Privacy Policy

• Initial Publication (Version 1.0): This is the official launch version of the legal documents for the Sesame application.
• Original Compliance Framework: This document establishes our rigorous data protection standards from day one (specifically in compliance with GDPR, CCPA, and COPPA).
• No Retroactive Changes: Since this is the initial release, no changes have been made to your rights or to the way we safeguard your privacy.

1. PREAMBLE AND TRUST COMMITMENT

The protection of your privacy and the security of your data are absolute priorities for MidBox Technologies Inc. ("MidBox", "we", "us", "our", the "Company"). In connection with the operation of the Sesame mobile application ("the Application"), we are committed to managing your personal information with the utmost transparency and in compliance with the strictest legislative standards.

This Privacy Policy comprehensively describes how we collect, use, store, and share your information. It has been specifically drafted to comply with the requirements of:

• Quebec's Law 25 (Act to modernize legislative provisions as regards the protection of personal information);
• The General Data Protection Regulation (GDPR—Regulation EU 2016/679);
• The United States' Children's Online Privacy Protection Act (COPPA).

By installing and using the Sesame Application, you acknowledge that you have read and accepted the practices described in this document.

2. PERSON IN CHARGE OF THE PROTECTION OF PERSONAL INFORMATION

In accordance with Law 25, we have designated a Person in Charge of the Protection of Personal Information (Privacy Officer / Data Protection Officer) within our organization. This person is responsible for ensuring compliance with the legislation and handling your requests.

For any questions regarding this policy, to exercise your rights, or to file a complaint, you may contact:

Privacy Officer:
Title: Director of Data Compliance
Email Address: privacy@midboxtech.com
Mailing Address: 6300 avenue Auteuil, Suite 505-147, Brossard (Quebec) J4Z 3P2

3. COLLECTED DATA AND COLLECTION METHODS

We apply the principle of data minimization, collecting only what is strictly necessary for the proper functioning of the Application and the improvement of our services.

3.1 Data you provide directly to us

This data is collected when you create an account or interact with the Application.

• Account Information (Essential): Email address, encrypted password, and username. This data is necessary for the performance of the user agreement and to secure your access via our authentication services (Firebase).
• User Content: Recipe texts, ingredient lists, personal notes, and photos of dishes that you upload or create in the Application.
• Nutritional Goals and Recipe Importation: The Application acts as a smart recipe book. Sesame does not generate recipes autonomously, but only imports and structures the recipes that you expressly identify and submit. If you choose to set personal nutritional goals (caloric or macronutrient targets), you consent to us using this data to analyze the recipes you have imported. Sesame does not manage any dietary restrictions, specific diets, or allergies. The Application is not a medical device, does not provide any diagnosis or weight monitoring, and the data entered into it does not under any circumstances constitute a medical record.
• Data Imported via Third-Party Links (Automated Extraction): When you use the Application to import recipe instructions from an external hyperlink (e.g. social networks) via our automated extraction tools and services, you warrant that you have the legal right to access this content and import it for your personal use. The Application acts solely as an automated technical intermediary that extracts and formats public text at your express request. We disclaim all liability regarding any copyright violations or violations of third-party platform terms of use resulting from the links you choose to submit.
• Support Communications: The content of your exchanges with our customer service or your bug reports.
• Private Silos and Household Data Isolation: Although the Application offers a multi-member Household structure, Sesame guarantees the absolute segregation of your health and nutrition data. Your meal logs and biometric data are strictly personal and are never shared, visible, or accessible to other members of your Household.
• Health Access Activation Lock: Access to the nutritional tracking module under a member's profile is protected by an activation lock. For adult members, this lock is deactivated after age confirmation (via self-declaration or system API). For minors under 14 years of age, this lock can only be deactivated by the voluntary and express action of the household owner (parent or legal guardian), serving as proof of formal parental consent to the use of this service.

3.2 Data collected automatically

This data is collected via cookies, pixels, and SDKs (software development kits) integrated into the Application.

• Technical Data: IP address, device model, operating system version, unique device identifier (UUID), language, time zone. (Legal basis: Legitimate interest for security and compatibility).
• Analytical Data: Diagnostic and performance data (collected via Firebase and Crashlytics) are aggregated and are not persistently linked to your personal identity or name. They serve solely to resolve technical bugs and measure the effectiveness of the Application, without any tracking or marketing purposes.
• Transactional Data: Subscription history, renewal dates, and receipt validation tokens (Receipt Tokens). This data is collected via our partner RevenueCat.
• Important Note: MidBox never collects, processes, or stores your complete banking information (credit card numbers). All financial transactions are processed exclusively and securely by the Apple App Store or the Google Play Store.
• Geotargeting and Local Legal Notices: To present you with the sanitary compliance and privacy legal notices adapted to your jurisdiction (Law 25 in Quebec, COPPA/CCPA in the United States, GDPR in Europe), the Application only detects the language and time zone settings of your device (e.g. America/Montreal). Sesame does not collect, transmit, or use any precise GPS geolocation data.

3.3 Data imported via third-party links

When you use the Application to import a recipe from an external hyperlink, we use an automated tool to extract and format the text at your request. This extracted information is processed and stored solely for the purpose of being added to your private recipe book.

3.4 Use of sensors and local device processing

• Barcode Scanner: The Application includes a barcode scanning feature to identify food products. This recognition is performed locally, directly on your mobile device, using the MLKit SDK. The real-time video stream and images captured by your device's camera to decode the barcode are never transmitted to our servers or to any external third party. Only the extracted numerical code is used to search for the product's nutritional information.
• Nutritional Reminders and Local Notifications: Meal logging reminders and nutritional goals are configured by you and scheduled autonomously by your mobile device's operating system (local notifications). No data regarding your meal times, reminder habits, or notification scheduling preferences transits through third-party or external push servers.

4. ARTIFICIAL INTELLIGENCE AND TRANSPARENCY (LAW 25 / GOOGLE VERTEX AI)

The Sesame Application integrates advanced generative artificial intelligence features to help you structure your recipes, generate images, or suggest ingredients. These services are provided by Google Cloud Vertex AI (Gemini models).

4.1 Transparency, Consent, and Culinary Assistant (AI)

In accordance with Law 25 (Quebec) and transparency principles:

• The Application integrates an interactive Culinary Assistant powered by Google Cloud's artificial intelligence models (Vertex AI). By using this assistant to ask questions about your recipes, request ingredient substitutions, or ask for preparation advice, you consent to the content of your query being transmitted to this third-party service.

4.2 Protection of your data in AI ("No Training" guarantee)

We understand your concerns regarding the use of your data to train public AI models.

• No-Training Commitment: We use the "Enterprise" version of Google Vertex AI. Under the applicable terms of service, Google contractually commits not to use your data (prompts, recipes, photos) to train its generative foundation models.
• Isolation: Your data is processed in a secure and isolated environment. It is used solely to generate the specific response to your request, and is then removed from the active processing context. It does not enrich a knowledge base shared with other users or with Google.
• Ephemeral Image Processing by AI: Photos you upload specifically for the automatic nutritional analysis of your meals are converted into a secure text format (Base64) and transmitted to the Google Vertex AI API for real-time processing. These images are processed in a strictly ephemeral manner: they are never saved on Sesame's persistent hosting servers, are not associated with your database profile, and the image state is immediately cleared from the local mobile application once the analysis is completed.

4.3 Algorithmic recommendations and automated processing

Recipe suggestions provided by the Application (for example, recommending a recipe from your own catalog that you have not cooked recently) are based on the analysis of your usage history. In accordance with Law 25, we inform you that these automated suggestions are intended solely to facilitate the management of your culinary notebook. They do not constitute profiling for advertising purposes and do not lead to any automated decision producing legal effects or significantly affecting you. You remain the sole decision-maker regarding whether to follow or ignore these recommendations.

5. SHARING AND INTERNATIONAL DATA TRANSFERS

We never sell, rent, or market your personal data to third parties for advertising purposes. We share your data only with technical processors necessary to provide the service.

5.1 Our certified processors

To ensure the operation of Sesame, we use the services of third-party providers located in the United States.

5.2 Legal framework for transfers (Data Privacy Framework)

Your data is transferred to and processed on servers located in the United States.

• EU and Swiss Users: These transfers are covered by the European Commission's adequacy decision (July 10, 2023) regarding the EU-U.S. Data Privacy Framework. Our providers (Google LLC and RevenueCat) are certified under this framework, guaranteeing a level of data protection substantially equivalent to that of the European Union.
• Quebec and Canadian Users: In accordance with Law 25, we have conducted a Privacy Impact Assessment (PIA—a rigorous risk analysis) before authorizing these transfers.

6. YOUR RIGHTS AND CONTROL OVER YOUR DATA

You have extensive rights regarding your data, which we commit to respecting regardless of your place of residence.

6.1 List of your rights

• Right of Access: You can request a copy of the data we hold about you.
• Right to Rectification: You can correct inaccurate information directly in the Application or by contacting us.
• Right to Erasure and Deletion: You can require the permanent deletion of your account and associated data from our databases. (Note: The right to de-indexing provided by Law 25 does not apply to our service, as the Sesame Application is a private environment that does not publish any of your personal information on public search engines).
• Right to Withdraw Consent: You can withdraw your consent to the processing of specific data (e.g. notifications, health data) at any time.
• Right to Restriction of Processing and to Object: You can request to restrict the processing of your data or object to certain uses.
• Control of Hardware and System Permissions: You can at any time authorize, modify, or revoke the Application's access to your mobile device's sensors and features (such as the camera for barcode scanning or access to the Apple Health and Google Health Connect health platforms). The Application integrates a direct redirection button to the system settings of your operating system (iOS/Android) in the Settings screen to facilitate the withdrawal of your hardware consents at any time.

6.2 Right to Data Portability (New—Law 25 & GDPR)

Since September 2024, Law 25 (just like the GDPR) grants you the right to data portability. This means that you can request to receive the computerized personal information you have provided to us in a structured, commonly used technological format (such as JSON or CSV).

• This right is intended to allow you to reuse your data or transfer it to another service provider.
• To exercise this right, you can use the self-service backup export feature available directly in the Settings screen of the Application. This allows you to instantly download a secure file containing all of your meal logs and nutritional consumption. If you wish to obtain an export of additional data or if you encounter any difficulties, you may also contact our Privacy Officer, who will process your request within 30 days.

6.3 Right to erasure (Right to be forgotten) and revocation

Upon permanent account deletion, all of your data (profile, nutritional history, local and cloud biometric data, media files in Storage, and RevenueCat billing profile) are permanently and irreversibly erased from our servers within 30 days. To satisfy our regulatory obligations to retain proof of consent (required by Law 25 and the GDPR), your history of legal notice acceptance is archived anonymously. This archiving uses a one-way cryptographic hash (SHA-256) of your email address, ensuring that no personally identifying data or data allowing you to be identified directly or indirectly is retained in our compliance records.

"Sign in with Apple" Users: In accordance with App Store guidelines, deleting your account from within the Application will also trigger a call to the Apple API (Sign in with Apple REST API) in order to immediately and permanently revoke the user token associated with your Sesame account. We thus sever any technical link between your Apple ID and our system.

In the event of a technical failure during the automatic revocation of the token by our servers, the Application will inform you and invite you to manually disconnect this link.

For any other request (portability, complex access, or if you no longer have access to the Application), contact us at privacy@midboxtech.com.

7. SECURITY AND DATA RETENTION

7.1 Security

Although no computer system can guarantee absolute security, we implement reasonable technical and organizational measures, adapted to the nature of the data processed, to protect your information. This includes using recognized cloud infrastructure providers (Google Cloud) that ensure the encryption of your data in transit (TLS) and at rest. We limit access to our databases to only those technical necessities related to the maintenance and improvement of the service.

Exclusively Local Biometric Storage and Obfuscation Measures: Your biometric data (such as weight, height, age, gender, and body fat percentage) is recorded exclusively locally on your mobile device and is never transmitted, synchronized, or stored on Sesame's Cloud servers. We apply local technical obfuscation measures (XOR encoding) to prevent direct plain-text access to these files by third parties. These technical measures constitute local protection and not strong cryptographic encryption. We recommend securing physical and logical access to your mobile device (lock code, biometrics) to preserve the confidentiality of this information.

7.2 Retention

We only retain your data for as long as necessary for the purposes for which it was collected.

• Active Account: Data is retained as long as the account is active.
• Inactive Account: If no activity is detected on your account for a period of 24 months, we will send you a notification. In the absence of a response, your personal data will be permanently deleted or irreversibly anonymized.
• Technical Data: Server logs and raw analytical data are retained for a maximum period of 14 months.

8. PROTECTION OF CHILDREN AND MINORS (LAW 25 / COPPA / GDPR)

8.1 Age gate and automatic blocking for nutritional calculations: By default, access to personalized nutritional calculation and biometric tracking features is strictly prohibited for individuals under 14 years of age to comply with Law 25 (Quebec) and the GDPR. When creating a profile or accessing these services, the Application queries the device's native age verification system (API DeclaredAgeRange under iOS 26.0+ or Android equivalent) or presents an age self-declaration questionnaire. If the user is identified as being under 14 years of age, access to these personalized features is automatically blocked, except in the case of express parental consent (see section 8.4).

8.2 Processing of data from adolescents (ages 14 to 17 inclusive)—Young Audience Mode: If a user is identified as a minor aged 14 to 17 inclusive, the Application automatically switches to "Young Audience Mode". In this mode, in order to prevent eating disorders (EDs) and limit focus on caloric intake among adolescents:

• Only dietary protein tracking remains active and visible in the Application's interface. Targets for calories, carbohydrates, lipids, and fibers are forced to zero and permanently hidden.
• All meal data and biometric information are stored exclusively locally on the user's device under local obfuscation. No health or meal data related to this age group is recorded, saved, or synchronized on our Cloud servers (Firestore) or our production databases.

8.3 Transitional data migration upon change in age status: In the event of a change in the user's age status (for example, reaching the age of majority at 18 or a corrective modification of the profile):

• Reaching the Age of Majority (Adult Mode): The nutritional and biometric data stored locally on the device are automatically and securely migrated to our Cloud Firestore database to enable full tracking of calories and macronutriments. Once the migration is confirmed, the device's temporary local files are cleared.
• Reclassification as a Minor (Minor Mode): Data previously stored on Cloud Firestore is immediately transferred back to the user's device in local obfuscated form, followed by a permanent, irreversible, and complete purge of the corresponding Firestore collections on our cloud servers, ensuring that no health data of the minor remains online.

8.4 Parental consent for minors under 14 years of age within the Household: Activating personalized nutritional tracking for a household member under 14 years of age requires the explicit authorization of the household owner (parent or legal guardian). The latter can grant this authorization via the parental consent modal integrated into the Application. By this action, the legal guardian formally consents to the local processing of their nutritional and biometric data, as well as the cloud storage of basic profile data (identifier, email address, household link) essential for linking and managing the Household, under their exclusive responsibility and in derogation of the strict blocking by default.

8.5 Specific provisions for the protection of children and minors (Law 25 / COPPA / GDPR)

• Regional Eligibility Thresholds: The Sesame Application is not intended for use without parental consent by children under 13 in the United States (under COPPA), under 14 in Quebec and Canada (under Law 25), or under 13 to 16 in the European Union (depending on the digital age of majority threshold set by the national legislation of each Member State under the GDPR).
• Limitation of Collection: Apart from the "Young Audience Mode" feature reserved for adolescents aged 14 to 17 (whose data is processed 100% locally on the device, see section 8.2) and profiles of minors under 14 who have received the express and verified parental consent of the household owner (see section 8.4), we do not knowingly collect personal information from minors.
• Corrective Measure: If we learn or have reason to believe that an account has been created by a minor in violation of these regional age limits and without the required parental consent ("actual knowledge" standard), we will immediately delete that account and all associated data from our active databases and local storage systems. If you are a parent or legal guardian and suspect that your minor child under 14 (or under 13 in the United States) is using the Application without your authorization, please contact us immediately at privacy@midboxtech.com.

9. CHANGES TO THE POLICY

We may update this policy to reflect technological, legal, or commercial developments. In the event of a material change (for example, a change in the purposes of using AI or the addition of a new major processor), we will inform you via a visible notification in the Application or by email, at least 15 days before the new terms come into effect. Continued use of the Application after this period will constitute acceptance.

10. MEDICAL LIABILITY LIMITATION CLAUSE:

The Sesame Application is a culinary and general wellness tool, designed to help you store, organize, and analyze cooking recipes. It under no circumstances constitutes a medical device and must not be used to diagnose, treat, cure, or prevent medical conditions or diseases (such as diabetes or clinical obesity). The information displayed in the Application does not constitute professional health advice. Furthermore, Sesame does not manage or support the tracking of food allergies, severe intolerances, or medically prescribed dietary restrictions. It is your sole responsibility to validate the safety and harmlessness of the ingredients consumed. Use of the data provided by Sesame is at your own risk.