OptimThis policy explains what data the Optim app processes, why, on what legal basis, who we share it with and what rights you have. We have kept it as plain as we can. If anything is unclear, write to us.
1. Who the controller is
CyberBuild Solutions S.R.L., VAT number RO53532866, EUID ROONRC.J2026005608003, registered office at Str. Ioan Stănei nr. 42, Corbu, Constanța County, Romania (“we”), which develops and operates the Optim app and the dontsitgetfit.me website.
Our Data Protection Officer (DPO) is Iulian Bofu. You can contact him about anything concerning your data at iulian@cyberbuildsolutions.com or by post at the registered office above.
2. What data we process
| Category | What exactly | Source |
|---|---|---|
| Account | name, username, password (stored only as a scrypt hash, never in plain text), date of consent | you, at sign-up |
| Profile | sex, year of birth, height, weight, activity level, goal, diet, allergies and foods you avoid | you |
| Food | your meal log, photos sent for recognition, photographed receipts and labels, what you have in your pantry | you |
| Body and activity | weight you enter; if you connect a Garmin watch: calories, steps, activities, sleep, heart rate, heart rate variability (HRV), smart-scale weight | you, or your Garmin account |
| WhatsApp (optional) | your phone number, the messages you send us and our replies | you, if you link your number |
| Technical | IP address and request times in server logs | automatically |
Data about your weight, food, sleep and heart rate is data concerning health under Article 9 of Regulation (EU) 2016/679 (“GDPR”). We do not ask for or process national ID numbers, card details, identity documents or data about other people.
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Your account and the operation of the app | performance of a contract (Art. 6(1)(b) GDPR): the terms of use |
| Calculating your daily target, meal recommendations and weight trend from health data | your explicit consent (Art. 9(2)(a) GDPR), given at sign-up by ticking the consent box |
| WhatsApp messages | your consent: you link your number and write to us first |
| Security of the service (technical logs, abuse prevention) | our legitimate interest (Art. 6(1)(f) GDPR) |
We do not use your data for advertising, we do not sell it, we do not build marketing profiles and we do not use it to train artificial intelligence models. The app's recommendations are informational calculations; they do not make decisions that produce legal effects concerning you.
You can withdraw your consent at any time by deleting your account (see Data deletion). Withdrawal does not affect processing carried out before it.
4. Who else receives data
The app runs on servers we operate in Romania. A few providers receive strictly what they need to do one specific thing:
- Groq, Inc. (USA), food recognition: receives only the text or photo of a meal, without your name or any account data, and returns the foods and quantities. As this is a transfer outside the European Economic Area, it relies on the provider's contractual safeguards.
- Open Food Facts (public product database), barcode lookup: receives only the number on the barcode, nothing about you.
- Garmin, if you connect your watch: the app reads data from your Garmin account. We use your Garmin password once, to obtain access, and do not store it.
- WhatsApp / Meta Platforms, if you use WhatsApp: messages pass through their service, under the WhatsApp privacy policy.
We do not give data to any other person or company, except where an authority requires it under the law.
5. How long we keep it
- Account data, profile, meal log and watch data: for as long as you have an account. When you delete your account, they are permanently deleted, immediately.
- Unused invitations expire after 7 days.
- Server technical logs: for a short period, only as long as needed for security and troubleshooting.
6. Your rights
You have the right to request access to your data and a copy of it, rectification, erasure, restriction of processing and portability (a machine-readable copy), to object to processing based on legitimate interest and to withdraw your consent. You can do much of this yourself in the app (Mai mult → Profilul meu, “More → My profile”). For the rest, write to our DPO at iulian@cyberbuildsolutions.com; we reply within 30 days at the latest.
You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, dataprotection.ro, or with the authority in the EU country where you live.
7. How we protect it
- Every user has a separate database; one person's data is never mixed with another's.
- Connections are encrypted (HTTPS), and your session is a signed cookie that only the server can read.
- Passwords are stored only as cryptographic hashes, each with a unique salt.
- Only CyberBuild Solutions administrators have access to the servers.
8. Minimum age, cookies, changes
Optim is only for people aged 18 or over.
The website and the app use a single cookie, the session cookie, which is needed to keep you signed in. We use no analytics or advertising cookies, tracking pixels or third-party fonts, so we do not ask for cookie consent.
If we change this policy, we update the date at the top. If a change affects what data we use or who we share it with, we tell you in the app before it takes effect.
This English text is a translation. If there is any difference, the Romanian version prevails.