Privacy Policy

Last updated: April 28, 2026. This plain-language policy is for the hosted Achiote web app and API. Self-hosted deployments control their own data.

What Achiote collects

Achiote may process food memories, optional chat history, API keys, usage events, Stripe billing records, and support messages you send us. Food memories can include family, culture, place, and health-adjacent context, so we treat them as sensitive personal stories even when they are not legally classified that way.

What Achiote does not collect

We do not ask for card numbers directly. Payment details, when enabled, are handled by Stripe. We do not sell personal data. Telemetry is designed to count product events, not store prompt text.

Telemetry and logs

We collect privacy-preserving events such as page opened, pricing viewed, onboarding prompt selected, ask started, ask succeeded, ask failed, checkout started, checkout failed, and feedback category. Analytics may include privacy-preserving event dimensions such as route, tier, checkout mode, prompt source, and error category. We do not intentionally store full food-memory prompts in analytics events. Server logs may include operational metadata such as endpoint, status, provider/tool state, timestamps, and error class.

When product analytics are enabled, we may use PostHog as an analytics processor for the same privacy-preserving page and product events. It is configured conservatively: no session recordings, anonymous-only profiles unless you sign in, and it honors your browser's Do Not Track setting. We do not send food-memory prompts, recipes, or credentials to it.

Data & memory controls

Achiote's default path is ephemeral request processing: you can describe a dish or drink, get a Memory Receipt, and leave every optional data toggle off. Achiote still works if every optional toggle is off.

Optional analytics and aggregate quality signals are opt in, not default-on. You can opt out again from the app controls at any time. These signals are intended to count product usage and reliability patterns, not store full prompts, recipes, credentials, or private family stories.

Saved memories, family confirmations, and public pantry contributions require a separate explicit opt in before anything is retained or reused beyond the current request. If you do not opt in, Achiote should continue to reconstruct memories using the current request, bundled reference data, and whatever research context your host AI provides.

Retention

Operational logs should be retained for no more than 90 days unless needed for security, abuse prevention, accounting, or legal obligations. Support records may be kept while an issue is open and for a reasonable follow-up period. Billing records follow accounting and payment-provider requirements.

Data deletion

To request data deletion, export, or correction, email [email protected] with the subject "Achiote data request". Include the email or API key identifier connected to the request. We will verify ownership before deleting account-linked records and normally acknowledge launch-period requests within 2 business days. Deletion requests cover your account data, stored food memories, and associated billing records (except where retention is required by law for accounting or tax purposes).

Your rights under GDPR and CCPA

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), including:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure ("right to be forgotten") — request deletion of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time where processing is based on consent

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• Right to know — request disclosure of what personal data is collected and how it is used
• Right to delete — request deletion of your personal information
• Right to opt out of sale — we do not sell personal data, so this right does not apply, but we confirm it here for transparency
• Right to non-discrimination — exercising your privacy rights will not result in discriminatory treatment

For all data rights requests, email [email protected] with the subject "Achiote data request". We respond within 30 days (or 45 days where permitted by law).

Data controller and processor

Kyanite Labs is the data controller for Achiote-hosted services. When you use Stripe for payments, Stripe acts as an independent data controller for payment data under its own privacy policy. AI inference may run locally on your device or via GLM z.ai as a data processor. When cloud inference is used, food-memory prompts are sent to the inference provider for processing and are not used for model training under the provider's API terms.

International transfers

Your data may be processed in the United States. If you are outside the US, your data will be transferred to and processed in the US. By using Achiote, you consent to this transfer. We rely on Standard Contractual Clauses or equivalent safeguards where required.

Security

Use HTTPS, keep API keys private, and do not paste secrets into food-memory prompts. If you believe you found a vulnerability, follow the process in Support or the repository security policy.