Last updated: 30.08.2026
The responsible party for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Dynamis Health UG (haftungsbeschränkt)
Merowingerstraße 7
82166 Gräfelfing
Germany
Represented by the Managing Directors (Geschäftsführer):
Moritz Koberling
Cornelius Ramesohl
Contact:
E-Mail: calog@dynamis.health
Register Court: Amtsgericht München, HRB 295206
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Legal Basis: We only process data if we have a legal basis to do so, such as:
Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. The personal data collected on this website is stored on Vercel's servers. This is based on our legitimate interest in the secure and efficient provision of our online offer (Art. 6 para. 1 lit. f GDPR).
The data you create in the calog app — your meals, sport sessions, profile and settings — is stored in a PostgreSQL database and object storage operated by Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992, on Amazon Web Services infrastructure in the eu-central-1 region (Frankfurt am Main, Germany). Supabase hosts a project's database, authentication service and storage objects in the region the project was created in, so this data is held inside the European Union and inside Germany.
Supabase encrypts all customer data at rest with AES-256 and in transit via TLS, is SOC 2 Type 2 compliant and ISO 27001 certified, and takes daily backups of the database.
Two exceptions are worth stating plainly. First, serverless functions used by the app may execute outside Germany even though the data they read and write is stored in Frankfurt. Second, the AI meal analysis described in Section 7 transmits the content of your query to Google for processing; that transfer is governed by Google's Cloud Data Processing Addendum and is not covered by the storage location above.
Legal Basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR). We have concluded a data processing agreement with Supabase pursuant to Art. 28 GDPR.
When you visit our website, the provider automatically collects and stores information in server log files:
We use Vercel Web Analytics to understand how our website is used. Vercel Analytics is designed to be privacy-friendly and does not use cookies to track visitors across different websites. Data is collected anonymously and aggregated.
Legal Basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the technical functionality and optimization of the website).
If you register for our waitlist, we collect your email address to inform you about our launch and updates.
Legal Basis: The processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw this consent at any time.
When using the Calog application, we process the data you enter (e.g., meal logs, nutritional data, user profile details) to provide the service.
Legal Basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR).
Health Data: If you track health-related metrics, we process this special category of data based on your explicit consent (Art. 9 para. 2 lit. a GDPR).
Features such as photo-based meal recognition, the Calo chat assistant, and automated meal, day, and week evaluations are powered by Google's Gemini AI models, which we access through a billed Google Cloud project (Google's "Paid Services", as opposed to the free, unbilled tier). To provide these features, the relevant content — e.g., a photo of your meal, a text message you send to Calo, or your logged meal and nutrition data — is transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (and, as part of the Google group of companies, potentially Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for processing, in order to generate the nutritional estimate, chat response, or evaluation shown to you.
We have accepted Google's Cloud Data Processing Addendum for this processing. Under this agreement, Google contractually commits not to use the content you submit, or the model's output, to develop or improve its products, including to train its models.
Legal Basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR), and, where health-related metrics are involved, your explicit consent (Art. 9 para. 2 lit. a GDPR) as described in Section 6.
When you log a meal using the voice-input feature, Calo captures your spoken words in order to transcribe them into text for your meal entry.
Legal Basis: Your consent, given via the iOS microphone and speech-recognition permission prompts (Art. 6 para. 1 lit. a GDPR).
Recipient (iOS versions below 26 only): Apple Inc., see Section 11 (International Data Transfers).
If you use the "share" function to share a meal, we generate a unique link (e.g., calog.io/meal/...) for that meal. Anyone who has this link can view the shared meal — including its nutritional information and Calo's AI evaluation, together with your first name — without needing to log in or have a calog account. Please only share links to meals with people you are comfortable having access to this information, and be aware that a link may be forwarded beyond the person you originally sent it to.
Legal Basis: This processing is based on your own action of creating and sending the share link (Art. 6 para. 1 lit. b GDPR, performance of a feature of the contract). If you would like a previously shared link deactivated, please contact us at calog@dynamis.health.
When you purchase a calog Premium subscription, we process the following data via Apple and our subscription management partner RevenueCat, Inc. (revenuecat.com/privacy):
We never receive your payment method, card number, or billing address — these are handled exclusively by Apple. We use the data above to grant or revoke access to calog Premium features and to honor restore-purchases requests.
Legal Basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR).
Recipients: Apple Inc., RevenueCat Inc., and our hosting provider Supabase. We do not share purchase data for advertising or analytics purposes.
Retention: Purchase records are retained for as long as required for tax, accounting, and warranty obligations under applicable law (typically 10 years in Germany).
Some of our service providers — Vercel Inc. (hosting), Google (Gemini AI, Section 7), Apple Inc. (speech recognition on iOS < 26, Section 8, and subscriptions, Section 10), and RevenueCat Inc. (subscriptions, Section 10) — are based in, or may process data in, the United States, a country outside the European Economic Area. Where this is the case, we ensure an adequate level of data protection through appropriate safeguards, in particular the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).
We do not sell your personal data. We only pass on data to third parties (e.g., database providers) if this is necessary for the fulfillment of the contract or if we are legally obliged to do so. We have concluded data processing agreements (AV-Verträge) with these service providers.
Under the GDPR, you have the following rights regarding your personal data:
To exercise these rights, please contact us at: calog@dynamis.health
You have the right to lodge a complaint with a supervisory authority. The competent authority for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
We use SSL/TLS encryption for our website to ensure the security of data processing and to protect the transmission of confidential content.
We reserve the right to update this Privacy Policy. The current version can always be found on this page.
