Privacy Policy & Data Protection
Last updated: September 2, 2026 • Governed under the Digital Personal Data Protection Act 2023 (India)
1. Data Fiduciary & Commitment
Amino AI (operated by Katori AI, "we", "us", or "our") functions as a Data Fiduciary under the Digital Personal Data Protection Act 2023 (DPDP Act). We are committed to processing your digital personal data lawfully, transparently, and with strict purpose limitation.
2. Personal Data Collected & Purpose
Name and email address retrieved via Google Sign-In (OAuth). Used exclusively for authentication, account management, and critical security notices. We never receive or store your Google password.
Age, gender, height, weight, activity level, dietary preference, and daily nutritional goals. Used solely to compute your personalized daily protein targets and 9 essential amino acid (EAA) reference requirements based on WHO/FAO and ICMR-NIN guidelines.
Logged dishes, portion amounts, custom recipes, and meal photos scanned via camera. Photos are processed in-memory for vision AI dish identification and are immediately discarded (never stored permanently on server disks or public storage).
3. Children's Data Policy (18+ Mandatory)
In accordance with Section 9 of the DPDP Act 2023, Amino AI is intended exclusively for adults aged 18 and above. We do not knowingly collect personal data, perform tracking, or profile individuals under 18. Any account discovered to belong to a minor without verifiable parental or guardian consent will be immediately terminated and all associated data permanently erased.
4. Your Statutory Rights (Data Principal Rights)
- Right to Information & Access: You can view your full data graph and export a complete structured JSON copy anytime from your Profile settings.
- Right to Correction: You can edit or update your name, username, health stats, and past food logs directly within the app without contacting support.
- Right to Erasure (Account Deletion): You can permanently delete your account and all associated personal data from
Profile → Account & Security. Deletion cascades across all tables and immediately revokes all authentication tokens. - Right to Nominate (DPDP Section 14): You have the legal right to nominate another individual to exercise your data rights in the event of death or incapacity. To register or exercise a nomination claim, email our Grievance Officer with identity verification.
5. Third-Party Subprocessors & Cross-Border Transfers
We only share data with vetted cloud infrastructure providers necessary to deliver the service, under strict Data Processing Agreements (DPAs):
| Data Processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Encrypted Postgres database & auth engine | USA |
| Google LLC | Google OAuth identity & Gemini Vision AI | USA |
| Vercel Inc. | Edge application hosting & serverless compute | USA |
We do not transfer digital personal data to any country restricted by the Central Government of India.
6. Grievance Redressal Mechanism (DPDP Act Section 8)
In accordance with Section 8 and Section 13 of the DPDP Act 2023, we have appointed a designated Grievance Officer to address data rights requests, nominee claims, consent withdrawals, and privacy complaints:
Designated Grievance Officer: Arya Aayush
Designation: Data Protection & Grievance Officer
Email Contact: arya.aayush04@gmail.com
Direct Address: Katori AI / Amino AI, India
Statutory SLA: Formal acknowledgment within 48 hours • Complete resolution within 30 days
How to Submit a Claim or Grievance:
- Grievance / Dispute: Email the Grievance Officer with subject line
[DPDP Grievance] Your Name / Registered Emaildescribing the issue. - Nominee Rights Claim: If a registered user is deceased or incapacitated, the verified nominee may email
[DPDP Nominee Claim]accompanied by legal proof (death certificate or certified medical power of attorney) and government photo ID. - Consent Withdrawal: Self-serve in your Profile settings under
Account & Security → Consent Management, or email the Grievance Officer directly.
If your grievance is not acknowledged within 48 hours or satisfactorily resolved within 30 days, you hold the statutory right under DPDP Act Section 13 to escalate your complaint to the Data Protection Board of India (DPB) at dpdp.gov.in.