PRIVACY POLICY

Zestro - Parallax Labs LLC

Effective Date: September 6, 2026

This Privacy Policy explains how Parallax Labs LLC ("we", "us", or "our") collects, uses, discloses, retains, and deletes information when you use the Zestro mobile application, visit our website, or contact us about Zestro (together, the "Service").

If you have questions about this policy, contact us at: privacy@tryzestro.com

1. Who We Are

Parallax Labs LLC is a limited liability company registered in the State of New Mexico, United States. We develop and operate Zestro, an AI-powered voice cooking companion.

2. Information We Collect

2.1 Information You Provide

Account information: Your name, email address, authentication provider, and account identifiers when you create or use an account through email, Google, or Apple where available.

Dietary and cooking profile: Information you choose to add about health conditions, food allergies, dietary preferences, fitness goals, cuisine preferences, cooking skill, available equipment, ingredients, and budget.

Cooking content: Meal requests, recipe prompts, generated meals and recipes, saved recipes, cookbook entries, cooking-session progress, ratings, feedback, and other information you provide while using the Service.

Voice and conversation information: Voice audio you transmit during a live cooking session, transcripts of what you say, responses generated during the session, and relevant recipe, dietary, and cooking context. Zestro transmits live audio to Google Gemini for real-time processing. Zestro does not intentionally store the raw audio recording, but may store transcripts and cooking-session records. Google may process or retain information in accordance with its applicable terms and data-processing commitments; we do not promise that a provider immediately deletes all voice data after processing.

Meal photos: Finished-meal photos you select or capture, along with transformed versions and image URLs produced when you use the meal-photo feature.

Communications: Information included in emails, support requests, privacy requests, and account-deletion requests. If you join the website launch list, we receive your email address and selected mobile platform.

2.2 Information Collected Through the Service

Notification information: Expo push-notification tokens, notification preferences, delivery status, and information needed to schedule or cancel cooking notifications.

Subscription information: Your Zestro user UUID, store, product identifiers, purchase and renewal events, subscription status, expiration information, cancellation status, and entitlement status. We do not receive or store your full card number or store-account payment credentials.

Technical and security information: Device type, operating system, IP address, API request metadata, timestamps, error information, and application or security logs generated when your device communicates with our backend. We use this information to deliver, secure, troubleshoot, and prevent misuse of the Service.

3. How We Use Information

We use information to:

• Create, authenticate, support, and delete Zestro accounts.
• Personalise meal suggestions and recipes around the profile, ingredients, restrictions, preferences, and goals you provide.
• Provide live voice-assisted cooking, generate transcripts and responses, and maintain cooking-session context.
• Generate recipe imagery and transform user-submitted finished-meal photos.
• Save recipes, cookbook entries, session history, meal photos, and preferences at your direction.
• Manage the seven-day app-managed trial and determine access to guided cooking features.
• Display, verify, and restore subscription entitlements and respond to purchase events.
• Register push tokens and deliver notifications you enable.
• Operate, secure, debug, and improve the Service and prevent fraud or abuse.
• Respond to support, privacy, and legal requests and send service-related communications.
• Comply with law and enforce our Terms of Service.

We do not sell personal information or use health, dietary, voice, or meal-photo information for third-party advertising.

4. Service Providers and Data Disclosures

We disclose information to service providers only as needed to operate the Service, support requested features, protect Zestro, or comply with law. These providers process information under their own applicable terms and privacy commitments.

Supabase: Provides authentication and identity services. Supabase receives information such as your email address, authentication details, and Supabase user ID.

Cloudflare: Hosts the application backend and API traffic and provides Workers, D1 database records, image storage, security tooling, and the public account-deletion flow. Cloudflare may process account IDs, profile and cooking records, saved content, images, IP addresses, request metadata, and deletion requests.

Google Gemini: Provides live AI voice and cooking assistance. Gemini receives live voice audio, transcripts or conversation turns, and the recipe, dietary, and cooking context needed to respond during a session.

RevenueCat: Manages subscription status and feature entitlements. RevenueCat receives your Zestro user UUID, store and product identifiers, purchase events, subscription status, and entitlement information. RevenueCat does not process your card payment.

Google Play and Apple: Google Play processes Android subscription payments, renewals, cancellations, and refunds. Apple will perform the equivalent role for iOS purchases when Zestro becomes available on iOS. The applicable store receives payment and transaction information under its own terms. Zestro receives purchase and subscription-status information rather than your full payment credentials.

Expo: Supports push-token registration and notification delivery. Expo receives the push token and notification payload needed to deliver notifications you enable.

fal.ai: Processes a finished-meal photo you submit and the transformation instructions needed to create an enhanced version. fal.ai receives the submitted image and returns a transformed image or image URL.

Runware: Generates recipe imagery. Runware receives recipe descriptions or image prompts derived from a recipe. These prompts may reflect meal characteristics or preferences but are not intended to include your direct account credentials.

We may also disclose information when required by law, to protect the rights and safety of users or others, or as part of a merger, acquisition, financing, or transfer of the Service, subject to appropriate notice and safeguards where required.

5. Health and Dietary Information

Dietary conditions, allergies, and related health information may be sensitive personal information. Providing this profile information is optional, but some personalised recommendations may be less useful if you do not provide it. We use it to provide the meal personalisation and cooking guidance you request, not to diagnose, treat, or provide medical advice.

We process this information to provide the personalisation and cooking features you request. Depending on the applicable law, our legal basis may include providing the Service you requested and, for health information, explicit consent where it has been validly obtained. This Privacy Policy does not itself constitute consent or replace any separate in-app disclosure and affirmative consent required by law. Where processing relies on consent, you may withdraw it through available profile or account controls or by contacting us. Withdrawing or deleting information may limit personalised features.

Always verify ingredients and labels yourself and consult a qualified healthcare professional or registered dietitian for medical dietary decisions.

6. Data Retention

We keep personal information only for as long as needed for the purposes described in this policy, to provide the Service, and to satisfy legitimate security, dispute, accounting, or legal requirements. Our usual retention approach is:

Account and profile information: Retained while your account is active. Following a verified account-deletion request, information under Zestro's control is scheduled for deletion and the request is completed within 30 days, unless limited information must be retained for a legal or security reason.

Recipes, cookbook records, transcripts, and cooking sessions: Retained while associated with your active account or until you delete the relevant content where that control is available. Associated records under Zestro's control are deleted as part of account deletion within the period described above.

Meal photos and transformed images: Retained when needed to provide the photo feature or display a saved cooking record. Images stored by Zestro are deleted with the associated account or record, subject to the deletion period above. Temporary copies may remain in provider caches or backups until overwritten under the provider's retention process.

Push tokens and notification preferences: Retained until the token is replaced or invalidated, you disable the relevant notification functionality, or your account is deleted.

Subscription and entitlement records: Retained while needed to provide and verify subscription access and resolve billing or entitlement issues. Zestro deletes its associated account and RevenueCat customer record as part of account deletion, but Google Play, Apple, and other payment-related providers may retain transaction records when required for accounting, fraud prevention, dispute resolution, or law.

Application and security logs: Normally retained for no more than 30 days and then deleted or overwritten. Specific records may be retained longer when reasonably necessary to investigate a security incident, prevent fraud or abuse, resolve a dispute, or comply with law.

De-identified or aggregated information that can no longer reasonably identify you may be retained for product and operational analysis.

7. Account Deletion and Your Choices

You can request account deletion through the App or through our public Zestro account deletion page. You may also contact privacy@tryzestro.com. We may ask you to verify ownership before completing a request.

Deleting your Zestro account removes associated information under Zestro's control, including your profile, dietary preferences, cooking history, saved recipes, stored transcripts, stored finished-meal photos, notification token, and Zestro subscription record, subject to the retention exceptions described above.

Deleting your Zestro account does not cancel an active Google Play or Apple subscription. You must manage or cancel the subscription separately through the store account used to make the purchase. Store and payment-related providers may retain transaction records as required by law or their applicable policies.

8. Your Privacy Rights

Depending on where you live, you may have rights to:

• Access personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated information.
• Receive certain information in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing relies on consent, without affecting earlier lawful processing.
• Appeal a refusal of a privacy request where local law provides that right.
• Lodge a complaint with your local data-protection authority.

California residents may also have rights to know, correct, or delete personal information and to opt out of its sale or sharing as defined by applicable law. Zestro does not sell personal information or share it for cross-context behavioural advertising.

To exercise a right, contact privacy@tryzestro.com. We may need to verify your identity and may retain a record of the request where legally permitted or required.

9. Data Security

We use technical and organisational safeguards designed to protect personal information, including encrypted network transport, authentication controls, and restrictions on access to production systems and provider credentials. No system is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

Zestro is not directed to children under 13, and users must be at least 13 years old. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact privacy@tryzestro.com so we can investigate and delete it where required.

11. International Data Transfers

Parallax Labs LLC is based in the United States, and our providers may process information in the United States and other countries. Where required, we use appropriate safeguards for international transfers and require information to be handled in accordance with applicable data-protection law.

12. Third-Party Links and Store Services

The Service may link to third-party websites, app stores, or services. Their privacy practices are governed by their own policies, and we encourage you to review them. Purchases, renewals, cancellations, and refunds processed by Google Play or Apple are also subject to the applicable store's terms and privacy policy.

13. Changes to This Policy

We may update this Privacy Policy as our products, providers, or legal obligations change. When changes are material, we will provide notice through the App, by email, or through another appropriate channel. The effective date at the top identifies the current version.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us:

Parallax Labs LLC

Email: privacy@tryzestro.com

State of Incorporation: New Mexico, United States

This Privacy Policy was last updated on September 6, 2026.