FGBG Privacy Policy
Version 1.0 (draft). Effective date: (to be confirmed)
The short version
- Your diet profile, allergies and food log stay on your phone. We don't keep a copy.
- When you speak or type your diet to set up your profile, the text is sent to our server and to an AI provider to turn it into settings. It is processed and then deleted, not stored. It may reveal health information, so we ask for your consent first.
- To show nearby places we use your approximate location while the app is open. Never in the background.
- When you order, you deal with the shop. The app fills in the shop's own order form on your phone with the details you choose (for example name, phone, email). The shop is the seller and receives those details under its own privacy policy.
- Your card details never reach our servers. You pay on the shop's payment page. If you choose to save a card or shop login, it is encrypted on your phone and unlocked only with your fingerprint, face or screen lock.
- "Learn this shop" sends the layout of a shop's web page to our server, with personal details removed on your phone first, so our system can learn how to order there.
- No ads. No selling or sharing of your data for advertising. Health Connect data is never sent to us.
- Contact: support@eumenes.ai.
1. Who we are
EUMENES.AI PTE. LTD. (Singapore, UEN 202648582K), (to be confirmed) ("we", "us") provides the FGBG app and its servers (the "Service"). - For the data in Section 3 that reaches our servers, we are the controller (GDPR/UK GDPR), the organisation (Singapore PDPA), the data fiduciary (India DPDP Act) and the equivalent role under other laws. - For data that stays on your device, we do not process it at all. - Shops are independent controllers of the order and account data you send them (Section 6).
Data Protection Officer: (to be confirmed), support@eumenes.ai.
2. Where each kind of data lives
| Data | Where it is | What reaches us |
|---|---|---|
| Diet profile (diets, allergies, targets, notes) | Your phone only | Nothing, except the one-time text in 3.2 |
| Food log, favourites, order history | Your phone only (and Health Connect if you turn it on) | Nothing |
| Order receipts (the shop's confirmation page after you pay) | Screenshot: your phone only (app-private storage, excluded from backups) | Text summary only, with your order history in your account: shop, order/invoice number, queue number, total, time, items, dine-in or takeaway. Never the image |
| Dine-in / takeaway choice | Asked on every order, never stored as a default | Stored with that order only |
| Saved card (optional, if offered in your version) | Your phone only, encrypted with a key in Android Keystore, unlocked by biometric or screen lock | Never |
| Saved shop logins and session tokens | Your phone only, encrypted the same way | Never |
| Order details (items, your name, phone, email, address) | Sent from your phone to the shop when you confirm | Not the personal details. Only the order outcome feedback in 3.5 |
| Location | Used on your phone; sent to us as coordinates to find places | 3.3 |
3. Personal data we process
3.1 Technical and device data (all users). A random install ID and a device token we issue, app version, device model, OS, language, IP address and request times. Used to run, secure and rate-limit the Service. Retention: server logs up to 30 days; the device record until you delete your data or after 12 months of inactivity.
3.2 Diet-profile text (only if you use voice or free text). Your words are turned into text on your phone. The text is sent to us and to our AI provider (Section 7) to produce structured profile settings, which are returned to your phone. The text may reveal health information (for example allergies, diabetes or blood pressure), so we process it only with your explicit consent, given on the screen before you speak. It is not stored: it is held in memory for the request and deleted, and it is never written to logs. The AI provider processes it under a contract that forbids training on it.
3.3 Location. Your approximate location (or precise, if you allow it) while the app is in use, sent with requests for nearby places and when you scan a QR code or start "learn this shop". We don't track you in the background or build location history. Coordinates attached to a "learn this shop" job are stored with that job (3.4).
3.4 "Learn this shop" jobs (only if you start one). The shop's web address or QR content, and while the job runs, the structure and visible text of the shop's pages, plus a log of the page's network requests. Before anything is sent, your phone removes names, emails, phone numbers, addresses, card-like numbers, passwords, cookies and login tokens. Our system is told never to open account or payment pages. The result (the shop's menu and an ordering "recipe") is stored and shared with all users: it is information about the shop, not about you. Raw job data retention: 30 days.
3.5 Feedback and order outcomes. If you send feedback, or the app reports whether an order or a swap worked, we receive the dish, the shop, the outcome and any text you write, linked to your device ID. This improves dish information for everyone. Retention: 24 months, then aggregated.
3.6 Menu photos or text you upload. Used to build the shop's menu. We may keep them as source material for that menu. Don't upload photos showing people.
3.7 Google sign-in (optional). Your Google account ID and email, used only to restore your Pro subscription and link devices.
3.8 Purchases of FGBG Pro. Google Play handles payment. We receive the product, the purchase token and the status, never your payment details.
3.9 Support emails. Your email address and what you send. Retention: up to 24 months.
3.10 Crash reports (only if you opt in). Technical crash data with personal data filtered out.
3.11 What we don't do. No advertising ID. No ad or tracking SDKs. No sale of personal data. No "sharing" for cross-context behavioural advertising. No profiling with legal effects. No use of Health Connect data for anything except writing your meals to it, and we never read it.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR/UK GDPR; similar bases elsewhere) |
|---|---|---|
| Show nearby places and rank dishes | 3.1, 3.3 | Contract (Art. 6(1)(b)) |
| Turn your spoken or typed diet into settings | 3.2 | Contract plus explicit consent for health data (Art. 9(2)(a)); PDPA consent; DPDP consent |
| Learn new shops; build shared menus and recipes | 3.4, 3.6 | Legitimate interest in providing and improving the Service (Art. 6(1)(f)), limited by redaction on the phone |
| Improve dish information; detect broken integrations | 3.5 | Legitimate interest |
| Security, abuse prevention, rate limits | 3.1 | Legitimate interest; legal obligation |
| Pro subscription, account restore | 3.7, 3.8 | Contract |
| Crash diagnostics | 3.10 | Consent |
| Support, legal claims | 3.9, as needed | Contract, legal obligation, legitimate interest |
You can withdraw consent at any time (Settings → Privacy). Withdrawal doesn't affect processing already done.
5. Payment cards
- Our servers never receive, store or see your card number, expiry or security code.
- Default: you enter or autofill your card (for example through Google Autofill or Google Pay saved cards) directly on the shop's payment page, which the app shows to you.
- If you choose "save on this phone" (where offered): the card is encrypted with a key held in Android Keystore that only works after your biometric or screen-lock check. It stays in the app's private storage, is excluded from backups, and is inserted only into the payment page of the shop you are ordering from. The security code (CVC) is never saved. You can delete it at any time.
- The shop and its payment provider process your payment under their own terms and privacy policies.
6. Shops (independent third parties)
- When you confirm an order, or ask us to create a shop account for you, your phone sends the details you approve to that shop: name, phone, email, delivery or pickup details, order, and payment through the shop's page.
- The shop is a separate controller. It decides how it uses your data under its own privacy policy, which we link to before you confirm.
- We are not responsible for shops' privacy practices.
- To delete an account at a shop, use the shop's own process; the app links to it. "Forget this shop account" deletes the login stored on your phone.
7. Our service providers (processors)
| Provider | Role | Data | Location |
|---|---|---|---|
| (to be confirmed) | Servers | 3.1, 3.3–3.6 | Singapore (to be confirmed) |
| (to be confirmed) | AI processing of profile text, menus, shop pages | 3.2 (transient), 3.4, 3.6 | United States (to be confirmed) |
| (to be confirmed) | Encrypted database backups | 3.1, 3.3–3.6 | (to be confirmed) |
| Google LLC (Play, Sign-in) | Distribution, billing, optional sign-in | 3.7, 3.8 | Global / US |
| (to be confirmed) (only if you opt in) | Crash reports | 3.10 | (to be confirmed) |
We may also disclose data (a) if the law or a valid order requires it, as narrowly as possible; (b) to protect rights, safety or security; (c) to a successor in a merger, acquisition or reorganisation, who will be bound by this Policy.
8. International transfers
We are in Singapore; some providers are in the United States. We use the safeguards your law requires: - PDPA s.26 contractual protections; - EU Standard Contractual Clauses, with the UK Addendum and Swiss amendments; - where required (for example India, Korea, Japan), your consent, given on the voice-profile consent screen, which names the destination country.
9. Security
- TLS for all traffic.
- On-device encryption with Android Keystore for cards and logins.
- Recipes are signed, and the app refuses unsigned ones.
- Least-privilege access, minimal logs, no logging of request bodies. No system is perfectly secure. We will notify you and the regulators of a breach as the law requires.
10. Your rights
Depending on where you live: access, correction, deletion, restriction, objection, portability, withdrawing consent, nominating someone (India), and complaining to a regulator. - On your phone: Settings → Privacy → Export (CSV) and Delete my data. The second also deletes everything we hold under your device ID. - Web: (to be confirmed), or email support@eumenes.ai. We reply within one month (GDPR/UK, PDPA "as soon as reasonably possible", at most 30 days), 45 days (US states), or sooner where your law requires. - Regulators: Singapore PDPC, your EU/EEA authority, the UK ICO, and others. - US state privacy laws (where applicable): we don't sell or share personal information, we don't use sensitive personal information beyond permitted purposes, and we don't discriminate against you for exercising your rights.
11. Children
The Service is for people aged 18+. We don't knowingly collect children's data. Contact us and we will delete it.
12. AI transparency
Dish nutrition estimates, swaps and profile summaries are produced with AI and labelled as estimates. They can be wrong (see the Terms). We don't use AI to make decisions about you with legal or similarly significant effects.
13. Changes
We will post updates here and tell you in the app before material changes take effect. We will ask again for consent if a change expands how we use health-related text.
14. Contact
EUMENES.AI PTE. LTD., (to be confirmed). Privacy / DPO: support@eumenes.ai. (to be confirmed).
DRAFTING NOTES (remove before publication):
- The "not stored" claims in 3.2 must be true in code: no body logging on /profile/parse, and an LLM vendor with zero-retention / no-training terms signed. Anthropic API data is not used for training by default; get ZDR in writing, or state the vendor's actual retention (for example "up to 30 days for abuse monitoring").
- The redaction in 3.4 must be implemented on the device before the first build job ships. Server agent prompt: never navigate to login, account or payment pages.
- If v1 ships without the card vault (recommended), simplify Section 5 to the default bullet and keep the Data Safety "User payment info = No".
- The data-retention purges (30 d logs and jobs, 24 m feedback, 12 m inactive devices) need a purge job, as for MyCarme.
- The privacy policy URL must be the same on the Play listing and in the Health Connect rationale screen.
- MyCarme used 331 New Bridge Road #04-09 as the address. The legal memo prefers a registered or virtual office for public listings.