard technical and organizational measures: data is encrypted in transit, access is restricted, and meal photos are stored in a private bucket served only via short-lived signed URLs.
8. International transfers
Our hosting and AI providers may process data outside your country, including in the United States. Where this involves transfers from the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
9. Cookies
We use essential cookies and local storage to keep you signed in and to remember which family profile is active. We don't use third-party marketing cookies.
10. Changes & contact
We may update this Notice; material changes will be flagged in-app. For privacy questions, contact Timothy Alan Nice through the support address on your billing receipt or the customer portal.