Effective date: October 4, 2026 · Last updated: October 7, 2026
This Privacy Policy explains how Kalestial Teknoloji Limited Şirketi (“Kalestial,” “we,” “us”) processes personal data when you use Mealvia: AI Cooking Assistant (“Mealvia”). We are the controller of personal data processed to operate Mealvia. Contact details appear below.
1. Information we process
• App identity and service activity. Mealvia creates a pseudonymous identifier without requiring an email address or a named sign-in. This identifier links authenticated requests, subscription access and generated content. It is not fully anonymous data. Our infrastructure also processes IP addresses, request times, technical logs and authentication records.
• Cooking inputs and AI content. These include ingredients and quantities, meal and time selections, dietary preferences and exclusions, questions sent to the cooking assistant, relevant conversation history, recipe context, generated recipes and answers.
• Selected photos. When you choose to scan ingredients, the photo you submit is processed to recognize visible food. Mealvia does not continuously access your camera or upload your entire photo library. Avoid including faces, documents or other information unrelated to ingredients.
• Subscription information. We process the app user identifier, purchased product, transaction and subscription status, expiration, renewal and restore information. Apple processes payment credentials; Mealvia does not receive your full payment card details.
• Optional advertising measurement. With iOS tracking permission, we process device and app identifiers, including the advertising identifier where available, IP address, device and network information, app installation and opening activity, and subscription events and revenue to understand which advertisements bring users and subscribers to Mealvia.
• Limited advertising measurement without tracking permission. After the iOS tracking prompt has been answered, Mealvia may use Apple’s SKAdNetwork and AppsFlyer’s anonymization mode to measure installations and app openings. In this mode, Mealvia disables IDFA and IDFV collection, does not supply its customer identifier, blocks user-level sharing with advertising partners, and does not link RevenueCat subscription events to AppsFlyer. This is not a zero-data mode: AppsFlyer receives technical install/session data and network requests, and its anonymization process deletes personal identifiers and hashes the AppsFlyer identifier and IP address. Apple’s SKAdNetwork provides delayed, privacy-limited campaign reports. Cooking inputs, photos and conversations are not sent through this measurement flow.
• Diagnostics. Crash and error reports may include device model, operating system, app version, technical identifiers and error details. Our error-reporting configuration excludes screenshots, session replay and intentional inclusion of recipe inputs, photos or chat messages.
• Support correspondence. If you contact us, we process your email address, message and information you choose to provide.
Cooked history, ratings, cooking-session settings and preferences are stored on your device. Relevant preferences and recipe context are also sent to our services when you use AI features. Saving a meal locally does not mean that the server copy of its generation request has been deleted.
2. Why we use information
We use information to generate recipes and illustrative dish images, identify ingredients, answer cooking questions, preserve your local cooking experience, authenticate service requests, verify and restore subscriptions, prevent abuse, troubleshoot faults, respond to support and comply with legal obligations. We also measure advertising results through Apple’s aggregate SKAdNetwork reporting and, with tracking permission, identifier-based attribution. We do not send your ingredients, dietary preferences, photos or cooking-assistant conversations to our advertising measurement partners.
3. AI processing and service providers
Mealvia uses the following providers for the stated purposes:
• Supabase: hosting, authentication, databases and storage. It processes the app identifier, service requests, recipe and assistant records, recognized ingredient results, generated images and subscription-access records.
• OpenAI: AI recipe generation, ingredient-photo recognition, cooking assistance and dish-image generation. Relevant inputs, selected scan photos and recipe or conversation context are transmitted through our backend. OpenAI does not need your Apple payment credentials to perform these tasks.
• RevenueCat: subscription validation, restoration and entitlement management, using app identifiers and purchase/subscription information.
• AppsFlyer: advertising measurement using the technical identifiers and activity described above. RevenueCat associates subscription events with an AppsFlyer identifier only when tracking permission is granted.
• Meta: advertising campaign measurement through our AppsFlyer integration. For activity attributed to Meta campaigns, configured app-opening and subscription events, including revenue values and relevant attribution information, may be shared with Meta. We use this integration to measure our advertising results; it does not receive your cooking content.
• Sentry: crash and technical error reporting.
• Apple: App Store distribution, payment processing and subscription management. Apple also processes data for its own purposes under its own privacy notices.
We do not use your AI inputs to train our own general-purpose models. OpenAI states that API data is not used to train its models by default, unless the customer opts in. Provider security or abuse-monitoring retention may still apply; using an AI feature does not imply zero retention. See OpenAI’s API data controls (https://developers.openai.com/api/docs/guides/your-data).
Provider information: Supabase (https://supabase.com/privacy), RevenueCat (https://www.revenuecat.com/privacy/), Sentry (https://sentry.io/privacy/), and Apple (https://www.apple.com/legal/privacy/). These notices supplement, rather than replace, our responsibility for the processing described here.
We may also disclose necessary data to professional advisers, authorities when legally required, or a successor in a business reorganization, subject to applicable protections and notice requirements.
Advertising partner information: AppsFlyer Services Privacy Policy (https://www.appsflyer.com/legal/services-privacy-policy/) and Meta Privacy Policy (https://www.facebook.com/privacy/policy/). These providers may also process information for their own purposes as described in their notices.
4. Permissions and sensitive information
Camera access is requested for taking ingredient photos. You may instead type ingredients or select an image using the system picker. Notification permission is used for cooking timer alerts. You can change permissions in device settings. Refusing a permission limits the corresponding feature.
Identifier-based advertising tracking is optional. Mealvia requests permission through Apple's iOS tracking prompt. Refusing or withdrawing tracking permission does not prevent you from using Mealvia or your subscription. You can change this choice in iOS Settings under Privacy & Security → Tracking.
When Mealvia detects that tracking permission has been withdrawn, it stops identifier-based AppsFlyer measurement and asks our server to remove the RevenueCat attribution identifiers used for future AppsFlyer subscription-event delivery. After the server confirms removal, the SDK may run in the limited measurement mode described above. The server update requires connectivity and can be delayed while the app is closed or offline. Withdrawal does not undo earlier lawful processing, recall events already sent or queued, or automatically delete existing provider records. Contact us for a deletion request.
Dietary exclusions or messages may reveal health or religious information. Do not submit medical records or sensitive information that is unnecessary for cooking assistance. This policy does not constitute explicit consent to processing sensitive information. Where explicit consent is required, a separate consent process is necessary before that processing. You may withdraw consent for future processing by contacting us and discontinuing the affected feature, without affecting processing lawfully carried out before withdrawal.
5. Legal bases and international processing
Where GDPR applies, ordinary service and subscription processing is based on performance of our contract with you; proportionate security, fraud prevention and technical diagnostics rely on legitimate interests; legally required processing relies on legal obligations. Optional processing and special-category data rely on consent or explicit consent where required. We assess interests against your rights.
For processing governed by Türkiye’s Law No. 6698 (KVKK), applicable grounds include processing necessary for a contract, compliance with legal obligations, establishing or protecting rights and legitimate interests that do not override fundamental rights, as applicable to each purpose. Explicit consent is required where no other lawful condition applies, including applicable special-category processing.
Our providers may process data outside your country, including in the European Economic Area and the United States. Hosting in one region does not mean all providers process data only there. International transfers are subject to applicable data-protection requirements, including any required adequacy decision, contractual safeguards or other permitted transfer mechanism. Contact us for details of the safeguards applicable to your data.
6. Retention
On-device records remain until removed or replaced through app or device controls; device backups may retain copies. Server records include generated recipes and images, recipe-request inputs, assistant questions and recent context, answers, scan results, authentication and subscription records. We retain records according to their continuing service purpose, support needs, security requirements and legal obligations; no universal automatic deletion deadline currently applies.
Mealvia does not save submitted scan-photo bytes in its application database or storage bucket. The photo is transmitted for analysis, and temporary device files and provider-side retention may remain. We store a request digest, processing status and recognition result for reliable processing.
Requests to delete server data are handled through the contact below, subject to identity verification and lawful retention exceptions. Deleting the app does not automatically delete server records or cancel an Apple subscription. We do not promise that every provider log or backup is erased immediately upon a request.
7. Your rights
Depending on your location and applicable law, you may request access, correction, erasure, restriction, portability or information about processing; object to processing based on legitimate interests; withdraw consent; and complain to a competent supervisory authority. Under KVKK Article 11, rights also include learning whether data is processed and transferred, requesting notification of corrections or erasure to recipients, objecting to adverse results arising exclusively from automated analysis, and seeking compensation for unlawful processing where applicable.
Email hello@kalestial.com to make a request. Because Mealvia uses a pseudonymous app identity, we may need proportionate information to locate and verify the relevant records. Do not send passwords, API keys or full payment card details. Some information held independently by Apple must be requested directly from Apple. Subscription cancellation is separate from data deletion.
8. Security and children
We use encrypted network connections, restricted backend access and device storage protections appropriate to the information processed. No service can guarantee absolute security.
Mealvia is not directed to children under 13. If local law requires a higher age or parental authorization, that requirement applies. If you believe a child has provided personal data improperly, contact us so we can investigate and take appropriate action.
9. Changes and contact
We will update this policy when our practices change and provide additional notice or seek consent where required. The published effective date identifies the applicable version.
Kalestial Teknoloji Limited Şirketi
Esentepe mah. Büyükdere Cd. Ferko Signature No:175/6, 34394 Şişli/İstanbul, Türkiye
hello@kalestial.com