Bivel Privacy Policy

Last updated: September 1, 2026

🌐 This is an English translation of the original Spanish Policy, provided for convenience. In the event of any discrepancy, the Spanish version prevails.

This policy explains what data the Bivel application (the "app") and its website bivelapp.com process, for what purpose, and what rights you have. By using the app or leaving your email on the website you accept what is described here.

⚠️ Health notice: Bivel offers guideline estimates for informational purposes and does not constitute professional medical or nutritional advice. Consult a health professional before making significant changes to your diet or training.

1. Data controller

• Controller: Daniel Pernas
• Contact: soporte@bivelapp.com

2. What data we process

We only process the data you enter so that the app can work:

• Account: email address and password (the password is stored encrypted by our authentication provider; we never see it), or your Apple or Google account if you choose "Sign in with Apple" or "Continue with Google" (we receive the identifier the provider gives us and the associated email — in Apple's case, your real one or a private relay address, depending on what you decide to share).
• Profile: name, sex, age, height, weight, activity level and goals.
• Allergies and dietary preferences (optional): if you enter them, we treat them as health data for the sole purpose of ensuring the AI coach never suggests foods that are unsuitable for you.
• Usage records: meals and macros, workouts, hydration, weight, your own recipes and your library of saved products and sports.
• Profile photo (optional): stored only on your device. It is never uploaded to our servers or synced with your account; if you change phones, you simply pick it again.
• Subscription (if you subscribe): the status of your subscription (trial, active or expired) and the purchase identifier that Apple provides to us, for the sole purpose of giving you access to the paid features. We do not process any card or payment details: billing is processed entirely by Apple (see section 4).
• Minimal technical data needed to provide the service (e.g. session identifier).

We do not collect your location or contacts. Nor do we process your card or payment details: if you subscribe, payment is handled by Apple and we only receive the status of your subscription (see section 4). The camera is used for two things: scanning barcodes (processed on your device; that image never leaves it) and, if you choose, analysing a photo of your meal with AI. In that case, the copy sent to OpenAI to estimate the foods and their macros is not retained there (see section 4). The photo is stored on your own device as a thumbnail for that entry; we do not upload the photo file to our servers — only a reference to that image is synced with your account, so the thumbnail is not lost when you change sessions.

• Waiting list (bivelapp.com): if you leave your email on the website before having the app installed, we store that email and, if your browser indicates it, your system (iOS/Android) — solely to let you know when Bivel is available in your app store. We do not create any account with that data or use it for anything else.

3. Purpose and legal basis

We process your data to provide you with the service (calculating goals, logging your day and offering AI analysis). The general legal basis is the performance of the service you request and your consent, which you can withdraw at any time by deleting your account. The waiting list email is processed on the basis of your consent, given when you submit the form.

Some data (weight, allergies and dietary preferences) may qualify as special category data — health data — under Article 9 of the GDPR. We process it exclusively on the basis of your explicit consent, which you give voluntarily by entering it in the app and can withdraw at any time by deleting that data or your account.

4. Providers that process data on our behalf

• Supabase (hosting, database and authentication). Your data is stored here securely, with per-user isolation (Row Level Security).
• OpenAI (artificial intelligence features): when you use meal analysis (by text or photo), the coach, or the analysis of a workout described in text, what is needed to generate the answer is sent to OpenAI: the text you write, the photo of your plate (only if you use that feature), a summary of your data for the day (goals, intake, workouts and trend), your allergies/intolerances or dietary preferences (if you have entered them, so the coach never suggests something that breaches them) and/or, when analysing a workout, your basic physical data (sex, age, height and weight) to estimate calories, together with your language and your country or time zone — solely to answer in your language and adjust the typical portion sizes of your region. Your email and other directly identifying data are not sent. OpenAI acts as a data processor and, as it is used through its API, does not use this data to train its models; photos are processed to give you the result and are not retained beyond that purpose. This processing may involve an international data transfer (OpenAI servers in the US), covered by the safeguards provided by the provider (e.g. standard contractual clauses).
• Open Food Facts (public food database): when you search for or scan a product, its service is queried. No personal data of yours is sent.
• Sentry (error monitoring): if the app crashes, a technical report is sent (error type, line of code) so it can be fixed. Configured to include no personal data (name, email, etc.) — the report is not linked to your identity. Servers in the EU.
• PostHog (product analytics): we record usage events (e.g. whether you complete onboarding or log a meal) to understand how the app is used and improve it. These events are linked to your account (to measure, for example, how many users keep using the app over time), but they are not used for advertising purposes or to track you outside the app. Servers in the EU.
• Google (if you use "Continue with Google"): acts as an identity provider to create or access your account. We receive from it an identifier for your Google account and your email; we do not receive your password. Google's processing of that data is governed by its own privacy policy and may involve an international data transfer (servers outside the EU), covered by the safeguards provided by the provider.
• Apple (if you use "Sign in with Apple"): acts as an identity provider to create or access your account; its processing of that data is governed by Apple's own privacy policy. In addition, if you subscribe, Apple processes the payment as the party responsible for the transaction (we do not take part in billing or see your card).
• RevenueCat (subscription management): if you subscribe, we use RevenueCat to validate the purchase with Apple and check whether your subscription is still active. It receives an internal identifier for your account (not your email), the purchase receipt data that Apple provides to it, and basic technical data (country, platform). It does not receive your card or payment details (Apple handles those). This processing may involve an international data transfer (servers in the US), covered by the safeguards provided by the provider (e.g. standard contractual clauses).

5. Retention

We keep your data while your account is active. If you delete your account, it is permanently erased (see section 7). Waiting list emails are kept until we notify you of the launch or you ask us to delete them.

6. Your rights

You have the right to access, rectify, delete and port your data, to restrict or object to its processing and to withdraw your consent at any time. You can exercise most of these from within the app (by editing your profile or deleting your account) or by writing to soporte@bivelapp.com.

If you believe we have not handled your rights properly, you have the right to lodge a complaint with the competent supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

7. Deleting your account and data

You can delete your account and all your data at any time from Settings → My account → Delete my account. Deletion is immediate and permanent. If you only left your email on the waiting list, write to soporte@bivelapp.com and we will delete it.

8. Children

The app is not directed at children under 14. If you are under the age of digital consent in your country, you need your legal guardian's permission.

9. Changes to this policy

We may update this policy. We will publish the current version at this same address with its update date.

10. Contact

For any privacy questions: soporte@bivelapp.com.