Privacy Policy

Company: AllBlazing BV — c/o WatSup AI

Address: Buitenwatersloot 81, 2613 TB Delft, The Netherlands

Chamber of Commerce (KvK): 83648941

VAT Number: NL862946670B01

Email: support@watsupai.com

For privacy inquiries, email support@watsupai.com or see our contact page.

We process your data based on:

• Consent: For non-essential cookies and analytics (you can withdraw at any time)
• Contract: For Pro passes, delivering scan results you request, sending the purchase/cancel emails that form part of that contract, and storing your “start now” request with the payment
• Legitimate interest: For abuse prevention, rate limiting, security, and responding to support messages
• Legal obligation: Invoices, tax records, and handling a valid cancellation/refund

We use your data only for:

• Generating AI-powered supplement stack analyses you request
• Pro status verification and pass duration (Pro tier)
• Payment processing (handled by Stripe)
• Rate limiting and abuse prevention
• Sending Pro confirmation and cancellation acknowledgements
• Responding to support messages
• Analytics (only if you accept cookies)

We do not sell your personal data. We do not send marketing emails without consent. We use processors listed in Section 11 only as needed to run the service.

We share personal data only with processors that help us run WatSupAI (payments, hosting, AI analysis, and analytics if consented). We require appropriate data processing agreements and safeguards. We do not sell personal data.

Under GDPR and Dutch privacy law (AVG), you have the right to:

• Access: Request a copy of your data (Pro users can request their data)
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Portability: Request data export in a machine-readable format
• Objection: Object to processing of your data
• Restriction: Request restriction of processing
• Withdraw consent: Opt out of cookies (cookie banner on first visit)

To exercise these rights, email support@watsupai.com. We'll respond within 30 days as required by GDPR.

We retain data only as long as necessary:

• Hashed IP quotas: Up to 30 days
• Scan cache: Up to 24 hours (hashed inputs only)
• Pro tier flags: For the 90-day pass (or while a legacy subscription is active)
• Stripe “start now” metadata and invoices: With the payment record (Stripe) and as required for accounting
• Cancellation requests: Until the refund is done and for the accounting period that applies
• Support email: As long as needed for support and legal compliance
• Newsletter: Until you unsubscribe
• Cookies / consent: As per your cookie choice (stored in localStorage)
• Device history: In your browser until you clear it, export/import, or the browser drops it. We do not hold a server copy.

We use industry-standard security measures to protect your data. All data transmission is encrypted (HTTPS). Payment data is handled by Stripe (PCI DSS compliant). We don't store sensitive data on our servers.

In the unlikely event of a data breach that affects your personal data, we will notify you and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours as required by GDPR.

Non-essential cookies run only after you accept. Reject is as easy as accept. Change this anytime via Cookie preferences in the footer.

No analytics cookies unless you opt in. Paying happens on Stripe; their own cookies may be set there.

We use the following third-party services:

• Stripe: Payments and the “start now” tick stored with the payment (EU/US, SCCs)
• OpenAI: AI text and image analysis for scans (USA, SCCs / DPA as applicable)
• Upstash: Caching, quotas, and Pro flags (EU)
• Netlify: Hosting, serverless functions, optional newsletter form (EU/US, SCCs)
• Email (SMTP): Pro confirmation, cancellation acknowledgements, and support mail
• Google Analytics (GA4): Analytics only if you accept cookies (USA, consent-based)
• Google Preferred Sources: Only if you click “Add as preferred source” (USA). Opens Google’s source-preferences flow; not used for analytics

Where data is transferred outside the EEA, we rely on appropriate safeguards such as EU Standard Contractual Clauses and processor terms. You may request more information about transfers by contacting us.

WatSupAI uses artificial intelligence (including third-party models via OpenAI) to generate entertainment and educational supplement stack analyses. Outputs are automated and may be inaccurate or incomplete.

• Not medical advice: The system does not diagnose, treat, or prescribe. It is not a medical device or clinical decision tool.
• Transparency: You are interacting with AI-generated content, not a human nutritionist or doctor.
• Your input: Do not submit medical records or other special-category health data. See Section 3.
• Human review: Contact us if you believe an output is harmful or incorrect; we do not guarantee manual review of every scan.

We assess our service as a limited-risk AI use case focused on general wellness entertainment, not high-risk healthcare AI under the EU AI Act. If classification changes, we will update this policy.

WatSupAI is 18+ only. We don't knowingly collect data from anyone under 18. If you're under 18, please don't use our service.

We may update this privacy policy from time to time. We'll notify you of any changes by updating the "Last updated" date at the top of this page. Continued use of our service after changes constitutes acceptance.

Data Protection Contact: For privacy questions or to exercise your rights, email support@watsupai.com.

Complaints: If you're not satisfied with our response, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

EU Online Dispute Resolution: For consumer disputes, you can use the EU Online Dispute Resolution platform at ec.europa.eu/consumers/odr.