Privacy Policy

Last Updated: June 24, 2025

Grace Ltd. ("the Company") respects the privacy of users of its mobile application and website (together, "the Service"). This privacy policy explains how we collect, use, store, and share personal information about you when you use the Service, and what your rights are regarding this information. We operate in accordance with the privacy protection laws of the State of Israel, including the Privacy Protection Law, 5741-1981 and its regulations. By using the Service, you confirm that you have read and understood this policy and that you agree to the collection and processing of your personal information as described herein. If you do not agree to this privacy policy, please refrain from using the Service.

Definitions: For the purposes of this policy – "personal information" means any information relating to an identified or identifiable person; "the Service" means the Grace application and the website linked to it; "the User" means any person using the Service; "third party" means any entity that is not the user or the Company (such as external service providers).

Types of Information We Collect

• Information You Provide to Us Directly: When creating an account or registering for the Service (via email address, Google or Apple account, etc.), we collect personal details such as your name, email address, and additional contact information. Additionally, when using the Service, you may enter personal data and health information to receive nutritional guidance – for example, age, gender, height, weight, nutrition goals, food preferences, allergies, and food and beverage consumption data. This data is provided voluntarily and is necessary to provide you with personalized content. You may also respond to questionnaires or feedback within the Service – we will store this information in accordance with this policy.
• Nutrition and Physical Activity Information: The Service allows you to record your food and beverage consumption manually or through photos, as well as sync physical activity data. If you upload photos of foods to the application, we will collect the photos and process them (using artificial intelligence algorithms) to identify food items and calculate nutritional values. Furthermore, if you enter fitness or health data (such as steps, calories burned, activity minutes) manually, we will also store it to track your progress.
• Information from Third Parties and Integrations: If you choose to log in to the Service using an external provider account (such as Google Sign-In or Apple ID), we will receive from that provider basic information such as your name and email address as stored with that third party. Furthermore, if you authorize connecting the Service to other applications and devices – for example, syncing with Apple HealthKit, Google Fit, Fitbit, or other health and fitness services – we will receive from them information such as step data, heart rate, calories burned, sleep hours, and other physical activity data, in accordance with the permissions you grant. This data will be used only for providing our nutritional and health services and will not be shared for advertising or marketing purposes. We emphasize that we do not sell health information collected through HealthKit or similar integration, and do not use it for delivering advertisements.
• Payment and Subscription Information: If you purchase a paid premium subscription, we will collect information about the subscription type, subscription start and end dates, and payment records (such as amount and billing date). We do not store full credit card details with us – payment processing is done through secure payment processors (for example, purchase through Apple App Store, Google Play, or online payment service), and accordingly, sensitive payment data (such as credit card number) is stored directly with those providers in encrypted form. We may store a transaction identifier, last four digits of credit card or other payment method, and billing details for record-keeping and oversight purposes.
• Technical Information and Usage Data: During your use of the website or application, we automatically collect certain technical information: your device's IP address, device type (for example, iPhone or Android), operating system version, browser type, language settings, application version, access times and dates, pages or screens you viewed, features you used, technical errors recorded, and unique identifiers such as device identifier or advertising identifier. This information (hereinafter "Usage Data") is collected through tracking technologies such as cookies and web beacons, as detailed below, and is used by us to analyze how the Service is used, improve user experience, resolve technical issues, ensure security, and prevent fraud.
• Cookies and Similar Technologies: On our website, we use cookies – small text files stored in your browser – as well as similar tracking tools (such as local storage, pixel tags, and web beacons) to identify you on your visit, remember your preferences (such as interface language), and collect statistical usage data. Some cookies are essential for Service operation (for example, for secure login to your account), some are intended for performance improvement and traffic monitoring, and others are used for functionality (such as remembering preferences). You can limit or block cookie use through browser settings; however, note that some services may not function properly without cookies. We do not use third-party cookies for personalized advertising purposes, as the Service does not contain advertising content from external parties.

How We Use Information

We use the personal information and other data we collect for the following purposes:

• To Provide and Operate the Service: First, we process the information to provide you with the requested services. This includes creating and managing your user profile, calculating and analyzing nutritional and physiological data you enter (for example, calculating calorie consumption, analyzing nutritional components, recommendations for balanced nutrition), and personalizing Service content for you (such as recommended menus, reminders, and customized notifications). Processing your data is necessary to enable the Service to function as designed and for you to receive personal nutritional insights.
• To Improve and Develop the Product: We may use information in aggregate (anonymous) or statistical form to understand usage patterns in the Service, identify trends, and improve our artificial intelligence algorithms. For example, we will analyze which features receive heavy use, where malfunctions occur, or how users respond to recommendations, and thereby we can refine user experience and accuracy of nutritional recommendations. Use of data for analytical purposes will be done while ensuring not to identify you personally in any public analysis output. Furthermore, we may use information (including feedback you provide to us) to develop new capabilities and features in the Service.
• To Communicate with Users: We will use your contact details to communicate with you regarding your account and the Service. For example, we will send you email messages or in-app notifications to confirm your registration, notify about important changes (such as updates to terms of use or privacy policy), update regarding new features or changes to the subscription plan, provide technical support or respond to your service inquiry, and for sending daily reminders or "push" notifications from the application if you grant permission (for example, reminder to log a meal, update on progress toward a goal, etc.). We may also send you informational and marketing material about our services (such as nutrition tips, news, and updates) – however, only in accordance with your preferences and subject to receiving your explicit consent as required by law for sending advertising materials.
• To Enforce Terms of Use and Prevent Prohibited Activity: The information will help us detect, investigate, and prevent cases of Service misuse, violations of terms of use, fraudulent actions, account theft, unauthorized access, security or law violations (such as attempts to perform cyber attacks, or entering illegal content). We may monitor usage patterns and identify anomalies indicating prohibited use, to protect the Service and our users. If necessary, we will use the information to take appropriate steps, such as blocking access, reporting to law enforcement, or taking legal action.
• Legal Compliance and Legal Protection: If required, we will process and disclose information as needed to comply with legal obligations imposed on us. For example, we may need to retain certain information for periods prescribed by law (such as tax or financial reporting laws), or disclose specific information details to authorized authorities when the law requires this or when we receive a judicial order. Furthermore, in case of a legal dispute between you and the Company, we may use relevant information in our possession (for example, activity logs) to protect our legal rights, pursue proceedings, or enforce judgments.

In all use of information, we ensure that processing is necessary for the purpose for which it was collected, and we do this based on accepted legal grounds (such as the need to provide you with the requested service, or obligation to comply with law). If we request to use your personal information for a new purpose that is materially different from the purposes detailed above, we will notify you and request your consent for this.

Sharing Information with Third Parties

We exercise extra caution in sharing your personal information and commit to doing so only subject to ensuring appropriate privacy protections and in accordance with law. The Company does not sell, rent, or transfer your personal information to advertisers or external marketers, and does not display third-party advertisements in the Service. However, we may share information in the following situations:

• Service Providers (Processors): We rely on a series of external providers to provide part of the Service functions and operations. For example, we use cloud storage and database providers (such as secure storage servers) to store information; analytics providers (such as Google Analytics) for analyzing usage data; communication and messaging providers (such as email and push notification services); payment and processing providers (such as Apple, Google, PayPal, or Stripe) to handle subscription transactions; and we may rely on image recognition or artificial intelligence analysis service providers to process food photos you upload. These service providers receive access to personal information necessary for them to provide their services, but are not permitted to use this information for any other purpose. We contract with them under agreements that require them to maintain data confidentiality, secure it appropriately, and process it only on behalf of the Company and in accordance with its instructions.
• AI Service Providers: To provide you with nutritional analysis, food identification, and personalized nutrition guidance, we use third-party artificial intelligence services, including OpenAI (operated by OpenAI, L.L.C.). When you use features such as food photo analysis, text-based food logging, or chat with our nutritionist assistant, your food descriptions, photos, chat messages, and related health information (such as your nutrition goals and preferences) may be processed by OpenAI's AI models. This data is sent to OpenAI solely for the purpose of providing you with nutritional analysis and recommendations. OpenAI processes this data according to their privacy policy and terms of service. We have configured our use of OpenAI's services to minimize data retention and ensure that your personal information is handled securely. For more information about how OpenAI processes data, please review OpenAI's privacy policy at https://openai.com/policies/privacy-policy.
• Integrations with Fitness and Health Entities: As mentioned, if you choose to connect your account to third-party services (Apple Health, Google Fit, Fitbit, etc.), we will share with them information necessary to perform synchronization or receive information from them – all in accordance with permissions you grant. For example, we may transfer to Apple HealthKit information about your daily calorie consumption or weight you entered so they also appear in your device's health application. Such sharing will be done only for your benefit and at your request, and any information we share with a third-party health platform will be subject to that service's privacy policy. We emphasize that under Apple's policy, health information we receive from HealthKit or send to it will never be used for advertising purposes or sold to third parties.
• Transfers in Connection with Business Control Changes: If, unfortunately, the Company undergoes a structural change, such as merger, acquisition by another company, strategic investment, securities offering, sale of all or majority of its assets, reorganization, or insolvency – personal information may be transferred or disclosed to parties involved in that transaction. In such a case, we will ensure that the acquiring or merged party assumes the obligations imposed by this privacy policy, at least to the same degree of privacy protection, and we will notify you (for example, through a message in the Service) of any such ownership change and your rights as required by law (for example, option to delete information before transfer, in certain cases).
• As Required by Law or to Protect Rights: There may be circumstances in which we are obligated by law to disclose information (for example, in the framework of legal proceedings, police request, or court order), or where it is necessary to disclose information to fulfill a legal obligation, prevent an offense or tort, protect your safety or the safety of others, enforce our terms of use, or protect the rights, property, and security of the Company, our employees, our users, or the public. In these cases, we may disclose relevant information to appropriate authorities or our advisors (for example, legal advisors), while attempting to notify you if legally possible.
• With Your Consent or at Your Direction: Beyond the situations above, if a situation arises where we request to share your personal information with a third party not covered by the categories above – we will do so only if we receive your explicit consent for this. For example, if you participate in our collaboration activity with a professional entity (for example, academic research in the field of nutrition) and we wish to transfer data to them, we will request your informed consent in advance (and we can allow you to participate anonymously if you prefer). We will never provide sensitive personal information about you to third parties without your consent, except as required by law as mentioned.

It is important to note that in any case of information sharing, we will share only the minimum information necessary to achieve that legitimate purpose, and we make efforts to ensure that the receiving party maintains the information securely and under confidentiality obligations.

Information Retention and Security

We will retain your personal information for the time necessary to fulfill the purposes for which it was collected, as detailed above, or for longer periods if required by law. For example, as long as you have an active account with us, your profile data and nutrition journal will be stored regularly to allow you access to information history. If you decide to delete your account or cease using the Service, we will deactivate your account and delete or anonymize personally identifiable information, except information we are required or permitted to retain for longer periods to comply with legal obligations (such as transaction records for tax purposes) or for legitimate business interests (such as maintaining records of consent, or dealing with potential claims). We will not retain personally identifiable information longer than necessary, and upon expiration of the required retention period, the information will be securely deleted or irreversibly anonymized.

Your information security is important to us. We implement reasonable administrative, physical, and technological security measures in accordance with industry standards to protect against unauthorized access, misuse, and loss or damage to personal information. These steps include, among others: encrypted communication (SSL/TLS) between the application and our servers; encryption of sensitive information at rest; limiting access to personal information only to employees and third parties with professional need to process it (subject to confidentiality obligations); intrusion detection and prevention systems; and additional controls to protect information. However, it is important that you understand that no security method guarantees absolute security. Despite our efforts, we cannot commit that our servers will be immune to any breach, or that information will not be disclosed due to exceptional cyber events or failures that are not under our control. Therefore, use of the Service and transfer of information to us are at your responsibility. We also recommend that you take security steps on your part: choose a strong password for your account (if relevant) and keep it confidential, avoid sharing login details with others, and make sure to log out of your account when finishing use on public devices.

In the unlikely event that a significant security incident occurs that poses a real risk to your personal information, we will act in accordance with our legal obligations to notify the Privacy Protection Authority and relevant parties, and make efforts to notify you through reasonable means (for example, via email or application message) so you can take appropriate steps.

Your Rights Regarding Information

As a user of our Service and as a person whose information is stored in our databases, you have several important rights to protect your privacy:

• Right to Access Information: According to the Privacy Protection Law, every person has the right to access personal information about themselves held in databases. This means that you may contact us and receive from us confirmation whether we hold personal information about you, and if so – receive a copy of your personal information in the database (subject to certain limitations, for example, to protect the privacy of others or state security). We will provide you with the information you requested for review in a format you choose – online display, digital file, or printed report – within the time prescribed by law (currently up to 30 days from the date of your inquiry, unless we request a justified extension).
• Right to Correction or Deletion: If you discover that information we hold about you is incorrect, incomplete, unclear, or not updated, you are entitled to request that we correct the information or delete it. For example, if your email address has changed, if you discovered that a certain record in your nutrition journal is incorrect, or if you no longer wish us to hold certain information – you may request its correction or removal. Upon receiving a correction/deletion request, we will act to correct or delete the information in accordance with our legal obligation, and update you. Note that if it is information we need to provide the Service (such as account details), its deletion may cause closure of your account or impair our ability to provide you with the Service. Furthermore, there are cases where we cannot delete information even if you requested – for example, if we are obligated to retain it by law or if the information is necessary for legal protection – but in such a situation we will notify you and detail the reason.
• Right to Object to Use of Information for Direct Marketing: If you registered and received direct marketing from us for marketing purposes (such as newsletter, offers, and marketing updates), you have the right to request at any time to be removed from the mailing list. In every marketing email sent, there will be an "Unsubscribe" link or removal instructions, and by clicking on it, we will stop sending marketing communications to you. You can also contact us in writing with a request to unsubscribe from direct marketing, and we will act to remove you from this in accordance with the provisions of the Communications Law (Bezeq and Broadcasting) (Amendment No. 40), 5768-2008 (known as the Spam Law). We may retain your details on a "do not send" list to ensure we do not accidentally bother you in the future with advertising materials. Note that even after removal from marketing communications, you may continue to receive important operational messages from us that are not promotional (for example: notice of change to terms of use, information about your subscription status, alert regarding your account security, etc.), as these messages are part of Service operation and are not conditional on marketing consent.
• Right to Restrict Processing or Objection (in Certain Cases): If you believe we are processing your information unjustifiably or beyond what is necessary, you have the right to demand that we restrict information processing (for example, if you dispute the accuracy of the information – for the investigation period, or if information processing is illegal and you request restriction instead of deletion). Additionally, if and to the extent applicable law grants you the right to object to information processing in specific circumstances (for example, according to European Privacy Protection Regulations (GDPR) if they apply to you) – we will also honor this right.
• Data Portability Right: If required by law (for example, under GDPR), you will be entitled to receive personal data you provided to us directly in a machine-readable format, or request that we transfer it to a third party you specify, when technically feasible (for example, if you request to export your nutrition history to a CSV file).

Exercising Rights: To exercise your rights, you can contact us at any time with an appropriate request (contact details are provided below). To protect your privacy, we may request identifying details (such as verification via registered email, or other identifying information) before providing information or making a change, to verify that you are indeed the rights holder. Requests will be handled in accordance with timeframes prescribed by law, and generally without financial cost. If for any reason we refuse your request (fully or partially), we will explain to you the legal reason for refusal and your options to appeal the decision. Remember that every person has the right to access personal information about themselves held in databases public and private in Israel, and if you discover that the information is not correct, you have the right to request its correction or deletion – we are here to assist with this and will honor any legal request.

If you have additional questions about your rights or how to exercise them, you can of course contact us and we will be happy to guide and assist.

Children's and Minors' Privacy

The Service is not intended for minors under the age of 18. We do not knowingly collect or request personal information from children or teenagers under the age of 18. If you are not 18 or older, you are not permitted to use the Service or provide us with personal information. Parent or guardian: If you notice that your child provided us with information without appropriate consent, please notify us so we can take steps to delete the information. If we discover (or receive a report) of a user who is under 18 who provided us with personal information, we will immediately act to delete or anonymize the information and delete their account, if any, except if we are obligated to retain the information for legal proceedings or by law. We take very seriously our duty to protect children's privacy online and act in accordance with the Privacy Protection Law and relevant minors legislation (including the Children's Online Privacy Protection Act (COPPA) of the USA, to the extent it applies extraterritorially).

Note that if you are age 13-18 (a minor with legal limitations) – use of the Service is conditional on you having received approval from your legal guardian for the terms of use and privacy policy, as needed. The Company reserves the right to request age verification from you at any time and verify your age through reasonable means.

Links to Other Websites and Services

The Service may from time to time include links to external websites or services not operated by us (for example, a link to an external article on nutrition, or referral to a store to purchase fitness equipment). If you click on a third-party link, you will be transferred to that third party's website or service. It is emphasized that this privacy policy does not apply to websites or services not owned or controlled by us. We recommend that you review the privacy policy of any external website or service you visit or use. The Company does not bear responsibility for the content, privacy practices, or security measures of any third-party websites.

Changes to Privacy Policy

We may update this privacy policy from time to time, for example to reflect changes in services we offer, legislative updates, use of new technologies, or any other business reason. When we make a material change to the policy (such as a change in how personal information is used, expansion of sharing rights, etc.), we will notify you clearly. Such notice may be made by publishing a prominent notice on the website or application, and/or by sending a message to your registered email address, before the changes take effect. At the top of this policy, we will update the "Last Updated" date so you can see when it was last updated.

We recommend that you review the privacy policy from time to time to stay updated on changes. Your continued use of the Service after an updated privacy policy takes effect will be considered your consent to any change in it, except regarding information collected previously (prior use will continue to be subject to the policy in effect at the time of collection unless we agree otherwise with you). If you do not agree to changes in the policy, you should stop using the Service and consider requesting deletion of your data from us (as mentioned above).

Contact

For any question, request, or clarification regarding this privacy policy or how we handle your personal information, you can contact us through the following means:

• Email for Support and Privacy: mytzunai@gmail.com

We do our best to respond to inquiries quickly and efficiently. If you did not receive a satisfactory response to your inquiry, and you believe your privacy right has been violated, you have the right under law to contact the Privacy Protection Authority in Israel or appropriate courts. However, we would appreciate if you allow us first to help and resolve any problem directly with you.

Thank you for choosing to use Grace. We are committed to protecting your privacy and the security of your information, and see this as an integral part of the service we provide.