CERO Mobile Application — Privacy Policy
‍
This Privacy Policy applies specifically to the CERO — Sustainable Lifestyle mobile application (the "App") published by VEKIN ("we," "us," or "our"). It explains what information the App collects, how we use it, who we share it with, and the choices and rights available to you.
This policy governs the CERO mobile application only. Information collected through the VEKIN website and our enterprise services — including DEMP, DAP, AI Carbon Auditor, Carbon Receipt, and our Validation and Verification Services — is governed by the [VEKIN Privacy Policy] (https://vekin.tech/privacy-policy).
‍
By downloading, installing, or using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not access or use our Services.
---
1. Information We Collect
1.1 Account Information
When you create an account, we collect your email address and password (stored only as a salted hash on our servers), together with your acceptance of our terms and your optional choices to receive news and to share data.
Your profile may additionally hold information you choose to add or update: your name (in English and Thai), title, phone number, profile photo, and your CERO referral code.
If you sign in with a third-party provider — Google, Apple, LINE, or Microsoft — we receive an identity token from that provider and the basic profile information attached to it, typically your email address and name. We never receive your password with that provider. If you use Sign in with Apple and choose to hide your email, we only ever see Apple's private relay address.
The App does not ask for identity documents, payment card details, or financial account information.
1.2 Device and Diagnostic Information
We automatically receive limited technical information when the App communicates with our servers, including device model, operating system version, App version, and language and region settings. Apple and Google may also provide us with aggregated crash and performance reports through App Store Connect and Google Play Console.
The App contains no advertising SDK and no third-party analytics SDK.
1.3 Health and Fitness Data
With your explicit consent, the App reads health and fitness data from your device — on Android devices through Health Connect by Android, and on iOS devices through Apple Health (HealthKit).
On both platforms we read your steps, your walking and running distance, your active calories burned, your exercise and workout sessions, your heart rate, and your resting heart rate. On iOS we additionally read your Apple exercise time, your Apple stand time, and your VO₂ max, which appear in your health summary in the App.
We request no other health permission, and we read no other health data type.
We only read. The App never writes, modifies, or deletes anything in Health Connect or Apple Health. No write permission is requested and no write is ever performed.
We use this data solely to show you your own activity inside the App:
- Today's summary — your steps, distance, and active calories for the day.- Workout history and workout detail — your past workouts with their duration, pace splits, heart rate and resting heart rate figures, and, where the workout itself recorded one, its route drawn on a map.- Exercise log — daily and range trends built from your steps, distance, and calories.- CO₂ insights — an estimate of the emissions avoided by walking, running, or cycling instead of travelling by car, derived from your distance.- Events and challenges you choose to join — your step, distance, and calorie totals for the event period, used to rank you on that event's leaderboard. The leaderboard shows standings and step counts only; it does not display your name or any other personal detail (see Section 4.1).
Health and fitness data is read only after you grant permission, and only for as long as that permission remains granted. You may grant or revoke it at any time:
- Android: through the Health Connect app, or via Settings → Apps → CERO → Permissions.- iOS: through Settings → Health → Data Access & Devices → CERO.
Revoking permission stops all further reading immediately and does not prevent you from using the rest of the App. Features that depend on this data will simply show no data.
1.4 Sustainability and Activity Data
The App generates and stores information derived from your use of it: your food scans and their results, the events and challenges you have joined, and the totals you have submitted to those events.
1.5 Food Scan Photos
If you use the food scan feature, the photo you take or select is uploaded to our servers and analysed to estimate the dish, its nutrition, and its carbon footprint. The photo and the resulting estimate are stored against your account so they can appear in your food history. This requires camera and photo library permission, which you grant when you first use the feature and can revoke at any time in your device settings.
You can delete any food scan from your food history at any time, which removes that entry and its photo from our servers. Deleting your account removes all of them.
1.6 Location
The App does not collect your device location. It does not track you, in the foreground or the background.
Where a workout map is shown, the route drawn on it comes from the route already stored inside that workout by Apple Health or Health Connect, and is rendered on your device. If your device asks for location permission while a map is on screen, that position is used only to show where you are on that map while it is open; it is not stored by us and never leaves your device.
1.7 Notifications
The daily reminder is a local notification: it is scheduled and delivered entirely by your own device, and neither its schedule nor the reminder itself passes through our servers. The App sends no remote push notifications and registers no push token. You are in control of the reminder — turn it off, or change the time it arrives, at any time under Profile → Preferences → Daily reminder and Reminder time. You can also disable notifications entirely in your device settings.
---
2. How We Use Your Information
- Providing the App: To operate the features you use — your activity summaries, workout history, exercise log, CO₂ insights, food scans, and the events and challenges you join.- Account management: To create and maintain your account, authenticate you, and provide customer support.- Improvement and diagnostics: To diagnose technical problems and improve the App's performance and usability.- Communications: To send you service-related messages, and — only where you have opted in — updates about new features or programmes.- Security and integrity: To detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms.- Legal compliance: To comply with applicable laws and regulatory obligations.
Restrictions on the use of health and fitness data
Health and fitness data read through Health Connect or Apple Health is used only for the features listed in Section 1.3. Specifically:
- We do not write health or fitness data back to Health Connect or Apple Health.- We do not use health or fitness data for advertising or marketing.- We do not use health or fitness data for profiling or use-based data mining.- We do not sell health or fitness data, and we do not share it with data brokers or advertising networks.- We do not use health or fitness data to determine eligibility for insurance, credit, employment, or any similar decision.- We do not transfer health or fitness data to any third party for that party's own purposes.
Our handling of this data complies with the Google Play Health Connect by Android Permissions policy, the Google Play User Data policy, and Apple's HealthKit requirements under App Store Review Guideline 5.1.3.
---
3. Legal Bases for Processing
Where data protection law applies to you, we rely on the following legal bases:
- Consent: For access to health and fitness data, for camera and photo library access, and for optional marketing communications. You may withdraw consent at any time.- Contractual necessity: To provide the App and the services you have signed up for.- Legitimate interests: For security, fraud prevention, and improving the App, where these interests are not overridden by your rights.- Legal obligation: Where processing is required to comply with applicable laws, regulations, or accreditation standards.
Health and fitness data is treated as sensitive personal data. We process it only on the basis of your explicit consent, and only for the purposes stated in Section 1.3.
---
4. Disclosure of Your Information
4.1 Health and Fitness Data
We do not disclose health or fitness data to any third party. It is not shared with service providers, affiliates, partners, accreditation or regulatory bodies, advertisers, analytics providers, or any other recipient, except where disclosure is strictly required by law or valid legal process.
Almost everything the App reads from Health Connect or Apple Health is used on your device and is never transmitted to us. There is one exception, and you choose it: events and challenges. When you join an event, the App sends your total steps, total distance, and total calories for that event's period to our servers so you can be ranked on that event's leaderboard. The leaderboard is anonymous to other participants — it shows standings and step counts, not names or personal details. Nothing else is sent: no individual workouts, no heart rate, no routes, no raw samples. If you join no events, no health-derived figure ever leaves your device.
Health and fitness data will not be transferred as part of any merger, acquisition, or sale of assets without your separate, explicit consent obtained at that time.
4.2 Other Information
We may share other categories of information with:
- Service providers: Vendors who host our infrastructure and support our services, including our cloud hosting provider and the service that analyses food scan photos. These providers are contractually bound to process the data only as necessary to provide their services to us, and may not use it for their own purposes.- Identity providers: Google, Apple, LINE, and Microsoft, where you choose to sign in with them. We share only what is needed to complete sign-in; their handling of your data is governed by their own privacy policies.- Legal compliance and protection: Where required by law, regulation, or valid legal process, or where necessary to protect our rights, our users, or the public.- Corporate transactions: In connection with a merger, acquisition, or sale of assets, subject to the exception for health and fitness data in Section 4.1.
We do not sell personal information.
---
5. Data Storage and Security
Health and fitness data is read on demand and used on your device. We keep no copy of your health readings on our servers, other than the per-event step, distance, and calorie totals described in Section 4.1.
All communication between the App and our servers uses HTTPS/TLS; released builds do not permit unencrypted connections. Your session credentials are held in your device's hardware-backed secure storage (iOS Keychain / Android Keystore).
VEKIN maintains certified management systems including ISO 9001, ISO 14001, ISO 14065, ISO/IEC 17029, ISO/IEC 27001, and ISO/IEC 29110. We apply technical, physical, and administrative safeguards designed to protect personal information against unauthorised access, disclosure, alteration, and destruction, including encryption in transit, access controls, and logging. No security measure is completely effective, and we cannot guarantee absolute security.
---
6. Data Retention and Deletion
We retain personal information only for as long as necessary for the purposes described in this policy, and for as long as required to meet legal and regulatory obligations.
- Health readings on your device are not retained by us at all — each screen reads what it needs from Health Connect or Apple Health at the moment you open it.- Event step, distance, and calorie totals are retained for the duration of the event and for as long as your account exists, so that leaderboards and your history stay accurate.- Food scan photos and results are retained until you delete the entry from your food history, or until you delete your account.
You can delete your account at any time from Profile → Danger zone → Delete account in the App. Deleting your account removes it together with your events, workouts, food history, and CO₂ history within 15 days. You can also request deletion by contacting us at contact@vekin.tech.
Revoking Health Connect or Apple Health permission stops all further reading immediately. Because we hold no copy of your health readings, there is nothing further to delete on our side except any event totals you have already submitted — those are removed when you delete your account, or on request.
---
7. International Data Transfers
Our infrastructure is operated in Thailand. We may store and process information in countries other than the one in which it was collected. Where required by applicable law, such transfers are covered by appropriate safeguards, such as standard contractual clauses or other lawful measures, to ensure an adequate level of data protection.
---
8. Your Rights and Choices
Depending on your jurisdiction, you may have the right to:
- Access the personal information we hold about you.- Correct inaccurate or incomplete information.- Delete your personal information.- Object to or restrict certain processing.- Data portability — receive your information in a portable format.- Withdraw consent at any time, where processing is based on consent.- Lodge a complaint with your local data protection authority. In Thailand, this is the Personal Data Protection Committee (PDPC).
For health and fitness data, you can withdraw consent directly in your device settings, and delete everything held against your account from within the App, without needing to contact us. For all other requests, contact us at contact@vekin.tech. We will respond within the timeframe required by applicable law.
---
9. Third-Party Services
The App integrates with the following third-party services:
- Health Connect by Android (Google) — reading health and fitness data on Android devices.- Apple Health / HealthKit (Apple) — reading health and fitness data on iOS devices.- Google Sign-In, Sign in with Apple, LINE Login, and Microsoft identity platform — optional sign-in.- Apple Maps — rendering the workout route map on iOS.
Health Connect and Apple Health are provided by Google and Apple respectively and are governed by their own privacy policies. Our use of data obtained through them is limited as described in Section 2.
---
10. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material — particularly any change to the health and fitness data types we access or the purposes for which we use them — we will notify you in the App and, where required, obtain your consent again before the change takes effect.
---
11. Contact Us
For questions about this policy or to exercise your rights:
VEKIN Email: contact@vekin.techWebsite: [vekin.tech](https://vekin.tech)
---
By using the CERO mobile application, you acknowledge that you have read and understood this Privacy Policy.