1 Introduction
Everwake Interactive Pty Ltd (ABN 66 688 718 881) ("we", "us", or "our") is the Australian company responsible for processing your Personal Data through Everbite. We provide the Everbite mobile applications, websites, web applications and related services (collectively, the "Service") as a digital utility that allows you to track nutrition and save and organise meals. You can record meals manually or use our AI-powered meal scanner to help identify foods and estimate nutrition information.
The purpose of this Privacy Policy is to be transparent about how data is handled. It explains what Personal Data is collected, how that information is used, with whom it is shared, and the steps taken to ensure its protection.
As an Australian company, we comply with the Australian Privacy Act 1988 (Cth). Where applicable, we also comply with United States privacy laws. Where processing requires your consent, we ask for it through a clear affirmative choice.
Consumers covered by applicable US state consumer-health laws should also read our US Consumer Health Data Privacy Notice.
2 Information We Collect
To provide our Services, we must collect and process certain information. In this policy, we use the term "Personal Data" as an umbrella term to include all information that identifies you, directly or indirectly. This definition encompasses all legal terms used in different jurisdictions, including "Personal Information" (under the Australian Privacy Act and the CCPA) and "Personal Data" (under the GDPR).
A specific and important subset of this is "Sensitive Data." This includes what the GDPR defines as "Special Categories of Data" and what the Australian Privacy Act refers to as "Sensitive Information." For our Services, this primarily relates to your health, nutrition, and body measurements. Unless otherwise stated, all references to "Personal Data" in this policy include "Sensitive Data." We apply technical and organisational safeguards appropriate to the sensitivity of the data and the risks of processing it.
User-Provided Personal Data
When you create an account or use our services, we collect:
- Name and email address.
- Age and gender.
- Any extra details you choose to add to your profile.
We may use your age and gender as inputs to generate estimates within self-directed target-setting utilities, such as estimated nutrition or calorie targets.
We use this information to communicate with you, manage your unique profile and secure your account. We may also use it for research or marketing after it has been aggregated and irreversibly anonymized so that no individual is reasonably identifiable.
Subscription and Transaction Data
When you purchase a subscription, we receive information needed to manage your access, such as your subscription plan, purchase status, renewal or expiry date, and transaction identifiers. Payments are processed by app stores or third-party payment providers. Payment credentials are provided directly to the payment processor and are not stored by us.
Health and Nutrition Data
To deliver the core functionality of the Services, we collect the following data from your input:
- Body weight, height, activity level and progress measurements.
- Food logs, including user-uploaded food photos, AI-generated results, manually entered data, notes and associated metadata.
- Dietary preferences and nutrition goals.
- Progress photos, where this feature is available and you choose to upload them.
It is up to you which health information to provide. However, some essential features require specific health information to function. We collect this to provide nutrition estimates, track your entries and progress over time, and help you review information related to your nutrition and general wellness. We may also use food photos under the optional-consent and anonymous-data rules in section 3.
Device & Usage Data
We may automatically collect:
- Device and software information, such as device type, operating-system version, app version, IP address and device or account identifiers.
- An approximate country or region inferred from device or app settings, such as locale.
- App usage and interaction data, such as features used, event logs and notification interactions.
- Notification information, such as push tokens and permission settings.
- Performance and diagnostic data, such as crash logs.
We use this data to secure the Service, diagnose performance issues and make informed product decisions.
3 How We Use Your Information
Provide the service
We use the information we collect to provide the core functions of Everbite. This includes using your data for food identification, providing nutrition estimates, and helping you find insights into your habits. We also use your information to ensure the stability and performance of the Service, manage your account, and provide technical support. To understand how people use Everbite, we may analyse app usage data to maintain, assess and improve the Service.
Research, Improvement, Marketing
Under your core health-data consent, we may use photos, food logs and related data to provide, maintain, secure and troubleshoot Everbite, and to monitor how the features you use perform in practice, including the meal scanner. These activities are part of operating the requested Service and supporting its reliability.
Where permitted by applicable law, we may create anonymised or aggregated information from Personal Data. Once that information meets applicable legal de-identification requirements, we may retain, use and disclose it indefinitely for any lawful business purpose, including research, statistics, marketing, developing products and services, and training, testing and improving AI models. We take reasonable measures to prevent identification, use this information only in de-identified form, do not attempt to re-identify it, and impose equivalent contractual requirements on recipients. We do not publish identifiable photos, food logs or health data.
We use separate optional controls before using identifiable or pseudonymized health data to develop new features, conduct broader research, undertake marketing, train AI models or for another purpose that is not necessary to operate, maintain or support the reliability of the requested Service. We do not use health data for targeted third-party advertising.
Communication & Direct Marketing
We use your contact details for service communications, including sending user-selected reminders, providing updates about the Service and its features, and responding to customer support requests. With your consent where required, we may send marketing communications about premium offers or new services, which you can opt out of at any time.
Legal
We also process your data to comply with legal obligations, such as detecting and preventing fraud, responding to valid law enforcement requests, and protecting our legal rights and the rights of our users.
Business transaction
In the event that Everbite engages in a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of that transaction. In such cases, your Personal Data will remain subject to the commitments made in this Privacy Policy. Any changes remain subject to section 12, including notice and consent where required by applicable law. We will always take reasonable steps to ensure that any successor entity continues to respect your privacy and protects your information in accordance with applicable laws.
Artificial Intelligence
We use Artificial Intelligence (AI) to analyse uploaded photos, text and other user inputs, including to identify and categorise foods or ingredients, extract text using optical character recognition, estimate quantities and nutrients, match results against nutritional databases, and generate nutrition insights. We may also use AI to test, maintain and improve these features as described in section 3. Our current AI service provider is OpenAI, and we may use or replace providers as the Service changes. We do not currently opt in to provider model training using identifiable or pseudonymised Personal Data. We may use and disclose anonymised information for AI training as described above. Training using identifiable or pseudonymised health data remains subject to the separate optional controls described above. AI providers may retain inputs and outputs for limited periods to provide, secure and monitor their services, including for abuse, safety or legal purposes, and may review content flagged for those purposes.
4 User-Provided Content
As part of our service, you may upload photos of food, which may be associated with metadata (such as time and location) and nutrition information. As a user of our Services, you are responsible for the content of the photos you choose to upload. We strongly advise you to ensure that your photos do not include identifiable faces, personal documents, or other objects which could be reasonably used to identify you. Generally, our policy is to treat food photos as Personal Data which is subject to the protections outlined in this Policy. Where permitted by applicable law, we may anonymise or aggregate photos and metadata. Once the information meets applicable legal de-identification requirements, we may retain, use and disclose it indefinitely for the lawful business purposes described in section 3, including AI training, without further notice or compensation to you. The safeguards in section 3 apply. We do not publish identifiable user photos.
5 How We Disclose Your Personal Data
We do not sell your Personal Data. We do not “share” it for cross-contextual behavioural advertising without your explicit consent. We disclose Personal Data only as described below, including to service providers needed to operate the Service.
Service Providers
We rely on third parties to provide business, professional or technical services and perform functions on our behalf. These include DigitalOcean for cloud hosting and OpenAI for meal analysis. We may also use providers for authentication, transactional email, subscription management, app updates, notifications, customer support, data analytics, security, auditing, consulting and legal services.
To Authorities
We may disclose Personal Data to legal or regulatory authorities where we reasonably believe disclosure is permitted or required by applicable law, including to comply with court orders or legally valid government requests. This includes sharing data with regulators or law enforcement to detect and prevent fraud, address security threats, or protect the legal rights and safety of Everbite and its users.
Anyone else authorized by you
We may disclose information to any other party specifically authorized by you, such as when you choose to integrate a third-party service or provide explicit consent during or after sign-up.
6 Legal Basis for Processing Your Personal Data
Under various global privacy laws, we must have a valid legal reason to process your Personal Data. We rely on the following legal bases to process Personal Data where applicable.
User Consent
When we rely on this basis, we seek your consent at the point of collection. We require an explicit affirmative action, such as selecting an agreement button or enabling a setting. Consent to process health data to provide, maintain, secure and troubleshoot Everbite's core functions, monitor their performance and support their reliability is required because the Service cannot operate without that data. Separate optional controls apply to developing new features, broader research, identifiable health-data marketing, AI training and other uses where separate consent is required.
You may withdraw consent to core health-data processing at any time. If you do, we will stop processing the affected Personal Data for purposes based on that consent, erase it from active systems within 30 days subject to the limited retention exception in section 8.1, and suspend your access to the Service until you provide consent again. We may instead anonymise it only where applicable law permits, as described in section 8.1. Withdrawal does not affect processing that was lawful before withdrawal. You may separately withdraw an optional consent without losing access to the Service's core functions.
Contractual Obligations
We process Personal Data where necessary to perform our agreement with you or provide services you request. This includes facilitating payments, managing subscription status and access, providing customer support, and notifying you about important changes to our terms or the Service.
Legitimate Business Purposes
In certain situations that do not involve Sensitive Data, we process Personal Data based on our legitimate business interests. This includes proportionate processing needed for administration, service security, fraud prevention and improvement of the Service. We do not rely on legitimate interests alone to process identifiable health data. Information that has been irreversibly anonymized so that no individual is reasonably identifiable is no longer Personal Data, and we may use it as described in this Policy.
Legal Compliance
We may process Personal Data where necessary to comply with applicable laws, regulations, court orders, investigations or other legal obligations, including obligations arising outside your country of residence.
7 International Data Transfers
Because we operate from Australia and use service providers that operate internationally, your Personal Data may be transferred to, stored or processed outside your country, including in Australia and the United States.
Where applicable law requires a recognised transfer mechanism or additional safeguards, we will put those measures in place before the relevant transfer occurs.
For overseas disclosures subject to the Australian Privacy Act, we take reasonable steps to ensure that recipients handle Personal Data consistently with the Australian Privacy Principles.
For users of the Service, we use reasonable technical and organisational safeguards appropriate to the sensitivity of the Personal Data we process, including encryption at rest and in transit.
By using our Services, you acknowledge that your information may be subject to the laws of these jurisdictions, including the right of local authorities to access data under specific circumstances (such as lawful regulatory investigations).
8 Data Security and Retention
8.1 Data Retention
We retain your Personal Data only for as long as necessary to provide the Service, maintain your account, fulfil an optional purpose you selected, or satisfy legal, regulatory or reporting requirements.
When you delete your account, withdraw consent to core health-data processing or validly exercise your right to erasure, we will erase the affected Personal Data in our active systems within 30 days, subject to this limited retention exception: we may retain only specific information, and only for as long as applicable law permits or requires its retention despite the request or withdrawal. We may use anonymisation instead of deletion only where applicable law permits it. Information already lawfully de-identified before the request or withdrawal, or anonymised under that permitted alternative, may be retained and used indefinitely for the purposes described in section 3, provided it meets applicable legal de-identification requirements and the safeguards in that section apply.
Information retained solely to meet a legal retention requirement will not be used for ordinary product operations, research or marketing and will be deleted when that requirement ends.
Residual copies may remain temporarily in protected backup and disaster-recovery systems. They are placed beyond ordinary use and are erased or overwritten through our normal backup cycle within three months.
8.2 Security
We take reasonable steps to secure your Personal Data from unauthorized access, unauthorized alteration, disclosure or destruction. This includes, but is not limited to, encryption and physical security measures, alongside regular reviews of our data collection, storage and processing practices. Access to Personal Data is limited to personnel and service providers who need it for authorised purposes and are subject to appropriate confidentiality and security obligations.
Security is a shared responsibility. As a user of our Services, you are expected to take reasonable steps to protect your own account. For example, you should keep the App and your device updated, protect your login credentials, restrict access to your device, and promptly notify us of suspected unauthorised account activity.
While we strive to take all reasonable measures to safeguard your information, no method of electronic transmission or storage is completely secure. We cannot guarantee that our security measures will withstand all potential threats or that data transmissions over the internet will remain totally secure.
9 Your Data Rights
We are committed to ensuring you have control over your personal information. Depending on your jurisdiction, you may be entitled to exercise some or all of the following rights regarding your Personal Data. We will respond to verified requests within the timeframes required by applicable law.
Please note that your specific rights depend on the laws applicable to you. We reserve the right to refuse, limit or delay a request where permitted by applicable law, including where we are required to retain certain information or comply with legal requirements, regulatory investigations or other lawful obligations.
Your rights may include:
- Know & Access: The right to request a copy of the Personal Data we hold about you and confirmation of how it is being processed.
- Correction: The right to rectify incomplete or inaccurate Personal Data relating to you.
- Erasure: The right to request that we erase your Personal Data, subject to the limited retention exception in section 8.1. In some cases, this may be fulfilled via permanent de-identification as set forth in section 8.1.
- Restriction & Objection: The right to limit how we process your data or object to specific uses, including an absolute right to opt-out of direct marketing.
- Portability: Where applicable, the right to receive eligible Personal Data in a structured, commonly used and machine-readable format or, where technically feasible, request its transfer to another service provider. To make a portability request, email [email protected].
- Withdraw Consent: The right to withdraw your consent at any time for data processing that relies solely on your permission. This will not affect the lawfulness of processing that occurred before the withdrawal.
- Non-Discrimination: We will not unlawfully discriminate against you for exercising a privacy right. Some features or the Service may be unavailable where they require Personal Data that you ask us not to process.
- Right to Lodge a Complaint: The right to contact a supervisory authority, such as the Office of the Australian Information Commissioner (OAIC) or your local data protection regulator, if you believe your privacy has been breached.
Where applicable law gives you a right to appeal our decision on a privacy request, you may submit an appeal by replying to our decision or emailing [email protected].
10 Privacy and Age Restrictions
We do not knowingly collect Personal Data from anyone under the age of 18. If we learn that we have inadvertently collected Personal Data from someone under 18, we will promptly disable the account, stop using the data except for deletion, security or legal compliance, and delete it from active systems within 30 days or sooner where required by law. Residual backup copies will be handled as described in section 8.1.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] so that we can take appropriate action.
11 Third-Party Links
Our Service may contain links to third-party websites or services for your convenience. These third-party sites are not governed by this Privacy Policy, and we are not responsible for their individual privacy practices or content. We do not control or endorse these external sites and encourage you to review their specific privacy policies before providing them with any information. This Privacy Policy applies solely to information processed by us through our Service.
12 Changes to This Privacy Policy
We may update this Privacy Policy from time to time as we provide and improve our Services. When changes are made, we will notify you by posting the revised version on our website or through other appropriate channels, such as email or in-app notifications. When changes materially affect how we collect, use or disclose Personal Data, we will provide notice before they take effect and obtain consent where required by applicable law. If you do not agree to the changes, you may request a copy of your data by emailing [email protected] and close your account.
13 Contact Us
Contact our Privacy Officer at [email protected] with questions, privacy-rights requests, direct-marketing opt-outs or complaints.
We will assess your complaint, seek further information where needed, and explain our response and any proposed resolution. We will respond within any period required by applicable law.
If we cannot resolve your complaint, you may lodge it with the Office of the Australian Information Commissioner (OAIC) or another data protection authority available to you under applicable law.