Privacy Policy

1. Introduction

Kamal ("we", "us", "our") operates the PlateSnap mobile application. We are committed to protecting the personal data of invited contributors ("you", "Data Principals") in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA" or "the Act") and its rules.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you access or use our services. As a Data Fiduciary under the DPDPA, we are bound by the obligations set forth in the Act.

2. Definitions (as per DPDPA, 2023)

• Data Principal: An invited contributor whose personal data is being processed (i.e., you).
• Data Fiduciary: The individual who determines the purpose and means of processing personal data for PlateSnap, namely Kamal.
• Data Processor: Any entity that processes personal data on behalf of the Data Fiduciary.
• Personal Data: Any data about an individual who is identifiable by or in relation to such data.

3. Personal Data We Collect

We collect the following categories of personal data from you:

• Email Address: Used for account registration, authentication, communication, and service notifications.
• Device and Session Information: Including device model, operating system version, app diagnostics, network state, and telemetry logs for app security, diagnostics, and crash analysis.
• Profile Information: Display name or username associated with your account.
• Camera: Before requesting camera permission, PlateSnap explains that the camera is used to capture photos of meals. Captured meal images are uploaded to build an academic food-image research dataset and to train and evaluate image recognition models. Embedded photo metadata (EXIF / GPS location data) is stripped before upload. Contributors are instructed to avoid capturing people, faces, or personally identifiable background details.
• Image Annotations: Dish labels and portion weights entered by contributors.

4. Purpose of Data Collection

In accordance with Section 4 of the DPDPA, we process your personal data only for lawful purposes for which you have given consent. The specific purposes are:

• Providing and maintaining core application services and user authentication
• Technical diagnostics, crash troubleshooting, and system stability
• Captured meal images and contributor annotations are used to build an academic food-image research dataset and to train and evaluate computer vision image recognition models.

5. Consent

As required under Section 6 of the DPDPA, we obtain your free, specific, informed, unconditional, and unambiguous consent before collecting and processing your personal data. Consent is obtained through:

• Clear opt-in mechanisms at the time of data collection
• A plain-language notice describing the data collected and the purpose of processing
• An affirmative action by you (e.g., checking a consent box, clicking "I agree")

You have the right to withdraw your consent at any time by contacting us. Withdrawal of consent shall not affect the lawfulness of processing that was carried out before the withdrawal.

6. Data Sharing and Third-Party Processors

We do not sell or rent your personal data. We engage trusted third-party service providers (Data Processors) to perform necessary technical functions on our behalf. These include:

• AI Model Inference: OpenRouter (process captured meal images).
• Backend & Cloud Storage: Amazon Web Services (AWS) and Cloudflare. Primary application databases and media storage repositories are hosted in India (ap-south). Images sent for model inference may be processed outside India as described in Section 11. Cloudflare's content-delivery services operate globally, and we do not represent them as India-only.
• Authentication Services: Google Sign-In and Firebase Authentication for secure contributor login.
• Diagnostics & Crash Reporting: Google Firebase Crashlytics for crash logs, device diagnostics, and performance monitoring.

All Data Processors process data strictly pursuant to our contractual instructions and are bound to maintain reasonable security standards under Section 8 of the DPDPA.

7. Data Retention

Upon your request for erasure (data deletion request), we shall delete or anonymize your personal data within a reasonable timeframe, as mandated by Section 8(7) of the DPDPA.

De-identified meal images and annotations are retained for the duration of the food-image dataset project and are used to build the dataset and to train and evaluate food-image recognition models. They are stored under an internal contributor ID, not your email. If you request erasure, they are removed from the dataset within 30 days; models already trained using them are not retrained.

8. Rights of Data Principals

Under Chapter III of the DPDPA, you have the following statutory rights:

• Right to Access (Section 11): You may request a summary of your personal data being processed, the processing activities undertaken, and the identities of all Data Fiduciaries and Data Processors with whom your data has been shared.
• Right to Correction and Erasure (Section 12): You may request correction of inaccurate or misleading personal data, completion of incomplete data, updating of outdated data, and erasure of your personal data.
• Right to Grievance Redressal (Section 13): You may lodge a complaint regarding our processing of your personal data. We are obligated to respond within the timelines prescribed by the Act.
• Right to Nominate (Section 14): You may nominate any other individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.

To exercise any of these rights, please contact our Grievance Contact using the details provided below, or review our Account and Data Deletion Instructions.

9. Obligations of Kamal as Data Fiduciary

Under Section 8 of the DPDPA, we commit to the following principles:

• Purpose Limitation: We process personal data only for the purposes for which consent was obtained.
• Data Accuracy: We make reasonable efforts to ensure the completeness, accuracy, and consistency of your personal data.
• Data Security: We implement reasonable security safeguards, access controls, authentication mechanisms, and protections for data in transit.
• Data Minimization: We collect only such personal data as is necessary for the specified purposes.
• Storage Limitation: We do not retain your personal data indefinitely. Data is deleted or anonymized when no longer necessary.
• Breach Notification: In the event of a personal data breach, we shall notify the Data Protection Board of India and affected Data Principals as required under Section 8(6) of the DPDPA.

10. Age Restriction (18+) and Children's Data

PlateSnap is exclusively intended for invited adult contributors. Contributors must be 18 years of age or older. We do not target, direct our services to, or knowingly collect personal data from children under 18 years of age. If we become aware that personal data of an individual under 18 has been inadvertently collected without verifiable parental consent as required under Section 9 of the DPDPA, we will take immediate steps to delete such data from our systems.

11. Cross-Border Data Transfer

Captured meal images may be processed outside India when enabled model services analyze them. Only the relevant meal images are sent to OpenRouter for this purpose. Email addresses, profile information, image annotations, and device or diagnostic data are not included in that model-service transfer. We will follow Section 16 of the DPDPA and any applicable restrictions notified by the Central Government.

12. Tracking Technologies and Diagnostics

We do not use web cookies or third-party behavioral ad trackers. We utilize diagnostic and telemetry tools (specifically Google Firebase Crashlytics) to collect device parameters, crash reports, and app performance metrics solely for system stability, debugging, and service improvement.

13. Data Security Measures

We implement reasonable security practices and procedures as required under the DPDPA, including:

• Protections for personal data in transit
• Access controls and authentication mechanisms
• Incident response procedures for data breaches

14. Data Protection Board of India

If you are dissatisfied with our response to your grievance or believe that your rights under the DPDPA have been violated, you may file a complaint with the Data Protection Board of India as established under Section 18 of the DPDPA.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or applicable law. Any material changes will be communicated to you through:

• A prominent notice on our website
• Email notification (if applicable)
• Requesting fresh consent where required by the DPDPA

16. Grievance Redressal and Contact Information

For any queries, concerns, or requests regarding your personal data or this Privacy Policy, please contact our Grievance Contact:

We shall acknowledge your request within 48 hours and endeavor to resolve your concern within the timelines prescribed under the DPDPA.