How we handle your data.
Quietly, carefully, and with very little of it.
Last updated: 20 April 2026
We collect the minimum we can reasonably get by with: your email if you join the waitlist, and whatever you tell us if you contact us. When the iOS app launches we'll add your nutrition logs and body metrics to that list. We don't sell your data, we don't run ads, and we don't share anything with third parties except the handful of services that actually run the app.
1. Who we are
BugarAI is operated by DonpiConsulting FZCO, a free-zone company registered in Dubai, United Arab Emirates. For the purposes of the EU General Data Protection Regulation (GDPR) and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), DonpiConsulting FZCO is the data controller of the personal data described in this policy.
You can reach us at info@donpicon.com for any privacy-related question or request.
2. What we collect, and when
Today, bugarai.com is a landing page with a waitlist and a contact form. That's it. The iOS app — described below — is in invitation-only beta and is not yet distributed on the App Store.
On the landing page (right now)
| What | When |
|---|---|
| Email address | When you submit the waitlist form at the top or bottom of bugarai.com. |
| Name, email, and message | When you submit the contact form at the bottom of bugarai.com. |
| Server access logs (IP address, user-agent, request path, timestamp) | Automatically, on every HTTP request. Kept for up to 30 days for security, abuse prevention, and debugging. Not used to profile you. |
In the iOS app (invitation-only beta)
If and when you accept an invitation and install BugarAI on your iPhone, we also process:
- Account information — your email, display name, and a hashed password. Never the password itself.
- Nutrition profile — the daily targets you set (calories, protein, carbs, fat), your meal schedule, and any dietary preferences.
- Meal logs and custom foods — what you log, when, at which restaurant, and the macros we compute for it.
- Body metrics — weight, body-composition measurements you enter, and any historical data you import.
- Supplement logs and hydration, if you choose to track them.
- AI conversation content — when you ask BugarAI for a meal suggestion or a weekly review, the prompt and the relevant context are sent to our AI provider (see §4).
We do not ask for location, contacts, photos, health-app data, or any information beyond what is strictly needed to run the feature you're using.
3. Why we process it
- Waitlist email — to notify you when an invitation becomes available. That's the only reason.
- Contact-form submissions — to reply to your message.
- Access logs — to keep the service running, prevent abuse, and diagnose issues.
- App data — to provide the features of the app: tracking, budgeting, variety analysis, AI suggestions, and history.
We do not profile you, target you with advertising, or share your data with data brokers. We do not, and will not, sell your personal data.
4. Who we share it with
We share personal data only with the service providers we rely on to actually run the app. Each one is contractually bound to process data only on our instructions.
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Cloud hosting, database, file storage. | EU (primary) |
| Anthropic (Claude) | AI meal suggestions and weekly reviews. Receives prompts and relevant context only when you use an AI feature. | United States |
| Apple (TestFlight) | iOS beta distribution. Apple receives your Apple-ID email if you accept an invitation. | Apple global infrastructure |
We will update this list before adding any new third party that processes your personal data.
5. Legal bases (for EU / EEA / UK users)
- Consent (Art. 6(1)(a) GDPR) — joining the waitlist and creating an app account.
- Contract (Art. 6(1)(b) GDPR) — providing the app once you've accepted an invitation and signed in.
- Legitimate interests (Art. 6(1)(f) GDPR) — keeping the service secure, preventing abuse, short-term access logs.
6. International transfers
Because we operate from the UAE, rely on EU hosting, and call an AI provider based in the United States, your personal data will be transferred across borders. For transfers from the EU/EEA/UK we rely on Standard Contractual Clauses (or the UK International Data Transfer Agreement / Addendum) together with our providers' published transfer mechanisms. You can request a copy of the relevant clauses by emailing us.
7. How long we keep it
| Data | Retention |
|---|---|
| Waitlist email | Until BugarAI is discontinued or you ask us to delete it, whichever is sooner. |
| Contact-form messages | Up to 12 months, then deleted. |
| Server access logs | Up to 30 days. |
| App account and logs | Until you delete your account, at which point everything is deleted within 30 days. Backups are purged on a 90-day cycle. |
8. Your rights
Depending on where you live, you have some or all of the following rights:
- Access — get a copy of the data we hold about you.
- Rectification — correct anything that's wrong.
- Erasure — have your data deleted.
- Portability — receive your data in a machine-readable format (CSV or JSON).
- Restriction and objection — ask us to pause or stop certain processing.
- Withdraw consent — at any time, without affecting past processing.
- Lodge a complaint — with a data-protection supervisory authority. In the UAE that's the UAE Data Office. In the EU it's the authority of your country of residence.
To exercise any of these rights, email info@donpicon.com. We'll respond within 30 days.
9. Children
BugarAI is not intended for people under 16 years old. We do not knowingly collect data from anyone younger. If you believe a child has given us personal data, email us and we'll delete it.
10. Security
We use TLS (HTTPS) everywhere, encrypt data at rest on our primary database, limit access to production systems to named administrators, and never store passwords in plain text. No system is perfect; we notify affected users without undue delay if we discover a breach that affects their data.
11. Changes to this policy
If we make material changes, we'll update the "Last updated" date at the top of this page and — for anyone with an app account — send an in-app notice before the changes take effect. The current version is always the one at bugarai.com/privacy.
12. Contact
DonpiConsulting FZCO
Dubai, United Arab Emirates
info@donpicon.com