Privacy Policy

Privacy Policy

This privacy policy explains how Carbs & Cals (“we”, “us”, “our”) collects, uses, shares, protects and stores your personal data when you visit our website or use our services. We are committed to protecting your privacy and complying with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Policy is reviewed every 6 months; last reviewed and updated January 2026.

GDPR and Your Rights

Your rights under UK GDPR include:

• the right to be informed
• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object
• rights in relation to automated decision-making and profiling.

1. What Personal Information We Collect

We collect personal data when you:

• register or sign up for newsletters, or free resources
• use our contact form
• interact with app features (e.g., height, weight, date of birth, food data stored on your device)
• make purchases or bulk requests
• agree to review a product
• Request permission to use our images

Types of data we collect may include: name, email address, app usage information, and information you voluntarily provide. 

2. How We Collect Your Information

We collect data:

• Directly from you when you provide it
• Through cookies and analytics when you use our site: Cookies Policy
• From third parties where you authorise sharing (e.g., Apple HealthKit / Google Fit). 

3. How We Use Your Information

We use your personal data for the following purposes and legal bases:

• To provide services and functionality (e.g., newsletter, app features): Performance of a contract
• To personalise your experience: Legitimate interests (improving our services)
• To send you marketing emails: Consent (you can withdraw at any time)
• To respond to queries or support requests: Performance of a contract or legitimate interests
• To comply with legal obligations: Legal obligation

4. Cookies and Tracking

We use cookies and similar technologies such as Google Analytics to collect information about your use of the website. For details about this and how to manage preferences, see our Cookies Policy.

5. Sharing and International Transfers

We may share your data with:

• service providers operating on our behalf (e.g., email platforms)
• analytics and advertising partners
• legal authorities if required by law. 

Some third parties may process data in countries outside the UK. Where this occurs, we ensure appropriate safeguards such as Standard Contractual Clauses are in place.

6. How Long We Retain Your Data

We retain personal data only as long as necessary:

• Mailing list data is retained until you unsubscribe
• Contact correspondence is retained for up to 60 months after final contact
• Product review data may be retained up to 24 months
• App data remains on your device until deletion. The data, however, may still exist on your cloud backup, but we do not have access to this data. 

7. How We Protect Your Information

We use appropriate technical and organisational measures to protect your data, such as encryption (SSL) and access restrictions. Although we strive to protect your data, no transmission over the internet can be guaranteed 100% secure.

8. Google Analytics

We use Google Analytics, a web analytics service provided by Google, to help us understand how visitors use our website. Google Analytics uses cookies and similar technologies to collect information about website usage, such as pages visited, time spent on the site, and the type of device and browser used.

The information generated by these cookies about your use of the website is transmitted to and stored by Google. We use this information to compile reports on website activity and to help us improve the performance, content, and usability of our website.

We only use Google Analytics where permitted by applicable cookie and data protection laws. You can control or withdraw your consent for analytics cookies at any time via our cookie consent tool, and you can also manage cookies through your browser settings.

Google provides further information about how it uses data collected from sites that use its services in its own privacy policy.

9. Your Rights and How to Exercise Them

You may:

• request access, correction or deletion of your personal data
• withdraw consent at any time 
• object to processing based on legitimate interests
• request restriction or portability of your personal data.

To exercise your rights, contact us via the contact form or email us. We will respond within one month where possible.

10. Complaints

If you have concerns about how we use your personal data, please contact us first so we can resolve them. The contact form can be found here.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your rights have been violated.

11. Updates to This Policy

We review this policy regularly and may update it from time to time. The “Last updated” date at the top shows when this policy was last revised.