Is there a Cal AI alternative built in Europe with GDPR hosting?

Less than the acronym suggests, and more than people assume. GDPR applies to any app offered to people in the EU, including US ones. So "GDPR-compliant" does not mean "servers in Europe". It means a legal basis for each processing step, processor agreements with every vendor, a lawful transfer mechanism for data leaving the EU, and your right to access and delete. Food and body data count as health data under Article 9, which requires explicit consent.

The question that really separates apps is therefore: where does the data live, which company is responsible, and which services receive what? An app can be formally compliant and still send every photo to five US vendors. That is why the section below lists Kairo's actual vendors rather than the word "compliant".

The database and login run on Supabase in an EU region; row-level security policies ensure each user can only reach their own rows, and a processor agreement under Article 28 is in place. The controller is Centaurio UG (haftungsbeschränkt) in Hofheim am Taunus, registered at the Frankfurt commercial register. Sign-in is via Apple or Google; we store no passwords.

For photo analysis the image is sent to the Google Gemini API. Because we use the paid tier, Google does not use your data for training; it is retained for at most 30 days for abuse monitoring, and Google is certified under the EU-US Data Privacy Framework. For nutrition lookups on branded products and restaurant dishes, only the recognised product name goes to a US search service under standard contractual clauses; no image, no user identifier. Analytics run on PostHog's EU hosting, crash reports on Sentry's EU processing. All of it, with legal bases, is in our privacy policy.

Cal AI has belonged to MyFitnessPal, Inc. of San Francisco since a deal that closed in December 2025 (per TechCrunch); its listing makes no EU-hosting statement, and Apple's privacy label lists data used to track you across apps. MyFitnessPal itself is a US company with no EU-hosting statement. Yazio is YAZIO GmbH of Erfurt, Germany, majority-owned by France's Groupe SEB since 2023. It is an EU company, which is why "built in Europe" is not a Kairo-only claim; the product difference is that Yazio is a database logger with photo as a PRO feature, while Kairo is photo-first.

These are listing facts, not a legal assessment. All three offer their apps in the EU and are bound by GDPR. If you want your health data handled by an EU company on EU infrastructure, Kairo and Yazio are the two verifiable candidates on this page; for the Cal AI ownership story itself, our Cal AI alternative page covers the acquisition and the April 2026 App Store removal with sources.

First: where is the database that holds my meals? Second: which AI analyses my photos, and are they used for training? Third: which other services receive what (analytics, subscription management, attribution)? Fourth: can I delete my account and data myself, and what happens to the photos? If a privacy policy leaves one of these unanswered, that is the answer.

For Kairo: EU region; Gemini paid API without training; the full vendor list is public in the policy; and you delete your account inside the app, which removes profile, meals and photos. What we do not claim is that we use no US services at all: Apple, Google, the search service and the subscription service are US-based, with transfers covered by DPF certification or standard contractual clauses, and the policy says exactly that.

Because access matters, not just location. A database in Frankfurt that any support employee can open with a service key protects less than one where per-user access rules are enforced by the database itself. Kairo uses such row-level security policies; even the connection to AI assistants (ChatGPT, Claude) runs on your own login token under the same rules, with no master key. See calorie tracking with ChatGPT and Claude. Location is the precondition; architecture is the protection.