1. Data controller
Stamelli ApS, CVR no. 46705858, Gammel Kalkbrænderi Vej 14, 2. th., 2100 Copenhagen Ø, Denmark, is the data controller for the processing of your personal data in Karbo. Contact us at [email protected].
2. Your data and where it is stored
When you use Karbo, the meals, recipes, goals and settings you register are stored on your device, so the app works without an internet connection. Your device is always what the app reads from.
If you consent to backup (see section 7), the app creates an anonymous account and backs your data up to it, so your entries are not lost if you lose or replace your phone. The anonymous account contains no name, e-mail address, phone number or any other information about who you are — only a random ID created on your device. The backup is stored with our data processor in the EU. Without consent, your data is stored only on your device.
You can turn the backup on and off under Profile → Settings → Backup. Turning it off withdraws your consent, the existing copy is deleted immediately, and your data stays solely on your device.
If you sign in, for example with Apple, Google or e-mail, your data is instead linked to that account so you can use it across devices. This also requires your consent. The anonymous account you had beforehand is deleted automatically (see section 10).
3. Data when signing in
When you sign in, we process the information necessary to provide the account: a user ID, e-mail address and the data you save yourself (meals, recipes, goals, streak and any family/sharing data). This is stored with our data processor in the EU. Family sharing and shared meals require a real account and are never available from an anonymous account.
4. Foods you share
When you create a food, it is shared with other users once its nutrition values add up — also if you use Karbo without signing in, as long as backup is turned on (see the Terms of Use, section 7). What is shared is the food's name, brand, category, nutritional content, portions and barcode. If you are signed in with a display name, the name accompanies the food. If you delete the food or your account, it also disappears for others.
If you report a food, we store the report and the reason together with your user ID, so that the same person cannot report the same food more than once.
5. Barcodes
When you scan a barcode, Karbo looks it up in the food database on your phone. The barcode is not sent to anyone. If Karbo does not recognise it, you can create the food yourself, and the barcode is then shared together with the food as described in section 4.
6. Children
Karbo may be used from the age of 15. If you are under 15, a parent must give consent. A parent can create a profile for a child in the family group; the information about the child is then recorded by the parent on the child's behalf.
7. Health information and your consent
What you register in Karbo — meals, carbohydrates and diabetes type, including for children you add — is health information. Simply using a carb-counting app can say something about your health. We only process it outside your device if you have given your explicit consent (Article 9(2)(a) of the General Data Protection Regulation). You give it by answering yes when you start the app, by ticking the box when you sign in, or by turning backup on. We record when you gave it and which version of the text it applied to.
Consent is voluntary. Without it Karbo still works, but everything is stored only on your device, and you cannot have an account, be part of a family group, send meals to others or share foods with other users.
You can withdraw your consent at any time under Profile → Settings → Backup. Your data on our servers — and your account, if you have one — is then deleted, while what is on your device stays. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
We never share health information with third parties for marketing.
8. Legal basis and purposes
We process health information on the basis of your consent (section 7). We process your other information — for example e-mail, subscription and foods you share — to provide the app and fulfil our agreement with you (Article 6(1)(b)). We may also produce statistics in aggregated and anonymised form — for example which foods are logged most often, or how the app's features are used — to improve the app, prioritise the food database and develop new features. Such statistics cannot be traced back to you as an individual.
9. Sharing
We do not sell your data. Apart from what is described in sections 4 and 5, data is only shared with data processors that help operate the app (e.g. hosting), and where required by law. Family sharing only shares the information you actively choose to share.
10. Retention and deletion
We retain your data for as long as you have an account. You can delete your data and your account in the app at any time. If you would like a copy of your data, you can write to us — it is free of charge. Local data is deleted when you uninstall the app.
Anonymous accounts are retained only while they are in use: if an anonymous account has been inactive for 90 days — because the app was deleted, or because you signed in with a real account — it and all its data are deleted automatically.
11. Your rights
You have the right to access, rectification, erasure, restriction and data portability under the GDPR, and the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).
12. Changes
We may update this policy. In the event of material changes, you will be asked to review and accept it again.