Privacy Policy

1. Summary in plain English

This policy is long because the law in several countries requires it to be, and because we would rather over-explain than leave you guessing about medical information you trusted us with. Section 3 lists every category of data we hold. Section 8 names every company that touches it. Section 11 tells you how to get it back or have it erased, whoever you are and wherever you live.

If you only read one thing, read Section 4 — it covers the allergy, medical-condition, medication and eating-disorder answers, which are the most sensitive information TOVELU holds about anyone.

2. Who we are and how to reach us

TOVELU is operated by Ajay Sen, an individual trading as “TOVELU” as a sole proprietorship established under the laws of India. In this policy “TOVELU”, “we”, “us” and “our” mean that operator. For data-protection purposes we are the controller of your personal data (the Data Fiduciary, under Indian law) — we decide what is collected and why.

This policy applies to the website at tovelu.store, the web application at app.tovelu.store, our email communications, and our affiliate and partner programs.

• Postal address: Indore, Madhya Pradesh, India
• Privacy, data and legal contact: ask@tovelu.store
• Grievance Officer (India — Consumer Protection (E-Commerce) Rules 2020, IT Rules and DPDP Act 2023): Ajay Sen, ask@tovelu.store. We acknowledge grievances within 48 hours and resolve them within 30 days.

We are not required to appoint a Data Protection Officer and have not appointed one. All privacy questions go to the address above and are read by the founder.

3. What we collect

3.1 Before you have an account

You can complete the entire TOVELU survey without creating an account. While you do, your answers are stored in your own browser (in localStorage) so you can leave and come back. Those answers only reach our servers when you create an account at the end, or at a checkpoint if you have already given us your email. If you never create an account, clearing your browser data removes them entirely.

3.2 Account and identity

• Name and email address.
• A password, stored only as a salted cryptographic hash by our authentication provider — we never see or store your actual password. If you sign in with Google, we receive your name, email address and Google account identifier, and no password at all.
• Email verification and password-reset tokens.

3.3 Survey answers (the plan inputs)

• Body and identity data: date of birth, sex assigned at birth, height, current weight, goal weight, country of residence.
• Routine data: wake and sleep times, working pattern, preferred meal times.
• Health data: food allergies, food intolerances, health conditions, rare metabolic conditions, categories of medication you take, whether you are pregnant or breastfeeding, answers that screen for disordered eating, and answers to a mental-health and self-harm safety screening (mood, anxiety, stress, and whether you are currently having thoughts of harming yourself). The self-harm and disordered-eating screening exists solely to decide whether it is safe to give you a plan at all — see Section 5.1.
• Lifestyle data: activity level, exercise, sleep duration, smoking, alcohol, stress, emotional eating, dieting history, motivation and confidence.
• Food preferences: diet type and the specific foods you like and dislike.

3.4 Data the app creates about you as you use it

• Your generated plan: calorie and macro targets, meals, portions, grocery lists.
• Which meals you confirmed, on which day, and which meal variant you chose.
• Weekly review entries: weight, and self-rated hunger, energy, sleep and cravings.
• Wellness notes, streaks, completed weeks and milestones.
• Safety flags derived from your answers: whether onboarding was blocked and the reason code, whether you confirmed you had spoken to a doctor, and whether weight figures are hidden in your interface.
• How many food photos you have used on a given day.

3.5 Payment and subscription data

We do not receive or store your card number, CVC or bank details at any point. Payment is taken by Dodo Payments, which acts as Merchant of Record — legally the seller of record for your purchase. From them we receive and store only: a subscription identifier, a customer identifier, your subscription status, plan type, renewal date and start date.

3.6 Technical data

• IP address, browser and device type, operating system, and referring page, recorded in server and security logs by our hosting and database providers.
• Authentication events (sign-ins, failed sign-ins, password resets).
• Error and crash information when something breaks, which may incidentally include the page you were on and your user identifier.
• Affiliate referral identifiers, if you arrived through an affiliate link.
• On our marketing website only, and only where you have consented or consent is not legally required: analytics and advertising identifiers — the pages you viewed on tovelu.store, how you arrived, and cookie identifiers set by Google, Microsoft and Meta. Every one of these is listed in our Cookie Policy, and none of them operate inside the app.

3.7 If you apply to an affiliate program

If you apply to be an Affiliate or an Affiliate Manager, we collect your name, email, country, mobile number (Affiliate Manager applications), PayPal email address for payouts, your social platform handles and follower counts, your promotional plan, and your answers to the program commitments. This data is used to assess your application, run the program and pay you.

3.8 What we do not collect

We do not collect precise geolocation, we do not buy personal data from data brokers, we do not scrape social media, and we do not use device fingerprinting.

4. Your health data, specifically

Allergies, intolerances, medical conditions, metabolic conditions, medication categories, pregnancy or breastfeeding status, disordered-eating and self-harm screening answers, your weight and your body measurements are special category data under the GDPR and UK GDPR, sensitive personal data under Indian law, sensitive personal information under US state privacy laws, and consumer health data under the Washington My Health My Data Act. Your self-harm and mental-health screening answers get an extra commitment beyond everything below: they are used only to decide whether to pause or stop your onboarding, they are never shown to our AI Coach or any other model, and they are never used to personalise anything you see. See Section 5.1.

We handle them under these commitments:

• We ask only what changes your plan. Every health question in the survey maps to a specific calculation or a specific safety rule. We explain why we are asking, at the moment we ask.
• Purpose limitation. Health answers are used to generate your plan, to exclude foods that are unsafe for you, and to run our safety screening. They are used for nothing else.
• We never sell them, share them for advertising, or use them for advertising or profiling of any kind.
• We do not disclose them to any third party except the infrastructure providers in Section 8 that host the database, and then only because your record physically lives there.
• Access is limited by database row-level security: your records are readable only by your own authenticated session. Administrative access exists for support and debugging and is limited to the founder.
• Answering is your choice. You may decline any question, but declining a safety question may mean we cannot responsibly give you a plan.

Where a safety answer requires it, TOVELU will stop and decline to build you a plan — for example if you tell us you are pregnant or breastfeeding. See Section 7 and our Medical Disclaimer.

5. Food photos and AI processing

The Emergency Meal feature lets you photograph food so the app can identify what is in it. You should know exactly what happens to that image:

• The photo is sent from your device to our server, and passed straight through to Anthropic PBC (the Claude API) for identification.
• TOVELU does not store the image. It is held in memory for the length of the request and then discarded. It is never written to our database or file storage.
• Anthropic processes it as our service provider, is contractually barred from using it to train its models, and may retain it only briefly for abuse monitoring under its own terms.
• The model is asked one question only — what food is in the picture. It is deliberately never asked to estimate portions or calories; those are calculated by TOVELU from our own nutrition table.
• Food photographs are taken in kitchens and restaurants and often contain other people, faces, documents and surroundings. Please photograph the food and not the room. Do not photograph anything you would not want processed by a third-party AI service.

AI output can be wrong. Never rely on it to decide whether a food is safe for your allergy — see the Medical Disclaimer and the AI section of our Terms of Service.

5.1 The Coach

TOVELU's Coach — the chat feature, and the short personalised messages you see on Flow, Pulse and Health — is also powered by Anthropic PBC (the Claude API). Each time you use it, we send Anthropic a snapshot built fresh for that request: your first name, your goal, your daily targets, what's in your kitchen inventory, your recent check-ins (mood, energy, stress and sleep as you rated them, and your streak), your stated cooking constraints and allergies, the optional “anything else about yourself” text you gave us at signup, and the same plain-language health signals already shown to you in the app's Health tab. Nothing here is a diagnosis or a prediction — TOVELU's health signals describe patterns in what you reported, never a condition.

What is deliberately excluded, on purpose, every time: your self-harm screening answers, your disordered-eating screening answers, and any other mental-health free text you gave us. The Coach is told only that it should speak gently with certain members — never why. We built it this way because handing a model a disclosure like that risks it being reflected back at you, unprompted, in an ordinary chat about dinner; no amount of instruction to the model makes that safe enough to be worth the personalisation.

Anthropic processes this as our service provider under the same terms as the photo feature above: it is contractually barred from using it to train models, and does not receive your email, password, payment details or full account history. The Coach is not a substitute for a doctor or therapist and is not a crisis service — see the Medical Disclaimer.

6. Why we use it, and our legal basis

For people in the EEA, the UK and Switzerland, the GDPR requires us to name a lawful basis for each purpose. This is that list; it is a useful plain statement of purpose for everyone else too.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not; you can ask us for that assessment, and you can object (Section 11).

Where we rely on consent, you can withdraw it at any time and that withdrawal is as easy as giving it — email ask@tovelu.store or use the unsubscribe link in any marketing email. Withdrawing consent does not affect processing that already happened, but if you withdraw consent to health processing we will no longer be able to provide the plan, and we will close your account and refund you if you are inside the guarantee window.

7. Automated decisions about you

TOVELU makes two kinds of automated decision, and we would rather you heard it from us:

1. Your plan is generated automatically. Your calorie target, macro split, meals and portions are calculated by formula from your answers. No human reviews them before you see them.
2. Onboarding can be automatically refused. If your answers indicate certain conditions — pregnancy or breastfeeding, Type 1 diabetes, being under 18, certain rare metabolic disorders, pancreatitis, liver disease, an active eating disorder, or a body-mass index below the healthy range — the system stops and declines to build you a plan. Certain medications and conditions instead route you to a screen asking you to speak to your doctor first. These rules exist to protect you, not to judge you.

This second decision may amount to automated decision-making under Article 22 GDPR. You have the right to a human review. Email ask@tovelu.store, tell us what happened, and a person will look at it, explain the rule that fired, and correct it if it was wrong. If you were charged before the block, you are refunded in full regardless of any time limit. We do not use profiling for advertising, credit, insurance or any similar purpose.

8. Who we share it with

We do not sell your personal information, and we have never sold it. We do not share it for cross-context behavioural advertising. We share it only in these situations:

8.1 Service providers (processors)

Companies that run parts of TOVELU for us, under contracts that limit them to our instructions. The current list, with what each one receives, is published at tovelu.store/subprocessors and forms part of this policy.

8.2 Analytics and advertising partners — marketing website only

With your consent (or, outside the EEA/UK, until you opt out), Google, Microsoft and Meta receive information about your visit to tovelu.store: which pages you viewed, how you arrived, and a cookie identifier. Google and Meta act as independent or joint controllers for their own purposes as well as ours, which is why your consent matters and why you can withdraw it at any time.

What they never receive: your survey answers, any health condition, medication, allergy, pregnancy status, eating-disorder answer, weight, plan, meals or progress — because no tag of theirs runs on any screen where those exist. We also keep Google Signals switched off and IP addresses anonymised in Analytics, and we never upload a customer list, build an audience from health data, or create lookalike audiences from anything but ordinary website visits.

Manage this at any time through cookie settings, or by sending a Global Privacy Control signal, which we honour automatically.

8.3 Professional advisers

Lawyers, accountants and auditors, bound by professional confidentiality, where needed.

8.4 Law and safety

We will disclose data where we are legally required to, or where we believe in good faith it is necessary to protect someone's life or physical safety, to investigate fraud, or to establish or defend legal claims. We will tell you about a legally compelled disclosure unless we are prohibited from doing so.

8.5 Business transfer

If TOVELU is ever sold, merged or reorganised, your data may transfer to the buyer, who will remain bound by this policy for the data received. We will notify you before any transfer takes effect and, if the buyer's practices differ materially, you will be able to delete your account first.

8.6 Affiliates

Affiliates and Affiliate Managers never receive your personal data. They see anonymous, aggregated statistics only: counts of clicks, sign-ups and sales, and the commission owed. They never learn your name, email, health information or what you bought beyond the fact that a sale occurred.

9. Where your data goes

TOVELU is operated from India, and our providers are based in the European Union, the United States, the United Kingdom and elsewhere. This means your personal data is transferred internationally.

For personal data originating in the EEA, the UK or Switzerland, and transferred to a country without an adequacy decision (which includes India and, for some providers, the United States):

• We rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, and the Swiss addendum) with each provider concerned;
• We rely on the EU–US Data Privacy Framework where a US provider is certified under it;
• We apply supplementary measures: encryption in transit, encryption at rest, access control, and data minimisation.

You can request a copy of the transfer safeguards that apply to you by writing to ask@tovelu.store. For Australian users, we take reasonable steps under APP 8 to ensure overseas recipients handle your data consistently with the Australian Privacy Principles.

10. How long we keep it

Where we no longer need data but cannot delete it immediately (for example, it sits in a backup), we isolate it and stop using it until deletion happens.

11. Your rights, and how to use them

Whoever you are and wherever you live, TOVELU will honour these requests:

• Access — a copy of the personal data we hold about you.
• Portability — that copy in a structured, machine-readable format, or sent directly to another provider where technically feasible.
• Correction — fix anything inaccurate. Most of it you can edit yourself in Profile.
• Deletion — erase your account and data, subject only to records we must keep by law.
• Restriction and objection — pause a use, or object to processing based on legitimate interests.
• Withdraw consent — for marketing, or for health processing.
• Human review — of any automated decision (Section 7).
• Non-retaliation — we will never degrade your service, change your price or deny you anything for exercising a privacy right.

How: email ask@tovelu.store from the address on your account, with what you want. If we cannot tell it is you, we will ask for one more piece of verification — we will never ask for a government ID, a photograph or a payment card to verify a privacy request.

Timing: we acknowledge within 48 hours and respond within 30 days. If a request is genuinely complex we may extend once, by up to 60 days for EEA/UK requests or 45 days for California requests, and we will tell you why. Requests are free; we will only charge for a manifestly unfounded or repetitive request, and we will tell you before we do.

Authorised agents may submit requests on your behalf where the law allows; we will ask for proof of authorisation and may ask you to confirm directly.

Appeals: if we refuse a request, we will tell you why and how to appeal. To appeal, reply with “Appeal” in the subject line; the founder reviews appeals personally and responds within 45 days. This right applies to everyone, and is a legal requirement in several US states.

12. EEA, UK and Switzerland

Sections 6, 7, 9 and 11 set out your GDPR rights in full. In addition:

• Providing your health answers is not a statutory requirement, but it is necessary to receive the service; without them we cannot build a safe plan.
• You may lodge a complaint with your national supervisory authority. In Ireland that is the Data Protection Commission (dataprotection.ie); in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the FDPIC. We would appreciate the chance to fix it first.
• Our Article 27 representatives are named in Section 2.

13. India (Digital Personal Data Protection Act, 2023)

TOVELU is a Data Fiduciary. If you are in India, you are a Data Principal and you have the right to access a summary of your data and our processing, to correction and erasure, to nominate another person to exercise your rights if you die or become incapacitated, and to a grievance redressal mechanism.

Our Grievance Officer is Ajay Sen, reachable at ask@tovelu.store, acknowledging within 48 hours and resolving within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

We process your data on the basis of your consent, given through this notice and the survey, and for the legitimate uses permitted by the Act. You may withdraw consent at any time (Section 11). We also treat your health information as sensitive personal data or information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and maintain reasonable security practices accordingly.

Because TOVELU requires all users to be 18 or older, we do not knowingly process the data of a child as defined by the Act, and therefore do not carry out behavioural tracking or targeted advertising directed at children.

14. United States

This section applies if you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia or another state with a comprehensive privacy law.

14.1 Notice at collection

The categories of personal information we collect, and why, are in Sections 3 and 6. In the terms used by the California Consumer Privacy Act, we collect: identifiers; customer records; commercial information; internet activity; and sensitive personal information in the form of health data and, where you sign in with Google, account credentials. We collect it from you directly, from your device, and from our payment processor. Of these, only internet activity on our marketing website is shared for advertising (Section 14.2); identifiers, customer records and all sensitive information are not. Retention periods are in Section 10.

14.2 Sale and sharing

We do not sell personal information for money. However, allowing Meta and Google advertising cookies on our marketing website counts as “sharing” personal information for cross-context behavioural advertising under the CCPA, and some regulators treat it as a “sale”. We describe it that way rather than relying on a narrow reading in our own favour.

What is shared: internet activity on tovelu.store — pages viewed, referrer, and a cookie identifier — with Google and Meta. What is never shared: your health data, survey answers, plan, weight or anything else from the app, because no advertising technology runs there at all.

We do not sell or share the personal information of anyone we know to be under 18, and TOVELU is an adults-only service.

To opt out, choose whichever is easiest:

• Use the Do Not Sell or Share My Personal Information link, in our footer on every page and here.
• Turn on Global Privacy Control in your browser or extension — we detect and honour it automatically, with no further action from you, and we treat it as a valid opt-out request.
• Email ask@tovelu.store and we will apply it to your account.

Opting out is free, takes effect immediately, and changes nothing about your price, your plan or your access.

14.3 Sensitive personal information

We use sensitive personal information only for the purposes permitted by CCPA §7027(m) — providing the service you asked for, security, and safety. We do not use or disclose it to infer characteristics about you, and we never share or sell it for advertising of any kind. You have the right to limit its use, and it is already limited to the narrowest permitted set.

14.4 Your rights

You have the rights listed in Section 11 — to know, access, delete, correct, port, limit sensitive-data use, opt out of sale/share/targeted advertising and profiling, and appeal. We will not discriminate against you for exercising them. Exercise them at ask@tovelu.store.

14.5 Shine the Light

California Civil Code §1798.83 lets California residents ask about disclosures to third parties for their own direct-marketing use. We make no such disclosures.

15. Consumer health data (Washington, Nevada)

This section is the Consumer Health Data Privacy Policy required by the Washington My Health My Data Act, and also addresses Nevada SB 370.

• What consumer health data we collect: the health, body, medication, reproductive-status and eating-behaviour information listed in Sections 3.3 and 3.4, plus food photographs processed transiently under Section 5.
• Sources: you, directly, through the survey and the app. Nothing is inferred from third-party sources.
• Purposes: generating and adjusting your meal plan, excluding unsafe foods, running safety screening, and showing you your own progress. Nothing else.
• Who we share it with: only the processors listed at subprocessors that host or transmit it — our database, hosting and, for photos only, AI identification providers. We do not sell consumer health data, and we will not sell it. Selling it would require your separate written authorisation, which we do not seek and would not accept.
• Advertising: no consumer health data is ever shared with Google, Meta, Microsoft or any advertising network. Our analytics and advertising tags run only on the marketing website at tovelu.store and are blocked in code from running on app.tovelu.store, where every health question and every health record lives. We do not build advertising audiences from health data, do not create lookalike audiences from it, and do not use it to target or suppress any ad.
• Your rights: to confirm whether we collect, share or sell your consumer health data; to access it; to withdraw consent to its collection and sharing; and to have it deleted, including from our backups on our normal cycle. We will pass a deletion request on to our processors.
• How to exercise them: ask@tovelu.store. We respond within 45 days, extendable once by 45 days with notice. If we deny your request, you may appeal as described in Section 11, and you may complain to the Washington State Attorney General.
• Geofencing: we do not, and will not, use geofences around health facilities or anywhere else.

16. Canada, Australia, Brazil and elsewhere

• Canada (PIPEDA, Quebec Law 25): we collect, use and disclose personal information with your knowledge and consent, for the purposes stated here. Health information is collected with express consent. You may complain to the Office of the Privacy Commissioner of Canada. Commercial email is sent only with express consent and always carries an unsubscribe link and our identity, as CASL requires.
• Australia (Privacy Act 1988): we handle personal and health information in line with the Australian Privacy Principles, including APP 8 on overseas disclosure. Complaints may go to the Office of the Australian Information Commissioner.
• Brazil (LGPD): you have rights of confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. Health data is processed on the basis of your specific and highlighted consent.
• South Africa (POPIA), Japan (APPI), South Korea (PIPA) and other jurisdictions: we apply the standards in this policy globally, and we will honour any additional local right you assert.

17. How we protect it

• Encryption in transit (HTTPS/TLS) everywhere, and encryption at rest at our database provider.
• Row-level security in the database: your records are readable only by your own authenticated session, enforced by the database itself rather than by application code.
• Passwords are hashed and salted by our authentication provider; we never see them.
• Payment card data never reaches our systems.
• Payment webhooks are cryptographically signature-verified; unsigned or forged requests are rejected.
• Security headers (HSTS, X-Content-Type-Options, X-Frame-Options) on our domains, and rate limiting on sensitive endpoints.
• Administrative access is limited to the founder and uses separate credentials.

No system is perfectly secure, and we will not pretend otherwise. Use a strong, unique password. If we suffer a personal-data breach that is likely to result in a risk to you, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay. If you believe you have found a vulnerability, please tell us — see our Security & Responsible Disclosure page.

18. Children

TOVELU is for adults. You must be 18 or older to use it, and the survey blocks anyone whose date of birth shows they are under 18. Calorie restriction and ketogenic eating are not appropriate for children and adolescents without medical supervision, which is a safety decision before it is a legal one.

We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, email ask@tovelu.store and we will delete the account and the data promptly and refund any payment.

19. Changes to this policy

We will update this policy as TOVELU changes. The “last updated” date at the top always reflects the current version. If a change is material — a new purpose, a new category of data, a new recipient, or anything that reduces your rights — we will notify you by email or in the app before it takes effect, and where the law requires consent for the change we will ask for it rather than assume it. We keep prior versions and will send you one on request.

20. Complaints

Tell us first: ask@tovelu.store. Every complaint is acknowledged within 48 hours and answered within 30 days. If you are still unhappy, you may complain to your data-protection authority — the Data Protection Board of India, your EEA supervisory authority, the UK ICO, the Washington or California Attorney General, the Office of the Privacy Commissioner of Canada, or the OAIC in Australia, as applicable to you. Nothing in this policy removes that right.