Privacy Policy

Rita Kalnina, a UK sole trader trading as WithRita, is responsible for your personal information. Use the email or postal address shown on this page for privacy questions.

WithRita accounts and paid services are for adults aged 18 or over. Services will initially be offered in the United Kingdom and Latvia.

The information we need depends on what you choose. Required fields are marked on the form; without them we cannot provide that feature or service.

We use information to set up your account, take an order and supply your chosen service under our contract with you or to take steps you request before that contract. We rely on legitimate interests for security and proportionate service monitoring, and on legal obligations for payment and tax records. Optional news uses consent, which you can withdraw.

WithRita does not ask for medical information in general forms. Nutrition features are educational support, not diagnosis or treatment. If sensitive information is genuinely required for an individual service, we will explain why and ask for separate consent first.

WithRita does not make decisions based solely on automated processing that have legal or similarly significant effects on you. AI output is supporting information; Rita or you make the final decision for an individual service.

Style photos, PDFs and other personal material saved to your account are private. They are available only to you, Rita and the technical providers needed to run the feature. We do not use them in advertising without separate permission.

A meal or fridge photo is sent to OpenAI only to perform the analysis you request, using store: false, and is not saved to your WithRita account. OpenAI does not use API content to train models by default, although input may remain in standard safety logs for up to 30 days. AI can be wrong, so do not rely on it alone for medical or other important decisions.

‘My real week’ saves only your structured choices against the WithRita references — not meal photos, audio or free-text descriptions.

You enter card details in Stripe’s payment environment. WithRita receives only the information needed to manage payment and access, not your full card number or CVC.

Resend delivers account, password, payment and service emails. If you press a WhatsApp button, you open a conversation outside WithRita. The website does not receive or store the chat; WhatsApp/Meta processes it in its own service.

If you choose marketing emails, each one will include a way to unsubscribe. Essential account and purchase messages do not depend on marketing consent.

We do not sell your data. It is available to Rita and, only as needed, Railway (website, database and private storage), OpenAI (selected AI features), Stripe (payments), Resend (email), and Meta/WhatsApp when you choose WhatsApp. We may also disclose information where the law requires it.

Some providers operate outside the UK or European Economic Area. Where required, we use the applicable adequacy decision or contractual transfer safeguards. Ask us by email if you would like more detail.

We delete or anonymise information when it is no longer needed. Our main periods are:

• meal and fridge analysis photos — not stored by WithRita;
• ‘My real week’ choices — 30 days after that week ends;
• an unfinished or unpaid application — 30 days;
• private content for a completed one-off service — 90 days after completion;
• personal subscription content — during access and for 30 days afterwards;
• four-week plan intake and PDFs — during the service and access period, then for 30 more days;
• WhatsApp Business chats — during the personal conversation and for 30 days after the service ends, unless you continue the conversation or longer retention is needed for a dispute or legal obligation; chats are not copied into the WithRita website;
• an account with no active service or sign-in — 12 months; we send a warning 30 days before deletion;
• security and error logs — 30 days; user-level AI cost records — 90 days;
• payment and tax records — at least five years after the relevant UK tax return deadline, or longer if law requires;
• deleted data in backups — no more than 90 days after deletion from the live system.

Depending on the legal basis, you may ask for access, correction, deletion, restriction, portability, object to processing, or withdraw consent. You can always object to direct marketing.

You can create a data copy and request account deletion in your profile, or email us. We may verify your identity first. We will usually respond within one month.

You may complain to the UK Information Commissioner’s Office (ICO), Latvia’s Data State Inspectorate, or the data protection authority in your EEA country.

We currently use only technologies needed for security, sign-in and remembering language or market choice. Analytics and advertising cookies are off. If that changes, we will ask before using optional cookies.

We will update this policy if the service or our use of information changes. The current date and version will always appear above, and we will give active clients reasonable notice of a significant change.

If you would like a more detailed explanation about a particular use of your information, email us. We will explain it in plain language and address your situation.