1. About This Policy and Our Company

Lively Graphics, LLC ("Company," "we," "us," or "our") operates the Calimento mobile application, store, and website, including all related information, content, features, tools, products, and services (collectively, the "Services"). Calimento is a curated recipe management, meal planning, and shopping application powered in part by the Shopify e-commerce platform.

This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use the Services or otherwise communicate with us. If there is a conflict between our Terms of Use and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

This Privacy Policy is designed to comply with applicable law, including but not limited to: Apple's App Store Review Guidelines, the Washington My Health MY Data Act (RCW 70.372), the Washington Consumer Protection Act (RCW 19.86), the California Consumer Privacy Act (CCPA/CPRA), and the federal Children's Online Privacy Protection Act (COPPA).

2. Personal Information We Collect

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. We may collect or process the following categories of personal information depending on how you interact with the Services:

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third Parties

We may also receive personal information from the following sources:

• Shopify: As our e-commerce platform provider, Shopify collects and shares transaction and account data with us as described in Section 9 below.
• Anthropic, PBC: When you use our AI Vision feature, images you submit are processed by Anthropic. We receive back the extracted text content. See Section 5 for full AI processing disclosures.
• Business and marketing partners: We may receive data about you from advertising and analytics partners we work with.
• Social login providers: If you choose to log in using a third-party social account (e.g., Apple ID, Google), we receive your name and email address from that provider, subject to your settings with them.

3. How We Use Your Personal Information

Depending on how you interact with us or which Services you use, we may use your personal information for the following purposes:

3.1 Providing and Improving the Services

We use your personal information to provide you with the Services, including to: perform our contract with you; process your payments and fulfill orders; remember your preferences and items you are interested in; send account-related notifications; process purchases, returns, exchanges, or other transactions; create and manage your account; arrange for shipping; facilitate returns and exchanges; enable recipe creation and meal planning features; and create a customized experience for you, such as recommending products or recipes related to your activity.

3.2 Marketing and Advertising

We use your personal information for marketing and promotional purposes, such as to send marketing, advertising, and promotional communications by email, text message, or postal mail, and to show you online advertisements for products or services on the Services or other websites, including based on items you have previously purchased or added to your cart. You may opt out of marketing communications at any time as described in Section 12.

3.3 Security and Fraud Prevention

We use your personal information to authenticate your account, provide a secure payment and shopping experience, detect and investigate possible fraudulent or malicious activity, protect public safety, and secure our services. You are responsible for keeping your account credentials confidential.

3.4 Communicating With You

We use your personal information to provide customer support, respond to inquiries, and maintain our business relationship with you.

3.5 Legal Compliance

We use your personal information to comply with applicable law, respond to valid legal process (including requests from law enforcement or government agencies), participate in civil discovery or litigation, and enforce or investigate potential violations of our terms or policies.

3.6 User-Generated Content Processing

When you submit UGC to the App — including recipe text, ingredient lists, cooking instructions, photographs, and images of recipe cards — we process that content to provide the core functionality of the App (organizing your recipe collection, generating meal plans, and populating your grocery lists). Images you upload for the AI Vision scanner are transmitted to Anthropic for text extraction as described in Section 5. We do not use your UGC to train our own AI models without your separate, affirmative consent.

The App also allows you to generate a formatted PDF of your grocery list that includes your first name and a "Powered by Calimento.io" brand banner. The generation of this PDF is processed within the App and the resulting file is stored temporarily on your device. See Section 3.7 below for important disclosures about how sharing this PDF affects your personal information.

3.7 Share Grocery List PDF Feature

Calimento allows you to share your grocery list as a branded PDF document via the iOS Share Sheet. This feature enables you to send the PDF through any channel available on your iOS device, including but not limited to: AirDrop, Messages, Mail, Save to Files, and AirPrint. The PDF document includes your first name in the document title and the "Powered by Calimento.io" brand banner.

User-Initiated Sharing — Your Control and Responsibility: When you share a grocery list PDF via the iOS Share Sheet, you are making a voluntary, user-initiated decision to transfer that document — and the personal information it contains — to a channel, device, or recipient outside of Calimento's infrastructure. Once the PDF leaves the App via the Share Sheet, it is entirely outside the control of Lively Graphics, LLC. We cannot retrieve, delete, or control the subsequent handling of that document by its recipient(s), the recipient's device, or any intermediate service (such as an email provider or messaging platform).

No Transmission by Lively Graphics, LLC: The PDF sharing feature operates entirely through Apple's native iOS Share Sheet. Lively Graphics, LLC does not transmit, receive, copy, or store the shared PDF. We do not have visibility into which sharing channel you select, who you share the PDF with, or how the recipient handles the document. Your decision to share is between you and the destination channel.

Health Data Caution: If your grocery list includes items that could identify or be linked to a health condition — such as specialty dietary products, medical foods, or allergen-restricted items — that information will be present in the PDF you share. Please review the Washington My Health MY Data Act disclosures in Section 4 of this Policy and exercise caution when sharing PDFs containing health-related grocery items, as shared documents fall outside our ability to protect or delete.

Brand Disclaimer: The "Powered by Calimento.io" banner appearing on shared grocery list PDFs is a trademark attribution notice. Its presence on a shared document does not constitute any warranty, representation, or endorsement by Lively Graphics, LLC of the document's contents or of any use made of the document after sharing. Lively Graphics, LLC is not responsible for any use of shared PDFs by recipients.

4. Washington My Health MY Data Act Disclosures

4.1 What Constitutes Consumer Health Data in Calimento

Under the MHMDA, "consumer health data" is defined broadly to include personal information that is linked or reasonably linkable to a consumer and that identifies a consumer's past, present, or future physical or mental health status. In the context of Calimento, this may include:

• Dietary restrictions, food allergies, and medical dietary requirements you enter into the App (e.g., gluten-free, diabetic, low-sodium, allergen-free);
• Meal plans or recipe collections that reflect or could be inferred to reflect a health condition;
• Purchase history for specialty health or dietary products; and
• Any other information in the App that you associate with a health or medical condition.

4.2 How We Collect and Use Consumer Health Data

We collect consumer health data that you voluntarily provide to us when you use the meal planning and dietary preference features of the App. We use this data solely to provide, personalize, and improve the App's functionality for you. We do not sell consumer health data to third parties, and we do not use consumer health data for advertising targeting purposes.

4.3 Sharing of Consumer Health Data

We share consumer health data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Shopify: As our e-commerce infrastructure provider, Shopify may process consumer health data as part of our transaction and account management services. Shopify is bound by contractual obligations consistent with applicable law.
• Anthropic (AI Vision): Images you submit through the AI Vision scanner that contain health-related recipe information are processed by Anthropic solely for text extraction. Anthropic is prohibited from using this data for its own training or other independent purposes under our agreement.
• Legal compliance: We may disclose consumer health data if required by law, court order, or valid legal process.

We do not sell, share for targeted advertising purposes, or otherwise disclose consumer health data to any other third party without your express, affirmative consent.

4.4 Your Rights Under the MHMDA

If you are a Washington State resident, you have the following rights with respect to your consumer health data:

• Right to Confirm and Access: You may request confirmation of whether we collect, share, or sell your consumer health data, and to access a list of all third parties with whom we have shared or sold your consumer health data.
• Right to Withdraw Consent: Where we rely on your consent to collect consumer health data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to Delete: You may request deletion of your consumer health data. We will honor this request unless we are required by law to retain the data or have another overriding legal basis.
• Right to Appeal: If we decline to take action on your request, you may appeal our decision by contacting us as described in Section 14.

To exercise any MHMDA rights, please contact us at admin@livelygraphics.com with the subject line "MHMDA Rights Request." We will respond within 45 days as required by law, with the possibility of a 45-day extension for complex requests.

Non-Discrimination: We will not discriminate against you for exercising your MHMDA rights. We will not deny you Services, charge different prices, or provide a different quality of service because you exercised your rights under this law.

5. AI Features and Third-Party Data Processing

5.1 AI Vision Recipe Scanner

Calimento includes an artificial intelligence feature called "AI Vision", which allows you to photograph or upload images of physical recipe cards, handwritten notes, cookbook pages, or other documents. The AI Vision scanner uses machine learning optical character recognition (OCR) technology to extract and structure recipe text from your images.

5.2 Data Transmission to Anthropic, PBC

When you use the AI Vision feature, the following data processing occurs:

• The image you submit is transmitted over an encrypted internet connection to servers operated by Anthropic, PBC ("Anthropic"), an artificial intelligence company headquartered in San Francisco, California.
• Anthropic's AI models analyze the image to identify and extract textual content (ingredients, instructions, measurements, and recipe metadata).
• The extracted text is returned to Calimento and stored in your recipe collection.
• The original image may be temporarily retained by Anthropic for the duration of the processing request, subject to Anthropic's data retention practices. Lively Graphics, LLC does not control Anthropic's data handling, retention, or security practices.

By using the AI Vision feature, you consent to this data transmission and processing. You should not submit images that contain sensitive personal information such as medical records, government identification, financial account data, or other confidential information unrelated to recipes.

To review Anthropic's data practices, please visit: https://www.anthropic.com/legal/privacy

5.3 Other AI-Powered Features

The App may include additional AI-powered features such as personalized recipe recommendations, ingredient substitution suggestions, or nutritional estimates. These features may process your recipe collection data and usage patterns locally within the App or through additional third-party AI services. We will update this Privacy Policy and provide in-App notice before introducing new AI data processing activities.

5.4 No Sale of AI-Processed Data

We do not sell the content of images you submit through the AI Vision scanner, the text extracted from those images, or any other data processed by our AI features to any third party for advertising, data brokerage, or any other commercial purpose.

6. iOS Device Permissions and Apple Privacy Features

6.1 Device Permissions We Request

Calimento requests access to the following device capabilities on your iOS device. We request each permission only when the relevant feature is first used, and we explain the reason at the time of each prompt. You may grant or deny each permission, and you can change permissions at any time in your device Settings.

6.2 App Tracking Transparency (ATT)

Apple's App Tracking Transparency framework requires us to obtain your permission before we track you across apps or websites owned by other companies for advertising purposes. When you first launch Calimento, you will receive a system prompt asking whether you consent to tracking.

• If you allow tracking, we may use your Apple Identifier for Advertisers (IDFA) to deliver more relevant advertising and measure the effectiveness of advertising campaigns across other apps and websites.
• If you ask the App not to track, we will not access your IDFA for advertising purposes, and we will limit data sharing with advertising partners accordingly. Core App functionality is not affected by your choice.

You may change your tracking preference at any time by navigating to Settings > Privacy & Security > Tracking on your iOS device.

6.3 "Sign in with Apple"

If you choose to sign in to Calimento using "Sign in with Apple," Apple will authenticate your identity and share your name and email address (or a private relay email address) with us. We will use this information solely to create and manage your Calimento account. Please review Apple's Privacy Policy at https://www.apple.com/legal/privacy for details on how Apple handles your data during this process.

7. Cookies and Tracking Technologies

We and our service providers (including Shopify and advertising partners) use cookies, pixel tags, web beacons, and similar tracking technologies on our website and within the App to collect information about your interactions with the Services.

7.1 Types of Cookies We Use

• Strictly necessary cookies: Required for the Services to function (e.g., maintaining your shopping session, authenticating your account). These cannot be disabled.
• Preference cookies: Remember your settings and preferences (e.g., language, dietary filters, display settings).
• Analytics cookies: Help us understand how visitors use our website (e.g., page views, session duration, navigation paths). We use this information to improve the Services.
• Marketing cookies: Used to deliver relevant advertisements and track campaign effectiveness. These are only placed with your consent or as permitted by applicable law.

7.2 "Do Not Track" Signals

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is currently no industry-wide standard for how to respond to DNT signals, our website does not currently alter its data collection practices in response to DNT signals. We will revisit this position if and when a universally accepted standard is adopted.

8. How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• Service providers: With vendors and other third parties who perform services on our behalf (e.g., IT management, payment processing, data analytics, customer support, cloud storage, fulfillment, and shipping).
• Anthropic (AI processing): Images you submit through the AI Vision scanner are transmitted to Anthropic solely to provide the text extraction service, as described in Section 5.
• Business and marketing partners: To provide marketing services and personalized advertising. Our partners will use your information in accordance with their own privacy notices. You may have the right to opt out of this sharing as described in Section 12.
• At your direction: When you direct, request, or consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations.
• Corporate affiliates: Within our corporate group or with affiliated entities, in a manner consistent with this Privacy Policy.
• Business transactions: In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to commitments of confidentiality.
• Legal compliance: To comply with applicable legal obligations, respond to subpoenas, search warrants, and similar legal requests, enforce our Terms of Use, or protect the safety of our users or others.

9. Relationship with Shopify

The e-commerce Services are hosted by Shopify, Inc. ("Shopify"), which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services. Information you submit to the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services.

To help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is an independent data controller responsible for the processing of your personal information, including for responding to your requests to exercise your privacy rights.

To learn more about how Shopify uses your personal information and your rights with respect to Shopify's processing, please visit the Shopify Consumer Privacy Policy at https://www.shopify.com/legal/privacy.

10. Third-Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites.

Information you provide on public or semi-public venues, including information you share on third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

11. Children's Data

The Services are not intended to be used by children under the age of 13, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). Users between the ages of 13 and 17 should use the Services only with the involvement and consent of a parent or legal guardian.

If you are the parent or guardian of a child who has provided us with their personal information without your consent, please contact us at admin@livelygraphics.com, and we will take prompt steps to delete that information from our systems.

As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

12. Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. These rights are not absolute, may apply only in certain circumstances, and in certain cases we may decline your request as permitted by applicable law.

12.1 General Privacy Rights (All Users)

• Right to Access / Know: You may request access to personal information that we hold about you.
• Right to Delete: You may request deletion of personal information we maintain about you.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right of Portability: You may request a copy of your personal information in a portable format, and in certain circumstances, request that we transfer it to a third party.
• Right to Opt Out of Sale or Sharing for Targeted Advertising: You may have the right to opt out of the "sale" or "sharing" of your personal information for targeted advertising purposes.

12.2 California Residents — CCPA/CPRA Rights

If you are a California resident, you have the rights described above plus the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Limit Use of Sensitive Personal Information: You may direct us to limit our use of sensitive personal information (including account credentials, precise geolocation, and health-related data) to purposes necessary to perform the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
• Shine the Light: California Civil Code Section 1798.83 allows you to request information regarding disclosure of your personal information to third parties for their direct marketing purposes during the preceding calendar year.

To submit a CCPA/CPRA request, please contact us at admin@livelygraphics.com. We will verify your identity before processing your request.

12.3 Washington State Residents — MHMDA Rights

Washington State residents have additional rights with respect to consumer health data as described in Section 4 of this Privacy Policy.

12.4 Managing Communication Preferences

We may send you promotional emails, and you may opt out of receiving them at any time by using the unsubscribe link in any marketing email or by contacting us at admin@livelygraphics.com. If you opt out, we may still send you non-promotional messages, such as those about your account or orders you have placed.

To manage push notification preferences, navigate to Settings > Notifications > Calimento on your iOS device.

13. Security, Retention, and Account Deletion

13.1 Security Measures

We implement commercially reasonable administrative, technical, and physical security measures designed to protect the personal information we maintain about you. These measures include encryption of data in transit (TLS/SSL), access controls, and regular security assessments. However, no security measures are perfect or impenetrable, and we cannot guarantee absolute security. We recommend that you use strong, unique passwords and do not use unsecured channels to communicate sensitive information to us.

13.2 Data Retention

How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide you with Services, to comply with legal obligations, to resolve disputes, or to enforce applicable contracts and policies. We retain transaction records for the period required by applicable tax and financial regulations, and we retain account data for as long as your account is active plus a reasonable period thereafter to facilitate account reinstatement requests.

13.3 Account Deletion

You may request deletion of your account and all associated personal data at any time through the in-App Settings menu or by contacting us at admin@livelygraphics.com. Executing account deletion triggers a permanent, cascading wipe across our databases and cloud storage, irrevocably deleting your saved recipes, meal plans, grocery lists, account profile, and uploaded images. Note that:

• We may retain certain information for the period required by applicable law (e.g., transaction records for tax purposes) even after account deletion;
• Deletion of your Calimento account does not automatically cancel any active subscription — you must cancel your subscription separately through your Apple Account Settings (see our Terms of Use, Section 4.4); and
• Data previously shared with or processed by Anthropic is subject to Anthropic's own data retention and deletion practices.

14. International Transfers

We are based in King County, Washington, United States. Your personal information may be transferred to, stored, or processed in countries other than the country in which you reside, including the United States. These countries may have data protection laws that are different from — and in some cases less protective than — the laws of your country.

If we transfer your personal information out of the European Economic Area (EEA) or the United Kingdom, we will rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on our website and within the App, update the "Last Updated" date, and provide notice as required by applicable law. For material changes — particularly changes that affect how we handle consumer health data, AI processing, or your privacy rights — we will provide more prominent notice (such as an in-App notification or email) and, where required, seek your fresh consent.

Your continued use of the Services following notice of changes constitutes your acceptance of the revised Privacy Policy.

16. Contact Information

If you have any questions, concerns, or complaints about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us at:

We will respond to privacy rights requests within the timeframe required by applicable law. For MHMDA requests, we will respond within 45 days, with the possibility of a 45-day extension for complex requests. For CCPA/CPRA requests, we will respond within 45 days, with the possibility of a 90-day extension.