Privacy Policy
1. Data controller and governance
Publisher and data controller: Palta Negra LLC — New Mexico Entity ID: 0008083445.
1209 Mountain Road Pl NE, Suite N, Albuquerque, NM 87110, United States.
Contact: contact@powalia.com · +33 6 09 12 14 50.
Internal data protection contact: Frédérique Chataigner — contact@powalia.com. This internal contact role is distinct from that of a data protection officer (DPO, Articles 37 to 39) and from that of the European representative (Article 27).
Representative in the European Union — Article 27 GDPR: DPO Europe GmbH, Auguste-Viktoria-Allee 20A, 13403 Berlin, Germany (HRB 235801) — representative+palta.negra@data-privacy-office.eu, +49 30 219 25359. DPO Europe GmbH acts as representative of Palta Negra LLC in the Union; it is not the DPO of Palta Negra LLC.
Powalia processes health data, sensitive within the meaning of Article 9 GDPR, with an enhanced level of protection.
2. Data we collect
Account: email, password (stored hashed, never in clear text), first name, language, role.
Health and well-being (that you enter): profile (symptoms, treatments and supplements, sleep, stress, mental load), food (meals, drinks, meal photos, nutritional analyses, hydration, fasting), body measurements and optional progress photos, declared consumption.
Usage and technical: connection data and technical identifiers necessary for operation.
Gamification (“Powas”): points and levels linked to your activity.
Therapist relationships (optional): link with a therapist and data you choose to share.
Purchases: when subscribing or making a purchase, Apple or Google process the payment and transmit to us the information necessary to activate your access (see §7).
Meal photos: the image is temporarily transmitted to our AI analysis provider to produce a nutritional estimate (see §5); Powalia does not durably keep meal photos on its servers.
Body progress photos: optional, stored in a private object storage space (PAR1 region, France), accessible only via a temporary signed URL, displayed in Powalia, and deleted with the account.
3. Health data and consent (Article 9)
Consent to the processing of your health data is requested on first use of a health feature (“just-in-time”), and not as a condition of account creation. This consent is free, specific, informed, unambiguous, time-stamped and revocable at any time without retroactive effect. As long as it is not given, the health data concerned is not synchronised on our servers.
When you start an analysis, meal photos and descriptions are transmitted to our AI provider to produce the analysis (see §5). Powalia is not a medical device: it makes no diagnosis, prescribes or treats nothing. Results are provided for information only and do not replace the advice of a healthcare professional.
4. Purposes and legal bases
- Create and manage your account, provide the service — performance of the contract (Terms of Use).
- Personalise support, analyse and synchronise your health data — your consent (Article 9).
- Share data with a therapist you designate — your explicit consent, by category and revocable.
- Service-related emails (security, reset) — performance of the contract / legitimate interest.
- Manage subscriptions and purchases — performance of the contract.
- Security and abuse prevention — legitimate interest.
5. Artificial intelligence
To analyse your meals and supplements, certain data (meal photo or description, elements needed for the analysis) are transmitted, via a server relay, to our AI provider, currently OpenAI (Palta Negra LLC organisation). The call uses the chat completion API (endpoint /v1/chat/completions); no persistent storage function on the OpenAI side is used (no assistants, threads, files, vector stores or fine-tuning).
The OpenAI account is set so that API data is not used to train the models, and call logging is disabled. A short-term technical retention for anti-abuse monitoring, of up to 30 days, may remain at OpenAI. We do not transmit your full identity to the provider, unless technically necessary. The architecture is designed to allow the AI provider to be changed.
6. Sharing with a therapist
Sharing your data with a therapist is voluntary (no sharing by default), explicit, granular (you choose the categories) and revocable at any time (revocation cuts off access immediately).
7. Recipients, providers and payment platforms
- Scaleway — hosting of the backend and data (PostgreSQL database, object storage), PAR1 region, France.
- OpenAI — AI analysis of meals and supplements (see §5).
- Resend — sending of transactional emails (security, reset).
- Vercel — distribution of the web application (front-end).
- Apple and Google — distribution and payment platforms for subscriptions and in-app purchases. Payment information is collected and processed directly by the platform concerned under its own terms. Powalia receives only the information necessary to validate the purchase, activate access and manage the subscription.
- Systeme.io — hosting of and access to the online programmes purchased in the shop via Apple or Google. Only the data necessary to provide access is transmitted: identity, email address, purchased programme and technical activation data. Powalia does not transmit to Systeme.io the health data you enter in the app.
We do not sell your data. Data hosting (Scaleway) is covered by a dedicated contract, in France.
8. Security
The backend and data are hosted at Scaleway, in France (PAR1 region). Exchanges with our servers are encrypted in transit (HTTPS/TLS). Passwords are hashed; reset tokens have a short lifetime. Access is controlled by authentication tokens; when an account is deleted, existing tokens become immediately invalid. No data is visible to a third party (including a therapist) without explicit and revocable sharing.
9. Retention periods
- Account, health and well-being data: for the lifetime of the account; deleted when the account is deleted.
- Body progress photos: lifetime of the account, unless manually deleted earlier.
- Meal photos and descriptions: transmitted temporarily for analysis; no durable retention on Powalia’s side.
- Technical backups of the PostgreSQL database: 7 days maximum.
- Support requests: 24 months.
- Prospects: 3 years.
- Accounting and transaction records: 10 years (legal obligation).
- Register of requests to exercise rights: 5 years.
- Analysis results cached technically on the server: 24 hours.
- Powa assistant messages: minimised retention, automatically purged after summary or after reply.
- Powa assistant memory summary: kept until the account is deleted.
- Logs of openings of purchased content: internal use related to the provision of content.
- Technical anti-abuse retention at OpenAI: up to 30 days (see §5).
10. Transfers outside the EEA
As publisher, Palta Negra LLC may access certain data from third countries (outside the EEA). Depending on the features used, some data may be processed outside the EEA by providers such as OpenAI, Vercel, Resend, Apple, Google and Systeme.io. Data hosted by Scaleway is located in France. We make no unproven certification or scope claims.
11. Your rights
You have detailed rights on the “Your rights and personal data” page. You can export your data from the app (Profile → Privacy and my data → Export my data): a file of your data is provided to you. You can also send an access or portability request to contact@powalia.com.
12. Local storage
To work quickly, the App keeps a local copy of certain data on your device (cache) and an authentication token. This cache may persist on the device and is purged when the account is deleted.
13. Intended audience and minimum age
Powalia is mainly designed for people concerned by perimenopause and menopause. The app is rated 16+ on the App Store and is not intended for children under 16. Palta Negra LLC does not knowingly seek to collect personal data concerning people under 16. If we discover that data concerning a person under 16 has been collected, it may be deleted in accordance with this privacy policy and applicable laws.
14. Mobile apps, permissions and cookies
Permissions (camera, photos, notifications) are requested only when the relevant feature requires it. Powalia completes the declarations required by the platforms (Apple App Privacy, Google Play Data Safety). On cookies and trackers, see the “Cookie Policy”.
15. Changes
We may update this policy. In the event of a significant change, we inform you and, if necessary, collect your consent again. The applicable version is dated at the top of the page.