Last Updated: October 11, 2026

Your Privacy Matters: Cardisat™ is designed with privacy at its core. Your dietary and health data stays on your device and in your personal iCloud account. We do not collect, upload, or share your personal health information on external servers.

1. Introduction

Innovative Graphics, Inc. ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use the Cardisat™ mobile application ("the App").

2. Information We Collect

2.1 Information You Provide

We may collect the following information when you use the App:

• Account Information: Your Apple ID for subscription management (handled by Apple, not stored by us)
• User Profile: Your name and daily fat limit setting (stored locally and optionally in iCloud)
• Dietary Data: Fat intake log entries, food favorites, and lipid panel results you enter (stored locally and optionally in iCloud)
• Health Estimates: Age, gender, height, weight, and activity level entered in the Calorie Calculator (stored locally on your device only, never transmitted)
• Support Communications: Information you provide when contacting our support team
• App Preferences: Your settings and preferences within the App (stored locally on your device)

2.2 Camera and Photos Access

Cardisat requests access to your device camera and Photos library for two purposes:

• Barcode Scanning: The camera reads product barcodes to look up nutritional information. No images or video are stored, uploaded, or shared during barcode scanning. Lookups are performed via the Open Food Facts API (see Section 6).
• Food Item Photos: You may optionally take a photo or choose one from your Photos library to attach to a saved food item. Photos are stored locally on your device and optionally synced via your personal iCloud account. Photos are never uploaded to our servers.

Both camera access and Photos library access require your explicit permission. You can revoke these permissions at any time in iOS Settings → Cardisat.

2.3 Automatic Information Collection

We do not integrate any third-party analytics or advertising SDKs. Automatic data collection is limited to:

• Crash Reports (opt-in): If you have enabled "Share iPhone Analytics" in iOS Settings → Privacy & Security → Analytics & Improvements, Apple's built-in crash reporting may capture anonymized crash logs. You control this entirely through iOS Settings — we do not receive identifying information.
• App Store Analytics: Apple provides us with aggregate, anonymized metrics about App Store interactions (downloads, updates). These statistics do not identify individual users and are governed by Apple's Privacy Policy.

3. How We Use Your Information

We use the information we collect to:

• Provide the App: Enable fat tracking, food lookup, history, and all core features
• Process Subscriptions: Manage your subscription status through Apple's App Store
• Improve the App: Review anonymized crash reports (when shared by you via iOS Settings) to fix bugs and improve stability
• Developer Messages: Fetch occasional in-app announcements from Apple's CloudKit public database (see Section 6.5)
• Customer Support: Respond to your questions and provide assistance
• Comply with Legal Obligations: Respond to legal requests and prevent fraud

4. iCloud Sync

Cardisat uses iCloud to optionally sync your data across your Apple devices. The following data may be synced via your personal iCloud account:

• Fat Intake Logs: Your daily entries including grams, meal type, food category, and date
• Favorites: Your saved food items with names, serving sizes, fat gram values, and optional photos
• Settings: Your username, daily fat limit, and appearance preferences
• Lipid Panel Results: Cholesterol test results you have logged
• Your iCloud, Your Control: This data is stored in your iCloud account, not on our servers
• Apple's Privacy Policy: iCloud data is subject to Apple's Privacy Policy

Note: Calorie Calculator inputs (age, gender, height, weight, activity level) are stored locally only and are never synced to iCloud.

5. Data Storage and Security

5.1 Local Storage

Your data is stored locally on your device:

• All fat intake log entries
• Saved food favorites and associated photos
• Lipid panel results
• Calorie calculator inputs
• App settings and preferences
• Background theme and appearance preferences
• Cached Developer Messages (fetched from CloudKit; deleted when the App is uninstalled)

5.2 Security Measures

We implement industry-standard security measures to protect your information:

• All data transmissions use encryption (HTTPS), including Open Food Facts barcode lookups and CloudKit Developer Messages
• Local data is protected by iOS security features
• iCloud data is encrypted in transit and at rest by Apple
• Sensitive screens (History, Lipid Panels, Calorie Calculator) are protected by Face ID / Touch ID

6. Third-Party Services

The App uses the following third-party services:

6.1 Apple App Store & StoreKit

• Subscription management and in-app purchases
• Subject to Apple's Privacy Policy

6.2 Apple iCloud (Optional)

• Sync your fat intake logs, favorites, and settings across your Apple devices
• Subject to Apple's Privacy Policy

6.3 Open Food Facts (Barcode Scanner)

• When you scan a product barcode, Cardisat queries the Open Food Facts API to retrieve nutritional information
• The barcode number is transmitted to Open Food Facts servers to perform the lookup
• Open Food Facts is a free, open-source food database; subject to Open Food Facts Terms
• No personal information is transmitted with barcode lookups

6.4 USDA SR Legacy Database (Food Search)

• The food search feature uses a local copy of the USDA Standard Reference Legacy nutritional database
• All searches are performed entirely on-device; no data is transmitted

6.5 Apple CloudKit (Developer Messages)

• Cardisat uses Apple's CloudKit public database to fetch occasional in-app announcements from the developer
• This is a read-only public database — no iCloud account or sign-in is required
• No personal data, health data, or photos are transmitted to CloudKit
• Messages are cached locally and deleted when the App is uninstalled
• Apple may log standard network metadata (e.g., IP address) per Apple's own practices; subject to Apple's Privacy Policy

We do not use third-party analytics, advertising networks, or tracking services.

7. Data Sharing and Disclosure

We do not sell, rent, or share your personal information with third parties, except in the following limited circumstances:

• With Your Consent: When you explicitly authorize us to share information (e.g., when you use the Share feature to send a saved food item via email)
• Service Providers: Trusted partners who assist in operating the App (e.g., Apple for payments, iCloud sync, and CloudKit Developer Messages), under strict confidentiality agreements
• Legal Requirements: When required by law, court order, or to protect our rights and safety
• Business Transfers: In the event of a merger, acquisition, or sale of assets (users will be notified)

8. Your Privacy Rights

You have the following rights regarding your information:

• Access: Your data is stored locally on your device and in your iCloud account (if enabled). You can access it anytime through the App or your device settings
• Deletion: You can delete all your data by uninstalling the App, or by clearing your iCloud data through your device's iCloud settings
• Control: You have complete control over your data since it resides on your device and in your personal iCloud account
• Diagnostic Data: You can disable sharing of crash and analytics data at any time in iOS Settings → Privacy & Security → Analytics & Improvements
• Camera & Photos: You can revoke camera and Photos library access at any time in iOS Settings → Cardisat

Note: Since we do not collect or store your personal health data on our servers, there is no data held by us to access, correct, or delete. All data is under your direct control on your device and in your iCloud account.

For questions about your rights, contact us at App.Support@Innovative-Graphics.com

9. Children's Privacy

Cardisat is not intended for children under the age of 13.

Important: We do not collect or store any personal information on our servers from any users, including children. All data is stored locally on the user's device or in their personal iCloud account.

If you believe a child under 13 is using the App, please contact us at App.Support@Innovative-Graphics.com

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or shared
• Right to opt-out of sale of personal information
• Right to delete personal information
• Right to non-discrimination for exercising your rights

Note: We do not sell your personal information.

11. European Users (GDPR)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with your local EU/EEA supervisory authority (GDPR Article 77). A list of national supervisory authorities is available at edpb.europa.eu

Our legal basis for processing your data is:

• Contract Performance: To provide the App and its features
• Legitimate Interest: To improve the App and provide support
• Legal Obligation: To comply with applicable laws

International Data Transfers: Some service providers used by the App (Apple, Open Food Facts) are based in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

12. Canadian Users (PIPEDA)

If you are located in Canada, your privacy rights are protected under the Personal Information Protection and Electronic Documents Act (PIPEDA).

Under PIPEDA you have the right to:

• Know why we collect, use, or disclose your personal information
• Expect us to collect, use, or disclose your personal information reasonably and appropriately
• Know who is accountable for protecting your personal information
• Expect us to protect your personal information with appropriate safeguards
• Access and correct your personal information
• Complain about how we handle your personal information

Privacy Officer: You may direct privacy inquiries to App.Support@Innovative-Graphics.com

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

13. Brazilian Users (LGPD)

If you are located in Brazil, your privacy rights are protected under the Lei Geral de Proteção de Dados Pessoais (LGPD).

Under the LGPD you have the right to:

• Confirmation of the existence of processing
• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data
• Data portability
• Deletion of personal data processed with your consent
• Information about entities with whom data has been shared
• Information about the possibility of not providing consent and the consequences
• Revocation of consent

Our legal bases for processing under the LGPD include: performance of a contract, legitimate interest, compliance with a legal obligation, and consent (for optional features such as iCloud sync and photo attachment).

Data Protection Officer (Encarregado): App.Support@Innovative-Graphics.com

International Data Transfers: Data processed by Apple and Open Food Facts may be transferred to servers located outside Brazil. Such transfers are made with appropriate safeguards in place.

Note on Children: The LGPD sets a higher protection threshold for children under the age of 12. We do not collect personal data from children under 12.

If you have an unresolved complaint, you may contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

14. Australian Users (Privacy Act 1988)

If you are located in Australia, your privacy rights are protected under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• Cross-Border Disclosure (APP 8): Some data may be processed by overseas entities (Apple, Open Food Facts, both US-based). Before disclosing personal information to overseas recipients, we take reasonable steps to ensure those recipients handle the information in a manner consistent with the APPs.
• Access and Correction (APP 12 & 13): You may request access to, or correction of, personal information we hold about you by contacting our Privacy Officer.
• Notifiable Data Breaches (NDB): In the event of an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the NDB scheme.

If you have an unresolved privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

15. Data Retention

We retain your information only as long as necessary:

• App data (logs, favorites, settings, photos): Stored on your device and/or iCloud while you use the App; deleted from your device immediately when you uninstall the App; iCloud data is controlled through your iCloud account settings
• Calorie Calculator inputs: Stored locally only; deleted on uninstall; never transmitted
• Cached Developer Messages: Stored locally; deleted on uninstall
• Support communications: Retained for up to 2 years after resolution
• Crash reports: Retained by Apple per Apple's own data retention practices
• Legal compliance records: Retained for the minimum period required by applicable law, typically no more than 7 years

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Updating the "Last Updated" date at the top of this policy
• Displaying a notice in the App

Your continued use of the App after changes become effective constitutes acknowledgment that you have had the opportunity to review the updated policy.

17. Do Not Track

The App does not track users across third-party websites or apps. We do not respond to "Do Not Track" signals because we do not engage in tracking.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact our Privacy Officer:

• Email: App.Support@Innovative-Graphics.com
• App: Settings → E-Mail Us

We will respond to your inquiry within 30 days.

Cardisat™

© 2026 Innovative Graphics. All Rights Reserved.

Apple, iPhone, iPad, iCloud, and App Store are registered trademarks of Apple Inc.

By using Cardisat™, you acknowledge that you have read and understood this Privacy Policy and agree to its terms