Legal, Terms & Privacy

I. Definitions

Terms used throughout this Framework.

• "Account" means the registered profile you create to access a Service.
• "User Content" means anything you submit through the Services, including meal logs, protein targets, biometric values you enter, notes, photos submitted for analysis, feedback, and support messages.
• "Personal Data" has the meaning given under applicable data-protection law (including the EU/UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and comparable US state privacy laws).
• "Sub-processor" means a third-party vendor that processes Personal Data on our behalf. Our current sub-processors are listed in Section VII.
• "AI Output" means any recommendation, score, insight, summary, or other content generated by automated systems (including Large Language Models) in the Services.

II. Eligibility & Age

Kanso is offered only to adults. The Services are not intended for anyone under 18, and we do not knowingly collect Personal Data from people under 18.

A. Minimum age (18+)

You must be at least 18 years old to create an Account or use any Service. Kanso asks for a declared age (a whole number, not a birthday) in profile settings; we validate that field on the server and do not accept values below 18. If the law of your country, state, or region requires an older minimum age to enter into contracts like this Framework or to consent to the processing of health-related Personal Data through an app like Kanso, you must meet that higher age. By using the Services you represent that you meet the applicable minimum age.

B. Children under 13

The Services are not directed to children under 13, and we do not knowingly collect Personal Data from children under 13. If you are under 13, do not register an Account and do not submit any information to the Services. If we learn that we have collected Personal Data from a child under 13 without verifiable parental consent, we will delete that information.

C. No use by anyone under 18

No individual under the age of 18 may create an Account, use the Services, or provide us with Personal Data. We use reasonable age-related checks and technical safeguards designed to block under-18 registration. If we become aware that someone under 18 has created an Account or submitted Personal Data, we will investigate and, where appropriate, delete the Account and associated Personal Data. Parents and guardians who believe a minor has provided Personal Data may contact legal@ensolabs.cc.

III. Medical & AI Disclaimer

Every Enso Labs product is covered under one parent legal framework designed to protect users and Enso Labs LLC.

All Services are operated by Enso Labs LLC, a Texas entity.

Enso Labs applications and Services are wellness, productivity, and self-tracking tools and are not medical devices. They do not provide medical advice, diagnosis, treatment, cure, or prevention of any disease or condition, and they are not a substitute for professional medical, nutritional, psychological, pharmaceutical, or fitness advice. Always seek the advice of a qualified health provider with any questions you may have regarding a medical condition, medication regimen, pregnancy, nutritional strategy, or exercise program.

A. AI Output is informational only

The Services use automated systems, including Large Language Models ("LLMs"), to produce analyses, summaries, and suggestions. LLMs are known to occasionally generate inaccurate, incomplete, stale, or "hallucinated" outputs. AI Output is informational only. You are solely responsible for verifying every AI Output before acting on it.

Do not make medical, nutrition, allergen, insulin, medication, hydration, pregnancy, pediatric, legal, tax, or financial decisions based solely on AI Output. To the fullest extent permitted by law, Enso Labs LLC disclaims all liability for losses, injuries, claims, damages, or adverse outcomes arising from reliance on AI Output.

B. Third-party data sources

Kanso references nutrient data from third-party sources such as the USDA FoodData Central. These datasets are provided "as is" by the underlying publishers. We do not warrant that any third-party dataset is complete, current, or accurate for your specific food item, preparation, portion, or individual physiology. Verify critical values (for example, allergens, carbohydrate content for insulin dosing, or nutrients relevant to a medical condition) against an authoritative source before relying on them.

IV. Terms of Service

By using any Enso Labs service, you agree that Texas law controls, Harris County courts are the exclusive venue, disputes stay individual (no class actions), and AI output must be independently verified.

By creating an Account, accessing, or using any Service, you agree to this Framework. If you do not agree, do not use the Services.

A. Account and security

• You are responsible for the accuracy of your Account information and for keeping your credentials confidential.
• You are responsible for all activity that occurs under your Account. Notify us at support@ensolabs.cc if you suspect unauthorized access.
• We may suspend or terminate an Account that violates this Framework, creates security or legal risk, or is inactive for an extended period, at our reasonable discretion.

B. Acceptable use

You will not, and will not attempt to:

• Use the Services to violate any law, infringe any right, or harm any person, including by harassment, doxxing, or promoting self-harm.
• Reverse engineer, decompile, or attempt to extract source code or model weights from the Services, except where such activity is permitted by applicable law (e.g. interoperability rights) and cannot be waived by contract.
• Probe, scan, overload, or disrupt the Services; circumvent rate limits; or use automated tools or scraping to access data not made available to you.
• Upload malware, harmful code, or content that infringes intellectual property, privacy, or publicity rights.
• Use AI Output to produce medical, clinical, or diagnostic advice for third parties, or to train a competing machine-learning model.
• Resell, sublicense, or commercially exploit the Services without our prior written consent.

C. License we grant you

Subject to this Framework, Enso Labs grants you a limited, personal, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Services for your own non-commercial, personal wellness purposes. No rights are granted by implication, estoppel, or otherwise. All rights not expressly granted are reserved.

D. User Content and license you grant us

You retain ownership of your User Content. You grant Enso Labs a worldwide, royalty-free, non-exclusive license to host, copy, process, transmit, display, and create derivative works of your User Content solely to operate, secure, support, and improve the Services for you. We do not claim ownership of your User Content and we do not use it to train third-party AI models (see Section V). This license ends when you delete the relevant User Content or your Account, subject to reasonable retention for backups, audit, or legal compliance.

E. Feedback

If you submit suggestions, feature requests, or other feedback, you grant Enso Labs a perpetual, irrevocable, worldwide, royalty-free license to use that feedback for any purpose without obligation to you.

F. Paid tiers and payments

The Services are currently offered free of charge. If we introduce paid tiers, subscriptions will be processed by Stripe, Inc. We do not store complete payment card numbers. Pricing, billing cycles, free trials, refunds, and cancellation terms will be presented at checkout and become part of this Framework for subscribing users. Involuntary churn (expired cards, failed charges) may result in feature downgrade until payment is restored.

G. Service changes and availability

We are actively developing the Services. Features may be added, modified, deprecated, or discontinued. We do not warrant that the Services will be uninterrupted, error-free, secure against every attack, or continuously available. Scheduled and unscheduled downtime will occur.

H. Warranty disclaimer

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES AND ALL AI OUTPUT ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, AND QUIET ENJOYMENT. ENSO LABS DOES NOT WARRANT THAT THE SERVICES WILL MEET YOUR REQUIREMENTS, PRODUCE SPECIFIC OUTCOMES, OR OPERATE WITHOUT INTERRUPTION OR ERROR.

I. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, ENSO LABS LLC AND ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, LICENSORS, AND ASSIGNS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, LOSS OF GOODWILL, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATING TO THIS FRAMEWORK OR THE SERVICES, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

IN ALL CASES, OUR AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS FRAMEWORK OR THE SERVICES WILL NOT EXCEED THE GREATER OF (i) THE AMOUNTS YOU PAID TO ENSO LABS FOR THE SERVICES IN THE TWELVE MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO LIABILITY, OR (ii) USD $100. Some jurisdictions do not allow the exclusion or limitation of certain damages; in those jurisdictions, our liability is limited to the smallest amount permitted by law.

J. Indemnification

You will defend, indemnify, and hold harmless Enso Labs LLC and its present and future parent entities, affiliates, subsidiaries, officers, directors, employees, contractors, licensors, successors, and assigns from and against all third-party claims, liabilities, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or related to (a) your misuse of the Services, (b) your violation of this Framework, (c) your User Content, or (d) your violation of any law or third-party right.

K. Governing law and venue

This Framework and any dispute, claim, or controversy arising out of or relating to this Framework or the Services (whether in contract, tort, statute, or otherwise) are governed by the laws of the State of Texas, without regard to conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Any legal action or proceeding must be brought exclusively in the state or federal courts located in Harris County, Texas, and you consent to the personal jurisdiction and venue of those courts. This venue clause does not prevent consumers from bringing claims in the competent courts of their country of residence where such right is granted by mandatory local law.

L. Class-action waiver

To the fullest extent permitted by law, all disputes must be brought only on an individual basis. You and Enso Labs LLC each waive any right to participate as a plaintiff, class member, or representative in any purported class action, collective action, private attorney general action, or class-wide arbitration.

M. Termination

You may stop using the Services and delete your Account at any time. We may suspend or terminate your access at our reasonable discretion if you breach this Framework or create risk to the Services or other users. Upon termination, Sections III, IV.D (License you grant us, for the limited retention windows described), IV.H–L, and V–XI survive.

V. Privacy Policy

We only collect what is needed to run the Services. Meal photos are not retained in our app database, and data sent to AI providers is configured for no model training.

This section is our Privacy Policy. It explains what Personal Data we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. Enso Labs LLC is the data controller for Personal Data processed through the Services, except where we act as a processor on behalf of a business customer under a separate data-processing agreement.

A. What we collect

• Account data: email address, password hash, display name, locale, and optional profile fields you provide.
• User Content: meal logs, macro and protein targets you set, biometric values you enter (for example, weight, bodyweight-related notes), goals, notes, and feedback.
• Meal-analysis inputs: photos or text you submit to AI-assisted logging, and the structured output returned.
• Device and technical data: IP address, device and operating-system identifiers, app version, language, and basic event logs needed for security, abuse prevention, and diagnostics.
• Support data: the contents of support messages you send us and metadata about those messages.
• Payment metadata (future): when paid tiers launch, Stripe will handle card data directly. We receive a tokenized customer ID and limited billing metadata (for example, country, last-four digits for receipts).

We do not intentionally collect precise geolocation, biometric identifiers (such as fingerprints or face templates for authentication), genetic data, or Personal Data from anyone we know is under 18. We do not purchase Personal Data from data brokers for marketing.

B. How we use your data (purposes)

• To create and operate your Account and authenticate you.
• To provide AI-assisted analysis, insights, and corrective suggestions you request.
• To send transactional communications (verification, security alerts, support responses, important service notices).
• To keep the Services secure, prevent fraud and abuse, enforce our terms, and debug issues.
• To comply with legal obligations and respond to lawful requests.
• To improve the Services. We use aggregated or de-identified usage data, not individual-level User Content, to prioritize roadmap work.

C. Legal bases (EU/UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR / UK-GDPR:

• Performance of a contract (Art. 6(1)(b)): to provide the Services you request, including AI-assisted features.
• Legitimate interests (Art. 6(1)(f)): to secure the Services, prevent abuse, detect errors, and improve reliability.
• Consent (Art. 6(1)(a) and, where applicable, Art. 9(2)(a)): for optional features and for processing health-related information (for example, nutrition and biometric logs you voluntarily enter). You may withdraw consent at any time; withdrawal does not affect processing before withdrawal.
• Legal obligation (Art. 6(1)(c)): to comply with applicable law and lawful requests.

D. No sale, no sharing, no ad targeting

Enso Labs does not sell your Personal Data, and does not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA. We do not run advertising networks, we do not place cross-site tracking pixels on the marketing site (see Section VI), and we do not use your Personal Data or User Content to train third-party AI models.

E. AI providers & no-training configuration

F. No meal-photo storage

No photo storage promise. For photo-based meal workflows in Enso Labs applications, uploaded meal photos are processed for analysis and then discarded. Enso Labs LLC does not store meal photos in its application database. The structured analysis (for example, recognized items, estimated macros) is saved to your log so that you can review and correct it.

G. Sharing and disclosure

We disclose Personal Data only:

• To sub-processors acting on our instructions under written data-protection terms (see Section VII).
• To professional advisors (auditors, lawyers, accountants) under obligations of confidentiality.
• To comply with a lawful request, subpoena, court order, or to protect rights, safety, and property. We will push back against overbroad requests where appropriate.
• In connection with a merger, acquisition, financing, or sale of assets, subject to this Framework continuing to apply to your data.
• With your explicit consent for any other purpose.

H. International data transfers

Enso Labs is based in the United States. If you access the Services from the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction that restricts cross-border transfers, your Personal Data will be transferred to the United States and processed by the sub-processors listed below. Where required, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, and we evaluate supplementary measures. Contact legal@ensolabs.cc for a copy of the applicable transfer terms.

I. Retention

• While your Account is active, we retain Account and User Content for as long as needed to provide the Services.
• Meal photos submitted for analysis are discarded after analysis and are not stored in the application database (see Section V.F).
• After Account deletion, we remove or anonymize Personal Data from production systems within 30 days. Encrypted backups and disaster-recovery snapshots are rotated out within 90 days. We may retain minimal records (for example, proof of deletion, legal holds, abuse records) where required by law or to defend legal claims.
• Aggregated or de-identified data may be retained indefinitely for service improvement, trend analysis, and research.

J. Your rights

Subject to verification of your identity and to legal exceptions, you have the following rights. To exercise them, email legal@ensolabs.cc. We will respond within the timeframes required by applicable law (generally 30 days under the GDPR, 45 days under the CCPA/CPRA).

• Access — receive a copy of the Personal Data we hold about you.
• Correction / rectification — ask us to correct inaccurate or incomplete data.
• Deletion / erasure — ask us to delete your Personal Data, subject to legal exceptions.
• Portability — receive your data in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible.
• Restriction and objection — restrict or object to certain processing based on legitimate interests.
• Withdraw consent — where processing is based on your consent, without affecting prior lawful processing.
• Automated decisions — we do not make decisions that produce legal or similarly significant effects on you solely by automated means without human involvement. AI Output is suggestion-only and is reviewed by you before any action is taken.
• Complain to a regulator — if you are in the EU, UK, or a jurisdiction with a supervisory authority, you may lodge a complaint with your local data-protection authority. We ask that you contact us first so we can try to resolve it.
• Non-retaliation — we will not deny or degrade the Services, or charge different prices, because you exercised a privacy right.

K. California residents (CCPA / CPRA)

In addition to the rights above, California residents have the right to (i) know the categories and specific pieces of Personal Data we collect, the sources of that data, the purposes for collection, and the categories of recipients; (ii) request deletion; (iii) correct inaccurate Personal Data; (iv) limit the use and disclosure of sensitive Personal Data to purposes reasonably necessary to provide the Services; and (v) opt out of "sale" or "sharing". We do not sell or share Personal Data as those terms are defined under the CPRA, so there is nothing to opt out of today. If that ever changes, we will update this Framework, provide a "Do Not Sell or Share My Personal Information" link, and obtain opt-in consent where required.

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose Personal Data to third parties for their direct marketing purposes.

L. Other US state privacy rights

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as they come into force) have rights to access, correct, delete, obtain a copy, and opt out of targeted advertising, sale, or certain profiling. Because we do not engage in targeted advertising or sale of Personal Data, the most relevant rights are access, correction, deletion, and portability. Contact legal@ensolabs.cc to exercise these rights.

M. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, loss, misuse, and alteration. These include encryption in transit, encryption at rest where supported, least- privilege access for engineers, audit logging, and vendor due-diligence. No method of transmission or storage is 100% secure; we cannot guarantee absolute security. If we become aware of a breach that affects your Personal Data, we will notify you and the relevant regulators as required by law.

N. EU / UK representative

At this stage of the product, Enso Labs LLC does not offer Services on a regular basis to data subjects in the EU or the UK within the meaning of Article 27 GDPR / Article 27 UK-GDPR, and has therefore not appointed a representative. EU and UK data subjects may contact legal@ensolabs.cc directly for all GDPR / UK-GDPR matters. We will update this section if and when appointment of a representative becomes required.

VII. Sub-processors

Vendors that process Personal Data on our behalf, under written data-protection terms.

We keep our sub-processor list short on purpose. The table below is current as of April 22, 2026. We may engage additional sub-processors as the Services evolve. Material changes will be reflected here, and we will update the "Last updated" date at the top of this page.

• Vercel, Inc.

  Website and application hosting, edge compute, image optimization, build pipeline.

  Location:

  United States (global edge).

  Privacy:

  policy

• Cloudflare, Inc.

  DNS, CDN, DDoS protection, TLS termination, web application firewall.

  Location:

  United States (global edge).

  Privacy:

  policy

• Supabase, Inc.

  Primary application database (PostgreSQL), authentication, and object storage for user data.

  Location:

  United States (with regional deployments).

  Privacy:

  policy

• Google LLC (Firebase)

  Authentication helpers, push notifications, crash and stability diagnostics for Enso Labs apps.

  Location:

  United States (global edge).

  Privacy:

  policy

• OpenAI, L.L.C.

  Large-language-model analysis for AI-assisted features. Configured for no model training and minimal retention.

  Location:

  United States.

  Privacy:

  policy

• Google LLC (Gemini / Vertex AI)

  LLM and multimodal analysis for AI-assisted features. Configured for no model training and minimal retention where supported.

  Location:

  United States.

  Privacy:

  policy

• Stripe, Inc.

  Payment processing for any paid tiers. Stripe receives payment details; Enso Labs does not store full card numbers.

  Location:

  United States (global).

  Privacy:

  policy

• Resend, Inc.

  Transactional email delivery (account verification, password resets, support replies).

  Location:

  United States.

  Privacy:

  policy

• Functional Software, Inc. (Sentry)

  Application error monitoring and performance telemetry. Configured to scrub user content where technically feasible.

  Location:

  United States.

  Privacy:

  policy

VIII. Cookies & tracking

The ensolabs.cc marketing site does not run advertising or analytics cookies.

As of April 22, 2026, the ensolabs.cc marketing site does not set analytics or advertising cookies. We do not use Google Analytics, Meta Pixel, or similar cross-site trackers on the marketing site. Your browser may still set strictly-necessary cookies required by our hosting provider for security and load balancing.

When you use the Kanso application, we use strictly-necessary cookies and local storage to keep you signed in, remember your preferences, and secure your session. These are required for the Services to function and are therefore not subject to a consent banner under the EU ePrivacy rules. If we ever introduce non-essential cookies (for example, product analytics), we will update this section and obtain consent where required by law.

We honor Global Privacy Control (GPC)signals sent by your browser as an opt-out of any "sale" or "sharing" under US state privacy laws. Because we do not sell or share Personal Data today, honoring GPC requires no change in behavior.

IX. Intellectual property

The Services, including the Enso Labs and Kanso names, logos, visual identity, copy, code, and any underlying patents, trademarks, copyrights, and trade secrets, are owned by Enso Labs LLC or its licensors. Except for the limited license granted in Section IV.C, no rights are granted to you.

If you believe material on the Services infringes your copyright, you may send a notice under the US Digital Millennium Copyright Act (DMCA) to legal@ensolabs.cc with the information required by 17 U.S.C. § 512(c)(3). We may remove or disable access to allegedly infringing content and, in appropriate circumstances, terminate repeat infringers.

X. Changes to this Framework

We may update this Framework from time to time. For material changes—for example, new categories of data collection, new sub-processors that materially change the risk profile, or reduced user rights—we will provide at least 30 days' noticeby email to the address on file and/or by prominent notice in the Services before the change takes effect. For non-material updates (clarifications, typos, reorganization), we will update the "Last updated" date above and, where appropriate, summarize the change. Your continued use of the Services after a change becomes effective constitutes acceptance of the updated Framework; if you do not agree, stop using the Services and close your Account.

XI. Contact

Email support for product help and legal for privacy, compliance, or formal notices.

Enso Labs LLC, a Texas limited liability company.
Support: support@ensolabs.cc
Legal and privacy (including GDPR / CCPA requests and formal notices): legal@ensolabs.cc