1. About This Policy and Our Company

Lively Graphics, LLC ("Company," "we," "us," or "our") operates the Calimento iOS mobile application and the calimento.io website, including all related information, content, features, tools, and services (collectively, the "Services"). Calimento is a recipe management and meal planning application. All paid subscriptions are billed exclusively through Apple In-App Purchase; we operate no e-commerce store, sell no physical products, and never collect or store your payment card information. Our marketing website and these policy pages are hosted on Cloudflare, Inc., which serves solely as our website host and content delivery network.

This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use the Services or otherwise communicate with us. If there is a conflict between our Terms of Use and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

This Privacy Policy is designed to comply with applicable law, including but not limited to: Apple's App Store Review Guidelines, the Washington My Health MY Data Act (RCW 70.372), the Washington Consumer Protection Act (RCW 19.86), the California Consumer Privacy Act (CCPA/CPRA), and the federal Children's Online Privacy Protection Act (COPPA).

2. Personal Information We Collect

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. We may collect or process the following categories of personal information depending on how you interact with the Services:

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third Parties

We may also receive personal information from the following sources:

• Cloudflare (website host): Cloudflare, Inc. hosts and delivers our marketing website and policy pages at calimento.io and may log standard website visit data (such as IP address) as described in Section 9 below. Cloudflare does not process App subscriptions or payments and receives no data from the iOS App.
• Anthropic, PBC: When you use our AI Vision feature, images you submit are processed by Anthropic. We receive back the extracted text content. See Section 5 for full AI processing disclosures.
• Social login providers: If you choose to log in using a third-party social account (e.g., Apple ID, Google), we receive your name and email address from that provider, subject to your settings with them.

3. How We Use Your Personal Information

Depending on how you interact with us or which Services you use, we may use your personal information for the following purposes:

3.1 Providing and Improving the Services

We use your personal information to provide you with the Services, including to: perform our contract with you; verify your subscription status as reported by Apple In-App Purchase; remember your preferences; send account-related notifications; create and manage your account; enable recipe creation, meal planning, and grocery list features; and personalize your experience, such as recommending recipes related to your activity.

3.2 Email Communications

We send lifecycle, promotional, and product-update email about Calimento — including welcome and onboarding messages, re-engagement reminders, and win-back messages if your access lapses. These emails are delivered through our third-party email provider, Customer.io, as described in Section 5A. You may opt out of marketing email at any time as described in Section 12.4.

This is first-party marketing only. The App contains no advertising: we do not display ads in the App, do not use your data for third-party or cross-app targeted advertising, do not share your data with advertising networks or data brokers, and do not track you across other companies' apps or websites.

3.3 Security and Fraud Prevention

We use your personal information to authenticate your account, provide a secure experience, detect and investigate possible fraudulent or malicious activity, protect public safety, and secure our services. You are responsible for keeping your account credentials confidential.

3.4 Communicating With You

We use your personal information to provide customer support, respond to inquiries, and maintain our business relationship with you.

3.5 Legal Compliance

We use your personal information to comply with applicable law, respond to valid legal process (including requests from law enforcement or government agencies), participate in civil discovery or litigation, and enforce or investigate potential violations of our terms or policies.

3.6 User-Generated Content Processing

When you submit UGC to the App — including recipe text, ingredient lists, cooking instructions, photographs, and images of recipe cards — we process that content to provide the core functionality of the App (organizing your recipe collection, generating meal plans, and populating your grocery lists). Images you upload for the AI Vision scanner are transmitted to Anthropic for text extraction as described in Section 5. We do not use your UGC to train our own AI models without your separate, affirmative consent.

The App also allows you to generate a formatted PDF of your grocery list that includes your first name and a "Powered by Calimento.io" brand banner. The generation of this PDF is processed within the App and the resulting file is stored temporarily on your device. See Section 3.7 below for important disclosures about how sharing this PDF affects your personal information.

3.7 Share Grocery List PDF Feature

Calimento allows you to share your grocery list as a branded PDF document via the iOS Share Sheet. This feature enables you to send the PDF through any channel available on your iOS device, including but not limited to: AirDrop, Messages, Mail, Save to Files, and AirPrint. The PDF document includes your first name in the document title and the "Powered by Calimento.io" brand banner.

User-Initiated Sharing — Your Control and Responsibility: When you share a grocery list PDF via the iOS Share Sheet, you are making a voluntary, user-initiated decision to transfer that document — and the personal information it contains — to a channel, device, or recipient outside of Calimento's infrastructure. Once the PDF leaves the App via the Share Sheet, it is entirely outside the control of Lively Graphics, LLC. We cannot retrieve, delete, or control the subsequent handling of that document by its recipient(s), the recipient's device, or any intermediate service (such as an email provider or messaging platform).

No Transmission by Lively Graphics, LLC: The PDF sharing feature operates entirely through Apple's native iOS Share Sheet. Lively Graphics, LLC does not transmit, receive, copy, or store the shared PDF. We do not have visibility into which sharing channel you select, who you share the PDF with, or how the recipient handles the document. Your decision to share is between you and the destination channel.

Health Data Caution: If your grocery list includes items that could identify or be linked to a health condition — such as specialty dietary products, medical foods, or allergen-restricted items — that information will be present in the PDF you share. Please review the Washington My Health MY Data Act disclosures in Section 4 of this Policy and exercise caution when sharing PDFs containing health-related grocery items, as shared documents fall outside our ability to protect or delete.

Brand Disclaimer: The "Powered by Calimento.io" banner appearing on shared grocery list PDFs is a trademark attribution notice. Its presence on a shared document does not constitute any warranty, representation, or endorsement by Lively Graphics, LLC of the document's contents or of any use made of the document after sharing. Lively Graphics, LLC is not responsible for any use of shared PDFs by recipients.

4. Washington My Health MY Data Act Disclosures

4.1 What Constitutes Consumer Health Data in Calimento

Under the MHMDA, "consumer health data" is defined broadly to include personal information that is linked or reasonably linkable to a consumer and that identifies a consumer's past, present, or future physical or mental health status. In the context of Calimento, this may include:

• Dietary restrictions, food allergies, and medical dietary requirements you enter into the App (e.g., gluten-free, diabetic, low-sodium, allergen-free);
• Meal plans or recipe collections that reflect or could be inferred to reflect a health condition;
• Any other information in the App that you associate with a health or medical condition.

4.2 How We Collect and Use Consumer Health Data

We collect consumer health data that you voluntarily provide to us when you use the meal planning and dietary preference features of the App. We use this data solely to provide, personalize, and improve the App's functionality for you. We do not sell consumer health data to third parties, and we do not use consumer health data for advertising targeting purposes.

4.3 Sharing of Consumer Health Data

We share consumer health data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Anthropic (AI Vision): Images you submit through the AI Vision scanner that contain health-related recipe information are processed by Anthropic solely for text extraction. Anthropic is prohibited from using this data for its own training or other independent purposes under our agreement.
• Legal compliance: We may disclose consumer health data if required by law, court order, or valid legal process.

We do not sell, share for targeted advertising purposes, or otherwise disclose consumer health data to any other third party without your express, affirmative consent.

4.4 Your Rights Under the MHMDA

If you are a Washington State resident, you have the following rights with respect to your consumer health data:

• Right to Confirm and Access: You may request confirmation of whether we collect, share, or sell your consumer health data, and to access a list of all third parties with whom we have shared or sold your consumer health data.
• Right to Withdraw Consent: Where we rely on your consent to collect consumer health data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to Delete: You may request deletion of your consumer health data. We will honor this request unless we are required by law to retain the data or have another overriding legal basis.
• Right to Appeal: If we decline to take action on your request, you may appeal our decision by contacting us as described in Section 14.

To exercise any MHMDA rights, please contact us at admin@livelygraphics.com with the subject line "MHMDA Rights Request." We will respond within 45 days as required by law, with the possibility of a 45-day extension for complex requests.

Non-Discrimination: We will not discriminate against you for exercising your MHMDA rights. We will not deny you Services, charge different prices, or provide a different quality of service because you exercised your rights under this law.

5. AI Features and Third-Party Data Processing

5.1 AI Vision Recipe Scanner

Calimento includes an artificial intelligence feature called "AI Vision", which allows you to photograph or upload images of physical recipe cards, handwritten notes, cookbook pages, or other documents, as well as upload recipe PDFs. The AI Vision scanner uses machine learning optical character recognition (OCR) technology to extract and structure recipe content — including ingredients, measurements, preparation steps, and nutrition information (such as calories and macronutrients) where present — from your submitted images and documents.

5.2 Recipe Scanning — Data Transmission to Anthropic, PBC

Anthropic, PBC ("Anthropic") acts as a third-party service provider and sub-processor for our AI recipe scanning feature. We proxy your scan request to Anthropic's Claude API; Anthropic processes it on our behalf and returns the result to us. When you use the AI Vision recipe scanning feature, the following data processing occurs:

• Data sent: The image file (photograph of a recipe card, cookbook page, or handwritten note) or PDF document you submit is transmitted over an encrypted internet connection to servers operated by Anthropic, PBC ("Anthropic"), an artificial intelligence company headquartered in San Francisco, California. No other account data or personal information is included in this transmission.
• Purpose: Anthropic's Claude AI models analyze the submitted image or PDF solely to identify and extract structured recipe content — including ingredients, measurements, preparation steps, recipe titles, and nutrition information (such as calories and macronutrients) where present — and return that structured data to Calimento.
• Not used for advertising: Your submitted images, PDFs, and the text extracted from them are used solely to provide the recipe scanning feature. This data is not used by Lively Graphics, LLC or Anthropic for advertising, marketing profiling, or any purpose other than performing the extraction service.
• No human review: Your submitted content is processed by automated AI models. Anthropic does not assign human reviewers to read or evaluate individual user submissions in the ordinary course of providing this service, subject to Anthropic's own policies on safety and abuse monitoring.
• Not used for AI training: Under Anthropic's commercial API terms, the inputs we send (your images and PDFs) and the outputs returned are not used to train Anthropic's models by default.
• Transient processing — not retained at Anthropic: Processing by Anthropic is transient. The image or PDF is transmitted only for the duration of the API request to extract the recipe data; we do not retain your submitted image or PDF at Anthropic after processing completes. The durable copy of any recipe photo you choose to save lives only in our own cloud infrastructure, hosted on Google Cloud Storage, and is deleted in accordance with Section 13. Lively Graphics, LLC does not control Anthropic's internal data handling or security practices beyond what is set out in our service agreement with Anthropic.

By using the AI Vision feature, you consent to this data transmission and processing. You should not submit images or documents containing sensitive personal information — such as medical records, government identification, financial account data, or other confidential information unrelated to recipes.

To review Anthropic's data and privacy practices: https://www.anthropic.com/legal/privacy

5.3 Grocery Categorization — Data Transmission to Anthropic, PBC

Calimento includes an automated grocery categorization feature that organizes the ingredients from your recipes into grocery-aisle categories (for example: Produce, Dairy, Meat, Pantry) when you generate a shopping list. This feature also uses Anthropic's Claude AI models.

When you use the grocery list or shopping list feature, the following data processing occurs:

• Data sent: Individual ingredient names and quantities derived from your saved recipes (for example: "2 cups flour," "1 lb chicken breast") are transmitted to Anthropic's servers for categorization. Your name, account details, and any other personal information are not included in this transmission — only the ingredient text itself.
• Purpose: Anthropic's Claude AI models analyze the ingredient names solely to assign each item to an appropriate grocery-store category, enabling Calimento to present your shopping list in an organized, aisle-by-aisle format.
• Not used for advertising: Your ingredient data is used solely to provide the grocery categorization feature. It is not used by Lively Graphics, LLC or Anthropic for advertising, dietary profiling, or any commercial purpose beyond performing the categorization service.
• No human review: Ingredient categorization is performed entirely by automated AI models. Anthropic does not assign human reviewers to individual categorization requests in the ordinary course of service.
• Health data consideration: Ingredient names may in some cases be associated with dietary restrictions or health conditions (e.g., gluten-free products, diabetic-friendly items). Please review the Washington My Health MY Data Act disclosures in Section 4 of this Policy for information about your rights regarding health-linked data.

5.4 Other AI-Powered Features

The App may include additional AI-powered features such as personalized recipe recommendations, ingredient substitution suggestions, or nutritional estimates. These features may process your recipe collection data and usage patterns locally within the App or through additional third-party AI services. We will update this Privacy Policy and provide in-App notice before introducing new AI data processing activities that involve transmission of personal data to third parties.

5.5 No Sale of AI-Processed Data

We do not sell the content of images, PDFs, or ingredient data you submit through our AI features, the text extracted or derived from those submissions, or any other data processed by Anthropic on our behalf, to any third party for advertising, data brokerage, or any other commercial purpose.

5A. Email and Lifecycle Marketing — Customer.io

Calimento uses Peaberry Software, Inc. d/b/a Customer.io ("Customer.io") as a third-party service provider and sub-processor to send lifecycle and marketing email — for example, a welcome message at signup, reminders during your no-cost access period, re-engagement email if you have not opened the App recently, and win-back email if your access has lapsed. Customer.io processes this data on our behalf, under contract, solely to deliver our own first-party email.

Data we share with Customer.io. To operate these email campaigns, we share the following from your account record and derived engagement data:

• Your email address and, if you provided one, your first name;
• Account creation date, last account-update date, and the date you last opened the App;
• Your subscription status (for example: trial, subscribed, complimentary, lapsed, or trial-expired), whether your account is premium or complimentary, your trial start and computed trial-end dates, and the date premium access lapsed or was transferred to another account, if applicable;
• A stable internal identifier (your Firebase authentication ID) used to keep your profile consistent;
• The number of recipes you have saved; and
• Limited metadata for a single recipe — the title, image URL, and last-viewed date of your least-recently-viewed recipe — so a re-engagement email can remind you of a recipe you have not made in a while.

Data we do NOT share with Customer.io. We do not send recipe contents or ingredients, meal plans, grocery lists, nutrition data, payment or card data, government identifiers, precise location, or any health or medical data. No recipe data beyond the single recipe's title, image, and last-viewed date described above is shared.

When it is shared. A profile is created or updated in Customer.io when you sign in, a one-time "account created" event is recorded at signup, and a nightly process refreshes the fields listed above.

Purpose and limits. This data is used solely to deliver our own first-party lifecycle and marketing email. We do not sell this data, do not share it with data brokers, and do not use it for third-party or cross-app targeted advertising. You can opt out of marketing email at any time as described in Section 12.4; the unsubscribe process applies to Customer.io-delivered messages.

Win-back email and data retention. If your access lapses, we may send win-back email reminding you that your saved recipes are being retained for a limited period before deletion. Those retention periods — 90 days for users who never subscribed and one year (365 days) for former subscribers — are the same windows described in Section 13.2, and we honor them as stated.

5B. Product Analytics — HeyCatch

Calimento uses HeyCatch, Inc. ("HeyCatch"), a Delaware corporation, as a third-party service provider and sub-processor for product analytics — measuring how the App and our website are used so we can improve them, and measuring which of our own marketing channels bring new users. HeyCatch processes this data on our behalf, under a data processing agreement, solely to provide analytics reporting to us.

Data we share with HeyCatch from the App. When you use the App, the following is transmitted to HeyCatch:

• A stable internal identifier (your Firebase authentication ID) used to keep your analytics profile consistent;
• Your email address and, if you provided one, your first name;
• Your subscription status (for example: free trial, subscribed, complimentary, or expired) and account-creation date;
• The screens you view within the App (by generic screen name only), the interface elements you tap, and when you open or close the App;
• Two milestone events: completion of account signup, and the start of a paid subscription; and
• Technical information about your device: model, operating system version, App version, language, timezone, and IP address.

Data we do NOT share with HeyCatch. We do not send recipe contents, titles, or ingredients; meal plans; grocery-list contents; nutrition data; dietary preferences or restrictions; photographs; the contents of anything you type into the App; payment or card data; government identifiers; precise location; or any health or medical data. Screen names and interface labels are generic and contain no user content.

On our website. The HeyCatch analytics script on calimento.io measures page views, clicks, the referring site or campaign link that brought you to us, and standard browser and device information (including IP address), and sets the analytics identifiers described in Section 7.

Purpose and limits. This data is used solely for our own first-party product analytics and first-party marketing measurement. We do not sell this data, do not share it with advertising networks or data brokers, and do not use it to track you across other companies' apps or websites. HeyCatch states that it does not sell personal data and does not use customer data to train AI models. To review HeyCatch's privacy practices: https://heycatch.ai/privacy.

6. iOS Device Permissions and Apple Privacy Features

6.1 Device Permissions We Request

Calimento requests access to the following device capabilities on your iOS device. We request each permission only when the relevant feature is first used, and we explain the reason at the time of each prompt. You may grant or deny each permission, and you can change permissions at any time in your device Settings.

6.2 No Tracking — No App Tracking Transparency Prompt

Calimento does not track you. The App contains no advertising and does not access the Apple Identifier for Advertisers (IDFA). The App uses a product-analytics service (HeyCatch, described in Section 5B) that acts solely as our service provider: it measures how you use Calimento itself, for our own product improvement and marketing measurement, and does not link your data with data from other companies' apps or websites for targeted advertising, and does not share your data with data brokers. Because the App does not track you across apps or websites owned by other companies, it does not present Apple's App Tracking Transparency (ATT) permission prompt — no tracking permission is needed because no tracking, as Apple defines it, occurs.

If we ever introduce a feature that involves tracking as defined by Apple's ATT framework, we will update this Privacy Policy in advance and the App will present the required ATT permission prompt before any tracking begins.

6.3 "Sign in with Apple"

If you choose to sign in to Calimento using "Sign in with Apple," Apple will authenticate your identity and share your name and email address (or a private relay email address) with us. We will use this information solely to create and manage your Calimento account. Please review Apple's Privacy Policy at https://www.apple.com/legal/privacy for details on how Apple handles your data during this process.

7. Cookies and Tracking Technologies

Cookies are used only on our marketing website at calimento.io (hosted on Cloudflare). The iOS App itself does not use cookies, pixel tags, web beacons, or any similar tracking technologies (see Section 5B for the App's product-analytics disclosure). The disclosures in this Section 7 apply solely to visits to our website.

7.1 Types of Cookies We Use

• Strictly necessary cookies: Required for the website to function (e.g., maintaining your browsing session). These cannot be disabled.
• Preference cookies: Remember your website settings and preferences (e.g., language, display settings).
• Analytics cookies and identifiers: Our product-analytics provider, HeyCatch (Section 5B), sets cookies or browser-storage identifiers on calimento.io to help us understand how visitors use our website (e.g., page views, session duration, navigation paths, and which marketing link brought you to the site). We use this information to improve the website and measure our own marketing.

7.2 "Do Not Track" Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is currently no industry-wide standard for how to respond to DNT signals, our website does not currently alter its data collection practices in response to DNT signals. We will revisit this position if and when a universally accepted standard is adopted.

8. How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• Service providers and sub-processors: With vendors who perform services on our behalf, including Google Cloud Storage (durable storage of your account data and saved recipe images), Anthropic, PBC (transient AI processing of recipe scans and grocery categorization, as described in Section 5), Peaberry Software, Inc. d/b/a Customer.io (lifecycle and marketing email delivery, as described in Section 5A), and HeyCatch, Inc. (product analytics for the App and website, as described in Section 5B). We do not engage payment processors — all payments are handled by Apple — and we have no fulfillment or shipping providers because we sell no physical products.
• Anthropic (AI processing): Images you submit through the AI Vision scanner are transmitted to Anthropic solely to provide the text extraction service, as described in Section 5.
• Customer.io (email delivery): Contact information, engagement and usage data, subscription status, and limited recipe metadata (the title and image of a single recipe) are shared with Peaberry Software, Inc. d/b/a Customer.io solely to deliver our first-party lifecycle and marketing email, as described in Section 5A. This is not third-party advertising or data brokerage.
• HeyCatch (product analytics): Account identifiers, contact information, subscription status, and App/website usage events are shared with HeyCatch, Inc. solely to provide us with first-party product analytics and marketing measurement, as described in Section 5B. This is not third-party advertising or data brokerage.
• At your direction: When you direct, request, or consent to our disclosure of certain information to third parties, such as through your use of the iOS Share Sheet or login integrations.
• Corporate affiliates: Within our corporate group or with affiliated entities, in a manner consistent with this Privacy Policy.
• Business transactions: In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to commitments of confidentiality.
• Legal compliance: To comply with applicable legal obligations, respond to subpoenas, search warrants, and similar legal requests, enforce our Terms of Use, or protect the safety of our users or others.

9. Website Hosting by Cloudflare

Our marketing website and these policy pages at calimento.io are hosted and delivered through Cloudflare, Inc. ("Cloudflare"), which provides content delivery and hosting infrastructure. Cloudflare's role is limited to website hosting and delivery: Cloudflare does not process Calimento App subscriptions, does not handle any App payments (all payments are processed by Apple In-App Purchase), and does not receive data from the iOS App itself.

When you visit our website, Cloudflare — as the hosting and content delivery provider — may log standard website visit information such as your IP address, browser type, and pages viewed, for security and delivery purposes. For that website hosting data, Cloudflare acts as a service provider on our behalf, subject to its own privacy practices.

To learn more about Cloudflare's data practices, please visit the Cloudflare Privacy Policy at https://www.cloudflare.com/privacypolicy/.

10. Third-Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites.

Information you provide on public or semi-public venues, including information you share on third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

11. Children's Data

The Services are not intended to be used by children under the age of 13, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). Users between the ages of 13 and 17 should use the Services only with the involvement and consent of a parent or legal guardian.

If you are the parent or guardian of a child who has provided us with their personal information without your consent, please contact us at admin@livelygraphics.com, and we will take prompt steps to delete that information from our systems.

As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

12. Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. These rights are not absolute, may apply only in certain circumstances, and in certain cases we may decline your request as permitted by applicable law.

12.1 General Privacy Rights (All Users)

• Right to Access / Know: You may request access to personal information that we hold about you.
• Right to Delete: You may request deletion of personal information we maintain about you.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right of Portability: You may request a copy of your personal information in a portable format, and in certain circumstances, request that we transfer it to a third party.
• Right to Opt Out of Sale or Sharing for Targeted Advertising: You may have the right to opt out of the "sale" or "sharing" of your personal information for targeted advertising purposes. Note: we do not sell your personal information and do not share it for targeted advertising, so there is no sale or sharing to opt out of.

12.2 California Residents — CCPA/CPRA Rights

If you are a California resident, you have the rights described above plus the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Limit Use of Sensitive Personal Information: You may direct us to limit our use of sensitive personal information (including account credentials, precise geolocation, and health-related data) to purposes necessary to perform the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
• Shine the Light: California Civil Code Section 1798.83 allows you to request information regarding disclosure of your personal information to third parties for their direct marketing purposes during the preceding calendar year.

To submit a CCPA/CPRA request, please contact us at admin@livelygraphics.com. We will verify your identity before processing your request.

12.3 Washington State Residents — MHMDA Rights

Washington State residents have additional rights with respect to consumer health data as described in Section 4 of this Privacy Policy.

12.4 Managing Communication Preferences

We may send you lifecycle and promotional email, delivered through Customer.io (see Section 5A). You may opt out at any time by using the unsubscribe link included in every marketing email, or by contacting us at admin@livelygraphics.com. We honor unsubscribe requests promptly and within the time required by applicable law. If you opt out of marketing email, we may still send you non-promotional messages necessary to the service, such as those about your account, subscription, or security.

To manage push notification preferences, navigate to Settings > Notifications > Calimento on your iOS device.

13. Security, Retention, and Account Deletion

13.1 Security Measures

We implement commercially reasonable administrative, technical, and physical security measures designed to protect the personal information we maintain about you. These measures include encryption of data in transit (TLS/SSL), access controls, and regular security assessments. However, no security measures are perfect or impenetrable, and we cannot guarantee absolute security. We recommend that you use strong, unique passwords and do not use unsecured channels to communicate sensitive information to us.

13.2 Data Retention — Specific Schedules

The following retention schedules apply to personal data we hold in connection with your Calimento account. Retention periods run from the triggering event described below.

• Active accounts: Personal data associated with an active account (whether in the 30-day no-cost access period or a paid subscription) is retained for as long as the account remains active and for the automated deletion periods described below once access ends.
• Former paid subscribers — access lapsed: If you had an active paid subscription that ended (by cancellation or non-renewal) and did not immediately re-subscribe, your account data — including saved recipes, meal plans, grocery lists, account profile, and uploaded images — will be permanently deleted 365 days after your paid access ended. This window allows you to reactivate your subscription and recover your data within one year.
• Users who never subscribed — 30-day access period expired: If you created an account, used the 30-day no-cost access period, and never purchased a subscription, your account data will be permanently deleted 90 days after the 30-day no-cost access period ended (approximately 120 days after account creation). You will receive advance notice before deletion.
• Transaction records: Records of In-App Purchase transactions and subscription receipts are retained for the period required by applicable tax, accounting, and financial regulations, regardless of account status.
• AI-processed data: Data transmitted to Anthropic for recipe scanning or grocery categorization is subject to Anthropic's own retention practices. We do not control Anthropic's retention timelines for data processed on their servers.

Automated deletion under the schedules above will be preceded by advance notice to the email address registered to your account, where technically feasible.

13.3 User-Initiated Account Deletion

You may delete your account and all associated personal data at any time using the Delete Account function in the App (Settings > Account > Delete Account), or by contacting us at admin@livelygraphics.com. User-initiated deletion is permanent and immediate. It triggers the following actions:

• Identity credentials revoked: Your login credentials and authentication tokens are immediately invalidated. You will not be able to sign back in to the deleted account.
• Database records deleted: All account profile data, saved recipes, meal plans, and grocery lists stored in our databases are permanently erased.
• Stored images erased: All recipe images and photographs you uploaded and stored in our cloud infrastructure (Google Cloud Storage) are permanently deleted.
• Legal retention exception: We may retain certain records for the minimum period required by applicable law — for example, transaction records required by tax regulations. This retained data is limited to what law requires and is not used for any other purpose.
• Subscription cancellation is separate: Deleting your Calimento account does not automatically cancel any active Apple App Store subscription. You must cancel your subscription separately through Apple ID Account Settings before or after account deletion to prevent future charges.
• Anthropic-processed data: Data previously transmitted to Anthropic for AI processing (recipe images, PDFs, ingredient names) is subject to Anthropic's own data deletion and retention practices, which are outside our control.

14. International Transfers

We are based in King County, Washington, United States. Your personal information may be transferred to, stored, or processed in countries other than the country in which you reside, including the United States. These countries may have data protection laws that are different from — and in some cases less protective than — the laws of your country.

If we transfer your personal information out of the European Economic Area (EEA) or the United Kingdom, we will rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on our website and within the App, update the "Last Updated" date, and provide notice as required by applicable law. For material changes — particularly changes that affect how we handle consumer health data, AI processing, or your privacy rights — we will provide more prominent notice (such as an in-App notification or email) and, where required, seek your fresh consent.

Your continued use of the Services following notice of changes constitutes your acceptance of the revised Privacy Policy.

16. Contact Information

If you have any questions, concerns, or complaints about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us at:

We will respond to privacy rights requests within the timeframe required by applicable law. For MHMDA requests, we will respond within 45 days, with the possibility of a 45-day extension for complex requests. For CCPA/CPRA requests, we will respond within 45 days, with the possibility of a 90-day extension.