Consent to Processing of Personal Data

FotoBite — AI-powered calorie tracking Version dated 22 August 2026 This consent is provided pursuant to Art. 6(1)(a) and Art. 9(2)(a) of the EU General Data Protection Regulation (GDPR) 2016/679.

I, the user of the FotoBite service, hereby give my freely, specifically, informed and unambiguous consent to Individual Entrepreneur Oleg Vladimirovich Lalaev (ИП Лалаев Олег Владимирович) (hereinafter — the "Controller"), to process my personal data on the following terms:

1. Categories of Personal Data

I consent to the processing of the following personal data:

• Telegram User ID, first name, and username;

• Health and biometric data: sex, age, height (cm), current weight (kg), goal weight (kg), physical activity level;

• Food diary data: meal records (date, meal type, macronutrients/kcal, food items), food photographs submitted for AI analysis;

• Weight log data: chronological weight measurements;

• Payment data: Telegram payment charge identifier, payer's Telegram identifier, amount in Telegram Stars, purchased plan, payment date, subscription status, refund date and outcome;

• Technical data: date and time of interaction with the Service, timezone, interface language, date and version of this consent.

The user's IP address is processed transiently for security and rate-limiting purposes and is not stored in the database.

2. Purposes of Processing

• Calculation of the daily calorie and macronutrient target (KBZHU);

• Food diary and weight log management; generation of progress reports;

• AI-based recognition of food items from photographs;

• Sending personalised reminders via the Telegram bot (opt-in, withdrawable at any time in settings);

• Ensuring the security and proper functioning of the Service;

• Compliance with applicable legal obligations.

3. Processing Operations and Methods

The Controller is authorised to perform the following operations: collection, recording, organisation, accumulation, storage, clarification (updating, modification), retrieval, use, disclosure (transfer) to authorised processors acting under the Controller's instructions, anonymisation, deletion and destruction.

Method: automated processing using computing systems.

4. Transfer to Third Parties and International Transfers

I consent to the transfer of my personal data to the following parties who process data on the Controller's behalf:

Personal data is not transferred for commercial purposes, not used for targeted advertising, and not sold.

International transfers. I have been informed and consent to the fact that the primary database is hosted in Germany (EU). Any transfers outside the EEA rely on appropriate safeguards under Art. 46 GDPR (Standard Contractual Clauses).

⚠️ This consent explicitly covers the processing of Special Categories of personal data — namely health and biometric information (weight, body parameters, dietary data) — pursuant to Art. 9(2)(a) GDPR.

5. Legal Bases for Processing

6. Retention Period

This consent remains in effect from the moment it is given until the deletion of my account or until the Controller receives a withdrawal request.

After withdrawal or account deletion, the Controller will cease processing, except for data whose retention is required by law: consent records are kept for 3 years after the processing purposes are met, the consent expires or is withdrawn; payment records are kept for 3 years from the payment date.

7. Your Rights Under GDPR

As a data subject, I am informed that I have the right to:

• Access (Art. 15) — obtain confirmation of processing and a copy of my data (JSON export in app settings);

• Rectification (Art. 16) — correct inaccurate data in profile settings;

• Erasure (Art. 17) — delete my account and all associated data (immediate, via "Delete account" in settings);

• Restriction (Art. 18) — request restriction of processing in certain circumstances;

• Portability (Art. 20) — receive my data in a machine-readable format (JSON export);

• Object (Art. 21) — object to processing based on legitimate interests;

• Withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing prior to withdrawal;

• Lodge a complaint (Art. 77) — with the supervisory authority in my country of residence (see edpb.europa.eu).

All requests are handled within 30 days (Art. 12 GDPR).

8. How to Withdraw Consent

Consent may be withdrawn at any time by one of the following methods:

1. Using the "Delete account" function in the app settings;

1. Sending a written request to the Controller's email: [email protected];

1. Via the Telegram bot: @fotobite\_bot.

Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. When the in-app "Delete account" function is used, the request is executed immediately; a written request is executed no later than 10 working days after it is received.

9. Confirmation of Consent

This consent is given in electronic form upon registration in the FotoBite Service by activating the corresponding checkbox in the application interface. The fact, date, time and version of consent are recorded automatically and retained by the Controller for 3 years after the processing purposes are met, the consent expires or is withdrawn.

By activating the checkbox, I confirm that:

• I am 18 years of age or older;

• I have read and understood the [FotoBite Privacy Policy](/privacy);

• I give this consent freely, without coercion, having been fully informed of the purposes and conditions of processing;

• I understand that I may withdraw this consent at any time without any negative consequences for using the Service (other than the discontinuation of data processing).

Controller contact: ИП Лалаев Олег Владимирович · Email: [email protected] · Telegram: @fotobite\_bot

© 2026 FotoBite. All rights reserved. Version 22.08.2026.