Privacy policy
This policy explains what data the Kaizo app and the kaizo.fit website process, why, who it is shared with and how to exercise your rights.
1. Who is responsible for your data
WEDO TECHNOLOGY, Résidence Al Badr, Lot. 11, Bldg. 99, 2nd floor, Aïn Sebaâ, Casablanca, Morocco, publisher of Kaizo, is the data controller.
Contact for any question about your data: [email protected] (or [email protected]).
2. The data we process
- Account: e-mail address, first name (optional), username, language, sign-up date, date of last activity. Your password is managed by our authentication service in hashed form: nobody can read it. If you use "Continue with Google", Google sends us your e-mail address and your name; Kaizo receives neither your Google password nor access to your Google account.
- Profile: goal, sex, year of birth, height, weight and target weight, level, equipment, workouts per week, daily activity. Optional food preferences (diet, no pork, no alcohol, allergies, foods to avoid): some may reveal a belief or a health condition; they are only used to filter the foods suggested to you and are never sent to analytics tools.
- Training: programs, sessions, sets, loads, records and badges, and the history of the program adjustments suggested by the coach.
- Nutrition: nutrition plans, food diary, planned meals, foods and dishes you create.
- Measurements and photos: weigh-ins, body measurements and progress photos. Progress photos are stored on our servers and are visible only to you.
- AI features (only if you turn them on and give your consent): the description of a meal, its photo or your voice recording, and the data needed for the answer (see section 4). Meal photos and voice recordings are not kept by Kaizo. Your conversations with the assistant and the coach are kept in your history until you erase it or delete your account; weekly reviews, 30 days. We also record the number of uses and the cost of each call, without its content. Texts read aloud are kept for up to 30 days in a technical cache, with no link to your account. Depending on your phone settings, dictation may also use your phone's speech recognition service (for example Google), which does not depend on Kaizo.
- Products added to the catalogue (only if you submit an unknown packaged product): the barcode, the photos of the packaging (front, nutrition table, ingredients) and the values you check. The photos are re-encoded without metadata (no GPS location, no device information), read by the AI (see section 4), which extracts and translates the name, ingredients, allergens and nutrition values, and checks that it is a food or an alcohol-free drink and that no person appears. The product is published at once in the shared catalogue marked "Unverified", without your name or any information about you, then checked by the Kaizo team. The photos are never published nor shown in the app: only Kaizo's administrators can see them to check the product, and each view is logged. Nothing is sent to Open Food Facts.
- Notifications: a technical identifier of your device and your reminder settings, if you allow notifications, and the history of the automatic notifications and e-mails sent.
- E-mails: verification codes, account deletion confirmation, end of trial, support answers; the weekly or monthly recap (optional, off by default) contains counters of your activity (sessions, tonnage, records, badges, streak). Marketing e-mails (tips, offers, prices and purchase links) are only sent if you ticked the box provided (sign-up, Settings → Privacy or checkout page); we keep the date, the version of the text and where you gave your consent, and you can withdraw it at any time in the app or with the unsubscribe link of each e-mail.
- Subscriptions: your plan, its trials and the plans offered to you, its status and the purchase identifier sent by Google Play or by Paddle (subscription taken on kaizo.fit): Paddle customer, subscription and transaction identifiers, country, currency, amounts, taxes, renewal dates, invoice number. We never receive your bank details.
- Support: the messages and attachments you send to support (in the app or by e-mail), with, if you agree, the app version and your phone model.
- Reviews: the rating and comment you give in the app (with the app version); the reviews published on Google Play (public name, rating, text, language, device, app version), which we read and may answer publicly.
- Technical data: server logs (IP address, date, type of request) kept for security and diagnosis.
- Crash reports: when the app crashes, a technical report (error, screen, phone model and system, app version, technical identifier of your account) is sent to Kaizo and to Google Firebase Crashlytics to fix the problem. It contains neither your name, nor your e-mail, nor your health data. Kept 90 days.
- Usage statistics (only if you agree; your choice is saved with your account and can be changed in Settings → Privacy): anonymous app usage events (screens opened, workout started, meal logged, assistant used…) measured with Google Firebase Analytics (United States), without any advertising identifier and without any health value.
Kaizo does not access your location, contacts or other apps, shows no advertising and sells no data.
3. Why and on what basis
| Purpose | Basis |
|---|---|
| Create your account and run the app (programs, diary, statistics, reminders) | Performance of the contract (terms of use) |
| Process your health data (weight, measurements, food, training) | Your explicit consent, asked in the app. You can withdraw it in Settings → Privacy: Kaizo then stores no new health data; the data already stored stays in your account until you delete it or delete your account |
| AI features (meal analysis, voice, assistant, coach, review) and transfer of the data needed outside Morocco | Your explicit consent, asked in the app and revocable in Settings → Privacy |
| AI reading of packaging photos and publication of the product in the catalogue | Your agreement, given when you submit the product (a label is not health data; no data from your profile is sent) |
| Notifications | Your consent (phone permission and reminder settings) |
| Service e-mails and recap | Performance of the contract; your choice for the recap |
| Marketing e-mails | Your consent, revocable at any time |
| Crash reports | Our legitimate interest in running the app without errors |
| Usage statistics | Your consent, revocable at any time in Settings → Privacy |
| Manage your subscription | Performance of the contract |
| Answer reviews and improve the app | Our legitimate interest |
| Security, backups, abuse prevention, control of AI costs | Our legitimate interest |
| Meet our legal obligations (accounting, requests from authorities) | Legal obligation |
4. Who we share your data with
Only with the providers needed for the service, each for its own task:
| Provider | Role | Data | Location |
|---|---|---|---|
| Scaleway (for WEDO TECHNOLOGY) | Hosting of the API, the database, the files and their backups (Paris data centre) | All your account data | France (European Union) |
| Cloudflare | Network, attack protection, HTTPS certificate, tunnel to our servers, forwarding of kaizo.fit e-mails | All app and website traffic: Cloudflare decrypts the traffic in transit to protect it, then encrypts it again towards our servers, without keeping it; IP address; e-mails sent to kaizo.fit | Worldwide (United States) |
| Google (Gmail) | Mailbox receiving the e-mails sent to support@ and [email protected] | Your e-mails to support and your requests about your data | United States |
| Brevo (Sendinblue) | Sending of e-mails (codes, service, recap, support, marketing e-mails if you accept them) | E-mail address, first name, language, content of the e-mail | France (EU) |
| Google (sign-in with Google) | Sign-in to your account if you choose "Continue with Google" | Google sends us your e-mail and your name | United States |
| OpenRouter | Routing of AI requests | Content of the AI request, without your name, e-mail or identifier | United States |
| Mistral AI | Analysis of described meals, assistant, coach, review | Same | France (EU) |
| Google (Gemini) | Analysis of meal photos, reading of packaging photos, voice transcription, fallback for the other features | Same; for packaging: the photos only, without any data from your profile | United States |
| OpenAI | Reading voice, fallback for the other features (including packaging reading) | Same | United States |
| OneSignal | Sending notifications | Device identifier, technical account identifier, language, reminder settings | United States |
| Google Firebase (Crashlytics, Analytics) | Crash reports; usage statistics if you accept them | Technical report, technical identifier of the account and the device, anonymous usage events | United States |
| Google Play | Purchases in the Android app; reviews published on the app's page | Purchase identifier, plan, subscription status; public name, rating and text of your review | United States |
| RevenueCat | Tracking of Google Play subscriptions | Technical account identifier, purchase identifier, subscription status | United States |
| Paddle.com | Reseller and Merchant of Record for subscriptions bought on kaizo.fit: payment, invoices, taxes, refunds. Paddle is an independent controller of its own processing (Paddle's privacy policy). | E-mail, country (and postcode if required), technical identifier of your Kaizo account, plan bought; payment details are entered with Paddle | United Kingdom, United States |
| Open Food Facts | Information on scanned products | The barcode only, no personal data; your photos and product submissions are not sent to it | France (EU) |
We ask AI providers not to keep or reuse your data to train their models. Several providers are located outside Morocco, in particular in the United States, a country that is not on the CNDP's list of countries offering adequate protection: these transfers rely on your express consent (AI features, statistics), on the performance of the contract (e-mails, payment, notifications) and on the providers' contractual data protection commitments.
We may disclose data to the authorities where the law requires it.
5. How long we keep it
- As long as your account exists. When you delete your account, your data is erased immediately from our database, and we ask OneSignal to delete your user and Google Firebase to delete your usage statistics.
- Backups: a copy of the database and of the progress photos is made every night at our hosting provider (Scaleway, France); each copy is erased after 30 days. Deleted data therefore disappears from the backups within 30 days at the latest.
- Meal photos and voice recordings sent to the AI: not kept by Kaizo.
- AI safety log: for each exchange with the AI that can lead to a proposal (meal, workout, program, advice), we keep an encrypted record of what was sent to the AI, its answer, the model used and what you did next (proposal confirmed, edited, cancelled, allergen warning read). This record is pseudonymised (your name and e-mail address do not appear in clear), kept 3 years then erased, and it is not deleted when you clear a conversation or delete your account: it is only used to answer a complaint or a legal request, is only read by our team in that case, and every reading is logged. Photos and voice are never in it. Basis: our legitimate interest in establishing, exercising or defending legal claims.
- History of your consents (date and version of the consents given or withdrawn): 3 years, for the same reason.
- Packaging photos: erased 30 days after the team's decision (verified or rejected), and at the latest 180 days after submission if no decision was made; immediately if a person appears in them, if you withdraw your submission or if you delete your account. The published product stays in the catalogue: it contains no information about you.
- Server logs: 30 days at most.
- Crash reports: 90 days (no longer linked to your account once it is deleted).
- Reading voice cache: 30 days at most, with no link to your account.
- Reviews given in the app: detached from your account when it is deleted. Google Play reviews: handled by Google under its own rules.
- AI cost statistics: kept with no link to your account after it is deleted.
- Accounting records of payments (amounts, dates, Paddle identifiers): kept for the period required by accounting law, with no link to your account after it is deleted.
6. Security
Traffic is encrypted (HTTPS), passwords are hashed, server access is restricted and the administration interface is protected by two-factor authentication, with a log of every action. The Kaizo team does not look at the content of your meals, measurements, AI conversations, progress photos or recordings: the administration only sees counters and account states (its export of an account contains no health data), with two exceptions: the messages you send to support yourself, and the packaging photos you submit for the catalogue (each view logged).
7. Your rights
At any time you can:
- access your data and export it: Settings → Account → Export my data (JSON file: account, profile, training, nutrition, measurements, list of photos, AI conversations, consents, subscription and payments, support requests, reviews, submitted products…);
- correct it in the app;
- delete your account and all your data: Settings → Account → Delete my account, or without the app;
- withdraw your consent to health data, AI features, usage statistics and marketing e-mails: Settings → Privacy (and the unsubscribe link of the e-mails); for notifications, in your phone settings;
- object to a processing or ask for its restriction by writing to [email protected].
These rights are granted by Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data and, if you live in the European Union, by the General Data Protection Regulation (GDPR). We answer within 30 days. You can also contact the CNDP in Morocco (www.cndp.ma) or the data protection authority of your country.
8. Minimum age
Kaizo is for people aged 18 and over: you confirm it when you sign up and the app refuses a year of birth corresponding to less than 18 years. We do not knowingly collect data about minors; if we learn that an account belongs to a minor, we delete it.
9. Changes
We may update this policy. For any significant change, we let you know in the app before it takes effect; if a new consent is needed (for example for the AI), you will be asked again.
Last updated: October 8, 2026