Privacy & Data Protection Policy
1. Scope and controller
This Policy explains how personal data is processed across cutemeals.com, the Cute Meals mobile application, in-app AI features, support channels and related services.
The controller is Ali Yılmaz. Cute Meals is the name of the service and mobile application provided by Ali Yılmaz and is not a separate legal entity. You can contact the controller at contact@cutemeals.com or through the personal-data rights channel at https://cutemeals.com/veri-haklari.
2. Data categories we collect
Depending on how you use the service, we may process:
- Account data: name or display name, email, Firebase user ID, session and verification data.
- Child profile data: name, birth date, age/development stage, sex, height, weight, activity level and measurement history.
- Health and nutrition data: declared allergies, health conditions, diets, preferences, disliked foods and calculated nutrient needs.
- Usage and meal data: favourites, recipe choices, meal history, plans, portions, estimated nutrient totals, recommendation scores and interactions.
- User content: meal photos, AI assistant messages, feedback and support correspondence.
- Subscription data: product, status, purchase/expiry dates and store or RevenueCat identifiers. Cute Meals does not hold complete payment-card data.
- Technical data: IP address, device/OS and app version, request/security logs, error type, crash data and approximate timestamps.
- Website preferences: language and colour-theme selection.
3. Children’s data and special-category health data
Allergies, medical conditions and similar information are special-category health data. A child profile must be created by a parent or legal guardian acting for the child.
Cute Meals is not designed as an account service for children to use directly. The account holder must be at least 18 or have reached the applicable contractual age in their country.
Health-data personalisation requires separate, specific and withdrawable consent in the app where consent is the applicable legal basis. Accepting general terms or reading this Policy is not consent.
4. Purposes and legal bases
Purposes and potential legal bases include:
- Providing accounts, profiles and core service features: performance of a contract.
- Processing a child’s allergies, conditions and other health data for filtering, nutrition calculations and health-related personalisation: separate explicit parental/guardian consent. Contract performance is not used as an alternative basis for this special-category health data.
- Meal-photo analysis and AI: contract performance for a basic, specifically requested analysis that contains no health data; separate explicit consent where the analysis uses health data or child-health profile context.
- Security, abuse prevention, debugging and service improvement: legitimate interests balanced against individual rights.
- Subscription management and store verification: contract and legal obligations.
- Support: responding to your request, contract and legitimate interests.
- Marketing or optional notifications: separate consent that can be withdrawn.
- Legal requests, records and disputes: legal obligations and legal claims.
5. AI and photo analysis
When you select a meal photo, it may be uploaded to Cute Meals, stored on Google Cloud and sent to Google Gemini for content analysis. The analysis estimates a dish and likely ingredients; it is not a diagnosis or an allergen guarantee.
Text and limited child-profile context needed for assistant, explanation, translation or recommendation features may be sent to Google Gemini or OpenAI. We aim to avoid sending unnecessary direct identifiers; however, the child’s first name and computed nutrition values are sent to OpenAI when daily insights and suggestion explanations are generated.
We use providers’ business API terms so that this data is not used to train third-party AI models. The providers we use commit not to train their models on content submitted through the API by default; this statement will be updated if that commitment changes.
An uploaded meal photo is retained with the meal record once you confirm the analysis, and is deleted when you delete that meal or your account. If you do not confirm the analysis, the photo is not persisted; transient copies in processing logs are cleared within the normal backup cycle.
Do not include faces, documents, addresses, screens or identifying background details in meal photos. AI output is an automated estimate, not professional medical review.
6. Service providers and recipients
The following providers are used to deliver the service. Each is engaged only for the purpose and data category listed in its own row:
| Provider | Purpose | Data processed | Region | Privacy policy |
|---|---|---|---|---|
| Google Firebase | Authentication, crash reporting, notifications and product analytics | Email, user ID, device ID, crash logs, in-app interaction events | US / EU | Open policy |
| Google Cloud | Servers, file storage and asynchronous job queue | Account, profile, meal and photo data | EU | Open policy |
| Google Gemini | Photo analysis, AI assistant and recipe matching | Meal photo, assistant messages, limited profile context | US | Open policy |
| OpenAI | Daily insight text, suggestion explanations, translation and recipe processing | Child’s first name, computed nutrition values, recipe text | US | Open policy |
| Supabase | PostgreSQL database | All records stored by the app | EU (AWS eu-central-1) | Open policy |
| RevenueCat | Validating and managing subscription entitlements | Store transaction ID, subscription state, device ID | US | Open policy |
| Apple | App Store distribution, In-App Purchase and Sign in with Apple | Purchase record, Apple account identifier | US | Open policy |
| Google Play | Android distribution and in-app purchases | Purchase record | US | Open policy |
| Spoonacular | External recipe search | Search criteria, including exclusion terms derived from dietary preferences or allergies | US | Open policy |
- Authorities, courts and professional advisers when legally required.
7. International transfers
Some providers are established outside Türkiye or process data internationally. Account, health, photo, AI-request, subscription and technical data may therefore be transferred abroad.
Recurring transfers must rely on an applicable adequacy or appropriate-safeguard mechanism under KVKK Article 9. The exceptional consent route for incidental transfers is not used as the general basis for recurring cloud, authentication or AI traffic. Transfer parties, data categories and the selected mechanism must be documented for each provider. Where GDPR applies, an adequacy decision, standard contractual clauses or another valid safeguard must also be used.
8. Retention, account closure and deletion
Data is retained only while needed for the relevant purpose, while an account remains active, or for an applicable legal-obligation or dispute period.
You can delete your account directly in the mobile app under Profile > Account > Delete Account. If you cannot access the app, email contact@cutemeals.com with the subject “Cute Meals Account Deletion Request”. After verification, the account and linked child-profile records are deleted; limited records required by law may be restricted and backup removal may follow the ordinary backup cycle.
Whole-account deletion steps, affected data categories and the alternative request channel are described at /verileri-sil; deletion of one selected child profile while keeping the account is described at /verilerimi-sil. Data-copy requests may be emailed to contact@cutemeals.com with the subject “Personal Data Request”.
9. Our security approach
Measures include authentication, user/child ownership checks, encrypted transport, access restriction, security logging, sanitised crash reporting and service separation.
No system can guarantee absolute security. Access, storage visibility, vendor contracts, incident response and deletion controls for health data and photos require regular review.
10. Your rights and how to exercise them
Depending on applicable law, you may have rights of access, copy, correction, deletion, restriction, objection, consent withdrawal, portability, recipient information and redress.
Email contact@cutemeals.com with the subject “Personal Data Request”. Include your account email and the request, but do not unnecessarily attach health data or identity documents. Only proportionate verification information will be requested. Valid KVKK requests are answered within 30 days.
11. Website storage and analytics
cutemeals.com currently uses no advertising or behavioural-analytics cookies. Essential local-storage entries cm_lang and cm_theme remember language and colour theme.
Google Fonts may receive an IP address and basic request data. The mobile app uses session, preference, cache, Crashlytics and platform services. This Policy and any required controls will be updated before new analytics or advertising technology is enabled.
12. US users: HIPAA and health data
Cute Meals is currently a direct-to-consumer meal-planning application. It does not represent itself as a health plan, clearinghouse or HIPAA covered health-care provider.
Unless Cute Meals acts as a business associate processing protected health information for a HIPAA covered entity, HIPAA may not protect data in the app. Other US rules, including the FTC Act, Health Breach Notification Rule and state consumer-health privacy laws, may still apply.
Cute Meals does not sell personal health information for advertising or use it to create targeted-advertising profiles.
13. Changes and contact
We may update this Policy when data practices, providers or law change. Material changes will be announced before they take effect and renewed consent will be obtained where required.
Last updated: 14 September 2026. Privacy and data-rights questions: contact@cutemeals.com.