Privacy Policy: Regional Supplements

Version: VERSION · Effective date: EFFECTIVE DATE Controller: LEGAL ENTITY NAME, REGISTERED ADDRESS

These supplements add to our Privacy Policy. If you live in a place below, its section applies to you as well, and wins where the two differ. Section numbers refer to the Privacy Policy.

Language. Our privacy documents and the app are in English only at launch.

Where in-app analytics runs

In-app analytics (section 2.10) is first-party, records no food you ate, weight, body measurements, workouts, location or photos, and is off until you turn it on in Settings → Privacy and consents. The switch is offered only in the United States, Australia, New Zealand, Switzerland, Japan, Singapore, Brazil and South Africa, and in Canada outside Quebec once the app knows your province. The app does not ask for your province yet, so analytics is off in Canada. Everywhere else, and whenever we cannot tell your country or the country you chose differs from your phone's, there is no switch and nothing is recorded.

A. European Union, EEA and Switzerland

• Who we are: LEGAL ENTITY NAME. Data protection officer: not appointed.
• Legal bases: section 4. We process health data on your explicit consent (GDPR Art. 9(2)(a)).
• Your rights: access, correction, erasure, restriction, portability, objection, not to be subject to solely automated decisions with legal or similar effects, and to withdraw consent at any time (GDPR Arts. 7(3), 15–18, 20–22). We reply within one month, or up to two more months for complex requests, and tell you if we need the extra time.
• Transfers: to the United States, under the standard contractual clauses (with the Swiss changes for Switzerland). For a provider certified under the EU-US Data Privacy Framework we may rely on that instead, and for Switzerland only on the Swiss-US framework. The Sub-processors list shows each provider's safeguard.
• Storage on your device: before any ad loads, Google's consent message asks whether ads may store and read information on your phone; if you say no, you see limited ads that use no identifier stored on your phone. Analytics stays off. The app also stores what it needs to work, including RevenueCat's subscription ID and the usage ID kept by Google's label reader (section 2.11).
• Children: our minimum age of 16 is at or above the age of digital consent in every EU and EEA country.
• In-app analytics: off, with no switch, in the EU and EEA. In Switzerland the switch is offered and analytics is off until you turn it on.
• Health information is never published. Nothing about your weight, body, food or activity is made public. (Italian law expressly forbids publishing health data.)
• France: ZMacros is a general wellness app, not used to provide or follow medical care, so French health-data hosting certification (HDS) does not apply. Health professionals should not use it to keep patient records.
• Complaints: to the data protection authority where you live, work or where you think the breach happened (list at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en), such as the CNIL, the Garante, the AEPD or your German state authority; in Switzerland, the FDPIC.

B. United Kingdom

• Your rights are as in section A. We reply within one month. You can complain to us first, and we acknowledge complaints within 30 days.
• Transfers: standard contractual clauses with the UK International Data Transfer Addendum, or the UK Extension to the Data Privacy Framework for a certified provider.
• Complaints: the Information Commission (formerly the ICO), ico.org.uk.
• Under 18s: following the Age Appropriate Design Code, ads are non-personalised, location is used only while you record an activity.

C. United States

C.1 California notice at collection (CCPA)

What we have collected in the last 12 months:

• We do not sell or share personal information for cross-context behavioural advertising, and have not in the last 12 months. We have no actual knowledge of selling or sharing data of consumers under 16.
• We use sensitive personal information only for purposes the CCPA regulations allow without a right to limit, so we offer no "Limit the use" link.
• Retention: section 8.
• Your rights: to know and access, delete, correct, opt out of sale or sharing (we do neither), and not be discriminated against. Ask in the app (Settings → Data & Privacy → Your privacy rights) or at privacy@zmacros.com. We respond within 45 days, extendable by 45. You may use an authorised agent.
• Shine the Light: we do not disclose personal information to third parties for their direct marketing.

C.2 Other US states

If you live in a state with a comprehensive privacy law (such as Colorado, Connecticut, Oregon, Texas or Virginia), you can access, correct, delete and get a copy of your data, and opt out of sale, targeted advertising and profiling (we do none of these). We process sensitive data, including health data, only with your consent. We respond within 45 days. If we refuse a request, reply with "Appeal"; we answer within the time your state law sets and tell you how to contact your Attorney General.

Connecticut: we do not collect, use or sell personal data to train large language models. OpenAI, which reads meal photos for us, does not train on our requests.

C.3 Consumer health data

Washington, Nevada and Connecticut: see the Consumer Health Data Privacy Policy. Under those laws you can also:

• correct your consumer health data in the app or at privacy@zmacros.com;
• ask for a list of every third party and affiliate that has received your consumer health data, with an email address or web form for each;
• have your deletion passed on where we can. It removes the data from our servers. Backups at our host are overwritten on its regular cycle. Meal photos reach OpenAI without your name, email or account ID, so we cannot ask it to find yours; it keeps them up to 30 days, longer if flagged or required by law.

C.4 Children

ZMacros is not directed to children under 13, and we do not knowingly collect their data. The minimum age in the US is 16, or 18 in Texas, Utah and Louisiana (and California from 1 January 2027) and when we do not know your state.

D. Canada and Quebec

• Privacy officer: the founder, reachable at privacy@zmacros.com. In Quebec, this is the person in charge of the protection of personal information.
• Consent: we ask for express consent for health information. Our default settings give the most privacy: optional features are off until you turn them on.
• Outside Quebec and Canada: your information is stored with service providers in the United States. Before sending information outside Quebec we assess the privacy risks, and our providers are bound by written agreements.
• Rights: access, correction and withdrawal of consent. In Quebec, also de-indexing, a copy in a structured, commonly used format, and information about automated decisions. We reply within 30 days.
• Complaints: the Office of the Privacy Commissioner of Canada (priv.gc.ca); in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).
• Minimum age: 16 everywhere in Canada.

E. Brazil

• Data protection officer (encarregado): the founder, reachable at privacy@zmacros.com.
• We process health data on your specific, highlighted consent (LGPD art. 11). Transfers to the United States use the ANPD standard contractual clauses.
• Rights (LGPD art. 18): confirmation, access, correction, anonymisation or deletion, portability, information about sharing, and withdrawal of consent. Complaints: ANPD (gov.br/anpd).
• ZMacros is available in Brazil only from age 18.

F. India

• ZMacros is available in India only from age 18.
• Section 2 of the Privacy Policy sets out what we collect and why. You can withdraw consent, access, correct and erase your data, nominate someone to act for you, and complain to us and then to the Data Protection Board of India.
• Grievance officer: our founder,, reachable at grievance@zmacros.com. We reply within 90 days at most.

G. Japan

• Where your data is handled: in Canada, where ZMacros is run, and in the United States, where our service providers are. Canada protects personal data under its federal privacy law (PIPEDA) and provincial laws. The United States has no comprehensive federal privacy law like the APPI, though several states have their own. Our contracts require our providers to protect your data to the standard the APPI requires. On request we will tell you what those measures are and how we check them (APPI Arts. 28 and 32).
• How we protect it: data is encrypted in transit and at rest; every database table has access rules, so an account can reach only its own data; and we have a breach response plan.
• You can ask us to disclose, correct, stop using or delete your data at privacy@zmacros.com. Complaints: the Personal Information Protection Commission.
• Minimum age: 16.

H. South Korea

• We ask for separate consent before processing your health information and

• Transfer abroad: your data is transferred to the United States over the internet when you use a feature: your account and logs to Supabase, meal photos to OpenAI, your account ID and purchases to RevenueCat and your email to Resend. They store or process it to run ZMacros, for the periods in section 8. You can refuse by not using the feature concerned, but syncing, scanning and subscriptions cannot work without the transfer.

• Minimum age: 16. Complaints: the Personal Information Protection Commission or the KISA privacy centre (privacy.kisa.or.kr).

I. Australia and New Zealand

• Australia: we follow the Australian Privacy Principles. Health information is sensitive and collected with your consent. Overseas recipients are in the United States. Some decisions are made by computer without a person (Privacy Policy section 13):

  • Which decisions: AI scan cool-downs, a scan pause until tomorrow, stopping scans when the monthly allowance is used up, your plan's price level and scan allowance, and automatic changes to your daily targets.
  • Which information: your scan count and timing, your plan, the country of your store account, your year of birth and the health details you enter for your targets (such as weight, height, activity and logged food).

  You can change your targets, and ask us to review a scan limit at support@zmacros.com. Complaints: OAIC (oaic.gov.au).

• New Zealand: Privacy Act 2020. Privacy officer: the founder, reachable at privacy@zmacros.com. Complaints: the Privacy Commissioner (privacy.org.nz).

J. Other countries