Privacy Policy

Last updated: September 11, 2026

This Privacy Policy describes how your personal data is collected, used, and protected when you use the Aistamine service, pursuant to EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003.

1. Data Controller

2. Data Collected

2.1 Data provided by the user

• Registration data: name, email address, password (stored as bcrypt hash)
• Biometric data: gender, date of birth, height, weight, activity level, medications, diagnoses
• Health-related data: food diary entries, recorded symptoms with intensity, tolerance notes
• Payment data: managed entirely by PayPal; VisualSense does not store credit card or banking information

2.2 Automatically collected data

• Technical data: IP address (anonymized via hash), browser type, referring page
• Cookies: session cookies (necessary) and analytics cookies (with consent). See our Cookie Policy

2.3 Data from third parties

• Google OAuth: if you register via Google, we receive your name, email, and profile picture
• Open Food Facts: product data from barcode scans is retrieved from the Open Food Facts public API

3. Purpose and Legal Basis

4. Artificial Intelligence and Third-Party Processors

The Service uses third-party AI providers to analyze your data and generate personalized insights. By using the Service and accepting the Terms of Service, you consent to this processing.

4.1 AI providers used

• OpenAI (OpenAI, L.L.C., San Francisco, CA, USA) — GPT-4 models
• Anthropic (Anthropic, PBC, San Francisco, CA, USA) — Claude models

Only one provider is active at any time, as configured by the administrator.

4.2 Data sent to AI providers

• Food diary entries (food names, dates, meal types)
• Recorded symptoms (type, intensity, date)
• Biometric profile (age, gender, height, weight, medications)
• Conversation context for chat features

4.3 Safeguards

• Data is sent via encrypted HTTPS connections
• No identifying information (email, full name, IP) is sent to AI providers
• Both OpenAI and Anthropic maintain data processing agreements compliant with GDPR and do not use customer data for model training

5. Data Retention

Upon account deletion, all personal data is permanently removed within 30 days, except where retention is required by law.

6. Data Subject Rights

Under the GDPR, you have the right to:

• Access (Art. 15) — obtain a copy of your personal data
• Rectification (Art. 16) — correct inaccurate data
• Erasure (Art. 17) — request deletion of your data ("right to be forgotten")
• Restriction (Art. 18) — limit how your data is processed
• Portability (Art. 20) — receive your data in a machine-readable format
• Object (Art. 21) — object to processing based on legitimate interest

To exercise any of these rights, contact us at info@visualsense.it. We will respond within 30 days.

You also have the right to file a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it).

7. Data Security

• All data transmitted via HTTPS/TLS encryption
• Passwords hashed with bcrypt (cost 12)
• Secure sessions with httpOnly and SameSite cookies
• CSRF protection on all forms
• IP addresses stored only as SHA-256 hashes
• Database access restricted to authorized processes

8. International Data Transfers

Your data may be transferred to the United States when processed by AI providers (OpenAI/Anthropic). These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection.

9. Minors

The Service is not intended for persons under 16 years of age. If we become aware that we have collected data from a minor without parental consent, we will delete it promptly.

10. Changes to this Policy

We may update this Privacy Policy periodically. Significant changes will be communicated via email or in-app notification. The date at the top of this page indicates the last update.

11. Contact

For any privacy-related inquiries: info@visualsense.it