Privacy policy

This is a translation for convenience. The Spanish version is the legally binding one.

Last updated: October 20, 2026

1. Data we collect

• Account: first and last name (required), username, email address, phone number (optional, only to send you notifications) and the identifier of the account you sign in with (email and password, Google, Facebook or Apple). We don't store your password in readable form; Firebase Authentication manages it.
• Profile: name, date of birth, gender, weight, height, activity level, goal, target weight, diet type, allergies, foods you prefer to avoid and meal times.
• Food: your diary entries (foods, portions, calories, macronutrients and micronutrients), the meal photos you analyze, the barcodes you scan, your recipes and favorites, and the weekly plans, shopping lists and reviews you generate.
• Body and habits (optional): logged weights, body measurements, body fat percentage, progress photos, water intake, supplements you check off and your decisions about the goals the coach suggests.
• Fasting (optional, Premium): your fasts (plan, start, end and whether you reached your goal), how often you want the water reminder, your longest fast, the date and time you confirm the risks and your prior experience for fasts longer than 24 hours, and your answers to the safety questionnaire: age (if your profile doesn't have it), pregnancy or breastfeeding, eating disorders, diabetes and medications such as insulin or sulfonylureas, organ diseases, gout or gallstones, diuretics or blood pressure medications, and your confirmations that your doctor adjusted your treatment or agrees with a fast longer than 24 hours.
• GLP-1 treatment (optional, Premium): the medication and dose your doctor prescribed, the reminder frequency and time, the doses you log (date and, if you want, the injection site) and the symptoms you note. SUMA only records what you enter; it never suggests or changes doses.
• Physical activity (optional): steps, workouts, active and total calories, sleep, weight, body fat % and heart rate, only if you connect Health Connect or Apple Health (see section 6).
• Conversations: the messages you write to the assistant (AI Coach) and its replies.
• Preferences: language, units of measurement, and your settings for reminders, challenges and SumaPoints.
• Purchases: the plan you bought, its validity and the receipt the store provides. We don't receive or store your card details.
• Technical and connection data: IP address, approximate location inferred from that IP (city, state and country; it isn't your phone's exact location and we don't use GPS), device model and operating system, App version, language, sign-in method, dates of first and last connection, the most recent IP addresses you signed in from, and error logs. We use them to protect your account, prevent fraud and abuse, and provide support. We don't store advertising or device identifiers.

2. What we use it for

Necessary purposes: creating and protecting your account; calculating your goals and showing you your diary, progress and recommendations; analyzing food photos, text and barcodes; generating plans, lists and reviews; replying in the chat; sending the reminders you turn on; managing your subscription and providing support; meeting legal and tax obligations; and preventing fraud and abuse.

Secondary purposes (you can object by writing to contacto@sumaai.app without affecting the service): aggregate statistics to improve the App and sending you news about SUMAAI.

We don't sell your data or use it for personalized advertising.

3. Health data and consent

Your weight, measurements, food, allergies, physical activity, fasts, GLP-1 medication and dose, symptoms and progress photos may be considered sensitive personal data. We process them only for the purposes above and with your express consent, which you give when you sign up and when you turn on each optional feature. You can withdraw it at any time by turning off the feature, deleting the data in the App or deleting your account.

The information the App shows is for guidance only and doesn't replace seeing a doctor or dietitian.

4. Artificial intelligence

To analyze food photos and descriptions, reply in the chat and generate plans, we send the necessary content (the photo or text, plus the profile data relevant to the answer, such as your goal, weight or allergies) to Anthropic (Claude models), which acts as a data processor. In addition, every message you write to the AI Coach is sent with a summary of your day: what you ate against your goals, water, steps, weight, fasting and, if you use GLP-1 mode, your medication, dose and symptoms. Anthropic processes this information only to return the result to us and, under its commercial terms, doesn't use it to train its models. AI results are estimates: review them and adjust them when needed.

When you scan a barcode, we query the public Open Food Facts database, sending only the barcode number, with no personal data.

5. Voice dictation (optional)

If you use voice dictation, the App uses your phone's built-in speech recognition service (Google's, on Android) to turn your voice into text. We don't record or store the audio; we only receive the resulting text, which is treated like any written description. It needs microphone permission, which you can deny or withdraw.

6. Physical activity (Health Connect and Apple Health)

If you choose to connect Health Connect (Android) or Apple Health (iOS), the App only reads the following data, with your permission: steps, exercise sessions (type and duration), active and total calories burned, sleep (duration and stages), weight and body fat percentage (for example, from a smart scale or a watch) and heart rate (during your workouts and at rest). You can grant permission for only some of them. The App doesn't write data to those platforms or read any other data types (for example, location or routes).

We store in your account only daily totals for the most recently synced days (steps, active and total calories, minutes of sleep per night, resting heart rate and workouts with their type, minutes, calories and average and maximum heart rate; never individual heart rate readings), and we add your scale's weigh-ins and body fat percentage to your weight and measurements history (without replacing what you enter manually), in order to show you your activity in the App and, only if you turn it on, adjust your calorie and carb goals on training days (heart rate is used to estimate the intensity of each workout based on your age). This data isn't sold, isn't used for advertising, isn't shared with third parties (except the App's hosting provider, which acts as a processor) and isn't used for any purpose other than these features.

You can disconnect the source and delete the synced data at any time from Profile > Physical activity, and withdraw permissions from the Health Connect or Health settings. Use of information received from Health Connect complies with the Health Connect Permissions Policy, including the Limited Use requirements.

7. Sharing with your dietitian or trainer (optional)

Only if you decide to, you can link your account with a professional by entering the code they give you. Before accepting, you'll see their name and exactly what will be shared. With your consent, the professional can see your food diary, your weight and your goals, adjust your goals and leave you notes. They don't see your conversations with the assistant, your photos or your payment details. The professional is responsible for how they use the information in their care. You can unlink them whenever you want from Profile > My dietitian, and they lose access immediately.

8. Processors and transfers

We share data only with providers that provide services to us under contract and confidentiality:

• Google (Firebase): hosting for the database, files, authentication and server functions.
• Anthropic: artificial intelligence processing (section 4).
• Google Play and Stripe: subscription billing (section 9).
• Mailgun: account emails (verification, recovery and confirmations).

Some of these providers process data outside Mexico, mainly in the United States, with equivalent protection measures. We may also hand over information to authorities when a law or an order requires it. Transfers needed to provide the service don't require your consent under the law.

9. Payments and subscriptions

In the Android app, subscriptions are billed through Google Play; on the website, through Stripe. They process your payment method under their own privacy policies. We only receive confirmation of the purchase, the plan and its validity to activate Premium.

10. Device permissions

• Camera: taking photos of dishes and nutrition labels, and scanning barcodes.
• Photos or gallery: choosing photos of dishes or progress photos.
• Microphone: voice dictation.
• Notifications: reminders you set up.
• Health Connect / Health: reading physical activity.

All of them are optional; denying them only limits the related feature.

11. Your rights and how to delete your account

You can exercise your rights of Access, Rectification, Cancellation and Objection (ARCO rights), revoke your consent or limit the use of your data by writing to contacto@sumaai.app with your name, your account email, an ID and a description of your request. We'll reply within 20 business days at most and, if applicable, carry it out within the following 15 business days.

You can correct most of your data in the App and delete your account in Profile > Delete account, or by following the instructions at sumaai.app/en/delete-account (in Spanish). When you delete it, we erase your profile, diary, photos, conversations, plans, body and activity data, reminders, links with professionals and technical and connection data (IP, approximate location and device).

12. Retention

We keep your data while your account is active. Technical and connection data (IP, approximate location from IP and device) is updated with each use; we keep only the last 5 IP addresses, and they're deleted along with your account. When you delete it, we erase your data from our systems, except the minimum information the law requires us to keep (for example, tax or payment records) and security logs, which are deleted or anonymized when that period ends.

13. Security

We apply reasonable technical, administrative and physical measures: encrypted connections, rules that prevent one user from seeing another user's data, limited and logged staff access, and service keys that never reach the phone. No system is infallible; if a breach affecting your rights occurred, we would let you know.

14. Minors

The App isn't intended for anyone under 18. If we find data from a minor without authorization from their parent or legal guardian, we'll delete it.

15. Changes to this policy

If we change this policy, we'll let you know in the App or on this site, showing the date of the update. If the change requires new consent, we'll ask for it before applying it.