Privacy Policy

Data controller for Kaify Ai product data: Kaify Ai. Operational address currently published: Toros Mah., Çukurova, Adana 01150, Türkiye. Formal registered company name, registration number, DPO (if appointed), and EU/UK representative remain subject to counsel confirmation.

Contact: support@kaifyai.org.

Paddle processes payment transactions as Merchant of Record and publishes its own Privacy Notice (https://www.paddle.com/legal/privacy). Kaify Ai and Paddle do not have the same privacy role: Paddle typically acts as an independent controller for transaction and payment data it collects to sell and bill the product; Kaify Ai receives subscription status, entitlements, and limited billing identifiers needed to provide access.

This Policy covers the Kaify Ai website and application, account creation, coaching features, analytics, optional photo analysis, subscriptions, and related communications. It does not cover third-party websites linked from Kaify Ai except as we describe our sharing with service providers.

• Account: email, display name, locale, timezone, country/region, auth identifiers
• Age-related: birth date used to enforce 16+ eligibility; guardian authorization representations where applicable
• Profile and goals: height, weight, sex/gender if provided, fitness goals, experience, activity level, lifestyle notes
• Health and fitness: workout logs, meal/nutrition logs, water intake, steps, streaks, optional injury or condition notes, calorie/protein goals and progress
• Photographs and analysis: meal or physique photos you upload and model-derived observations/scores (images processed for analysis; storage practices follow product design)
• AI: prompts, chat messages, coaching memory summaries, inferred preferences used to personalize coaching
• Device/technical: IP (security/rate limits), browser/device type, session and security cookies/logs
• Analytics and attribution: first-party product analytics; optional Vercel Analytics/Speed Insights if cookie consent given
• Support communications and consent records
• Paddle-related: customer/subscription/transaction/entitlement identifiers and billing email as received from Paddle — not full card numbers

We collect data you provide directly, data generated by your use of Kaify Ai, data from authentication providers you choose, and payment/entitlement data from Paddle. We do not buy health dossiers from data brokers for Kaify Ai coaching.

• Provide the service and account (contract / equivalent)
• Process subscriptions and entitlements with Paddle (contract; legal obligation for tax/accounting where applicable)
• Security, fraud prevention, abuse detection (legitimate interests / legal obligation)
• Health/fitness coaching features, meal and physique analysis, and related AI processing (explicit consent where required for special-category/sensitive data — GDPR Art. 9 and analogous laws)
• Improve features using aggregated or deidentified data where permitted (legitimate interests)
• Comply with law, enforce Terms, handle disputes (legal obligation / legitimate interests)

You may withdraw consent for AI health processing or photo analysis in Settings. Withdrawal may limit or disable those features. Withdrawal does not affect prior lawful processing.

Fitness and health-related information is treated as sensitive. Kaify Ai is not a covered entity under HIPAA and does not claim HIPAA compliance. Where US state consumer health data laws (for example Washington My Health My Data Act) apply to you, additional notices or consents may be required.

Kaify Ai does not sell personal health data. Kaify Ai does not use health data for unrelated advertising, data brokerage, or undisclosed model training. If product behavior ever changes, this Policy and consents must be updated before such use.

Kaify Ai sends prompts and, where relevant, images to AI providers (currently Google Gemini for vision-related analysis and DeepSeek for conversational coaching) to generate outputs. Providers process data as service providers/subprocessors under their terms and our instructions to the extent contractually available. International transfers may occur (including to the United States and, for DeepSeek, routes that may involve China/US infrastructure). Safeguards may include contractual clauses where available.

AI outputs are not medical advice. Automated coaching personalizes recommendations; significant decisions about your health remain yours and your clinicians'.

Browser cookies, local storage, and similar technologies are described in our Cookie Policy. Native mobile SDKs (for example push notification tokens) are not 'cookies' and are covered here and in in-app settings. Non-essential analytics technologies require consent where required by law.

• Supabase — database, auth, storage (EU Frankfurt)
• Vercel — hosting and edge
• Google Gemini — AI vision/text
• DeepSeek — AI conversational text
• Sentry — error monitoring (PII scrubbing applied)
• Paddle — payments MoR
• Upstash — Redis rate limiting/caching

We may disclose data to authorities when legally required, or in connection with a merger, acquisition, or asset transfer subject to appropriate protections.

Data may be processed in the EEA, UK, US, Türkiye, and other countries where providers operate. Where required, we rely on adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms. DeepSeek-related transfers require ongoing counsel review.

We retain data while your account is active and thereafter according to our retention schedule, including approximately: chat/coaching memory up to 24 months after last activity; health/analytics metrics up to 36 months; billing events up to 7 years for accounting; consent evidence targeted for multi-year retention where legally required. Account deletion removes primary account data via cascade, while certain billing audit rows may be retained with user identifiers removed.

We implement technical and organizational measures appropriate to the risk (access controls, transport encryption, secrets management, PII scrubbing in error logs). No method of transmission or storage is perfectly secure. We do not claim specific certifications unless independently verified.

Depending on your location, you may have rights to access, rectify, erase, restrict, port, object, withdraw consent, and lodge a complaint with a supervisory authority. US state residents may have additional rights (know, delete, correct, opt out of sale/share/targeted advertising where applicable). Kaify Ai's position is that it does not sell personal information as 'sale' is commonly defined; if that changes, we will update this Policy.

Submit requests to support@kaifyai.org. We may verify identity before acting. Authorized agents may submit requests where law requires. Appeals processes will be provided where mandated.

Kaify Ai is not adults-only; the minimum age is 16. Users aged 16–17 may still be minors. We apply high-privacy defaults where feasible: minimize unnecessary collection, avoid targeted advertising to minors, avoid manipulative consent design, and restrict unnecessary profiling and sharing. Accounts discovered to belong to users under 16 will be deleted.

You may delete your account in Settings, or request deletion at https://kaifyai.org/delete-account (also usable if the app is uninstalled). Deletion cancels live Paddle subscriptions immediately when the cancel call succeeds, then deletes account data. Subscription cancellation alone (via Manage billing) stops renewal but keeps your account. Deletion does not automatically create a refund. If you cannot sign in, email support@kaifyai.org from the address on the account.

EEA/UK/Switzerland: GDPR/UK GDPR rights and Art. 9 conditions for health data as described above. Türkiye: see /kvkk for the regional disclosure module. Brazil/Canada/Australia and US states: rights apply when those laws apply to you. Local-language notices may be mandatory in some jurisdictions even though English is primary.

We may update this Policy. Material changes will be notified in-app or by email where required. Version: 2026-08-22.