Privacy policy

Last updated: May 6, 2026 · Effective date: May 6, 2026

This Privacy Policy describes how WeBiznis, obrt za računalno programiranje i digitalne usluge, vl. Filip Kalajžić (“Bulky,” “we,” “us,” or “our”) collects, uses, and shares information about you when you use our mobile application Bulky (the “App”) and our website at getbulkyapp.com (collectively, the “Service”).

We are the data controller for the personal data processed in connection with the Service.

WeBiznis, obrt za računalno programiranje i digitalne usluge, vl. Filip Kalajžić

Velimira Kljaića 2, Zagreb, Croatia

OIB (Tax ID): 07618939105

Email: info@webiznis.eu

1. Age requirement

The Service is intended for users 18 years of age and older. We do not knowingly collect personal data from anyone under 18. If you become aware that a minor has provided us with personal data, please contact us at info@webiznis.eu and we will delete it.

2. Information we collect

2.1 Information you provide

• Account information: email address, password (hashed), display name (optional)
• Profile and fitness data: age, gender, height, weight, activity level, fitness goals, target macros and calories
• Photos: images of meals you submit for AI analysis
• Subscription data: subscription tier, purchase status (we do not collect or store payment card details)
• Communications: any messages you send us via email or in-app support

2.2 Information collected automatically

• Device data: device model, operating system, app version, language, time zone
• Usage data: screens viewed, features used, scan history, session duration
• Diagnostic data: crash logs, performance metrics
• Identifiers: anonymous user ID, advertising identifier (only if you have not opted out via device settings)

2.3 Information we do not collect

We do not collect: government IDs, payment card numbers, biometric data, precise location, contacts, or microphone input.

3. How we use your information

We use your information to:

• Provide and operate the Service (meal scanning, macro tracking, progress tracking)
• Process AI analysis of meal photos via our AI processing partner
• Personalize your experience (calorie and macro recommendations based on your profile)
• Manage your account and subscription
• Send transactional communications (account confirmations, subscription receipts)
• Improve the Service through analytics and crash reporting
• Detect, prevent, and address fraud, abuse, or security issues
• Comply with legal obligations

4. Legal basis for processing (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Performance of a contract — to provide the Service you requested
• Consent — for optional features such as analytics and marketing communications (you can withdraw consent at any time)
• Legitimate interests — to secure the Service, prevent fraud, and improve our product
• Legal obligation — to comply with applicable laws

5. Sharing your information

We do not sell your personal data. We share information only with the following categories of third parties acting as data processors on our behalf:

We may also disclose information when required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Bulky, our users, or others.

6. International data transfers

Your data may be transferred to, stored in, and processed in countries outside the European Economic Area, including the United States. When we transfer personal data outside the EEA, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

7. Data retention

• Account data: retained while your account is active and for up to 90 days after deletion
• Meal photos: retained while your account is active; deleted within 30 days of account deletion
• Subscription records: retained for 7 years to comply with tax and accounting obligations under Croatian law
• Anonymized analytics: retained indefinitely
• Backups: deleted within 90 days of account deletion

You can delete your account at any time from the App settings or by emailing info@webiznis.eu.

8. Your rights

8.1 GDPR (EEA, UK, Switzerland)

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure (“right to be forgotten”) — request deletion of your data
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, where processing is based on consent
• Lodge a complaint — with your local data protection authority (in Croatia: AZOP — azop.hr)

8.2 CCPA / CPRA (California residents)

• Right to know what personal information we collect, use, and share
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing — we do not sell or share personal information
• Right to non-discrimination for exercising your rights

To exercise any right, contact us at info@webiznis.eu. We will respond within 30 days (GDPR) or 45 days (CCPA).

9. Security

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS 1.2+), encryption at rest, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Health and fitness disclaimer

The Service provides estimates of nutritional content based on AI image analysis. It is not medical advice. Estimates may be inaccurate. Consult a qualified healthcare professional before making decisions about your diet, especially if you have medical conditions, allergies, or are pregnant.

11. Children’s privacy

The Service is not intended for users under 18. We do not knowingly collect data from minors. If we learn we have collected data from a minor, we will delete it.

12. Third-party links

The Service may contain links to third-party sites. We are not responsible for their privacy practices. Review their privacy policies before providing data.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or in-app notice at least 14 days before taking effect. The “Last updated” date at the top reflects the most recent revision.

14. Contact us

For privacy questions or to exercise your rights:

WeBiznis, obrt za računalno programiranje i digitalne usluge, vl. Filip Kalajžić

Velimira Kljaića 2, Zagreb, Croatia

OIB (Tax ID): 07618939105

Email: info@webiznis.eu