Privacy Policy

Nutrivex AI (“we”, “us”, “our”) provides nutrition tracking, meal planning, and AI coaching. For users in the EEA/UK, we act as the data controller for personal data processed through our consumer apps and website. Where an organization deploys Nutrivex AI for its members (B2B), that organization is the controller and we act as its processor under a data processing agreement. Contact: privacy@nutrivex.ai.

• Account data: email address, name or display name, password hash or federated identity (Google / Apple Sign in), language, theme, and notification preferences.
• Nutrition data: meals and foods you log, calories, macronutrients, water intake, meal plans, grocery lists, and goals.
• Health-related data: optional profile information such as age, sex, height, weight and weight history, activity level, dietary preferences, allergies, and body-composition goals. We treat this as sensitive data.
• AI interaction data: the prompts, questions, and profile context you send to the AI coach and planner, and the responses generated.
• Payment data: subscription status, plan, renewal dates, and the last four digits and brand of your card. Full card numbers are handled by our payment processor and never reach our servers.
• Device and usage data: device model, OS version, app version, approximate region derived from IP address, crash reports, and aggregate feature usage.
• Support data: messages you send through our contact form or by email.

We do not knowingly collect data from children under 13 (or under 16 where local law requires). We do not sell personal data, and we do not use health data for advertising.

• Provide core features: logging, tracking, analytics dashboards, and progress history.
• Generate personalized meal plans, calorie and macro targets, and AI coaching answers.
• Process subscriptions, invoices, renewals, and cancellations.
• Send service messages and — only with your consent — product news and newsletters.
• Maintain security, prevent fraud and abuse, and debug crashes.
• Improve the product using aggregated, de-identified statistics.

Legal bases (GDPR): performance of a contract for core features and billing; your explicit consent for health-related data, marketing emails, and optional analytics; legitimate interests for security and product improvement; and legal obligation for tax and accounting records. You may withdraw consent at any time.

AI meal plans and coaching are generated by large language models operated by our AI provider. To answer you, we send the relevant parts of your request and profile context (for example calorie targets, dietary preferences, allergies) to that provider. Requests are processed to return a response and are not used to train third-party models. We retain your AI conversations in your account so you can revisit them; you can delete them at any time.

AI output is nutritional guidance, not medical advice. Always consult a qualified healthcare professional before making significant dietary or health decisions.

Subscriptions purchased on our website are processed by Stripe, a PCI-DSS Level 1 provider. Stripe receives your payment details directly; we store only the subscription state needed to unlock Premium features. Subscriptions purchased inside the mobile apps are processed by Apple or Google under their own terms and privacy policies, and we receive only a purchase token and subscription status.

Our website uses strictly necessary cookies and local storage to keep you signed in and to remember your language, theme, and accent preferences. We use privacy-respecting, aggregated product analytics to understand which features are used; where required by law we ask for your consent before setting non-essential cookies, and you can decline without losing access to any feature. We do not run third-party advertising or cross-site tracking cookies.

We share data only with service providers acting on our instructions:

• Cloud hosting and database — application data storage and authentication.
• Stripe — payment and subscription processing.
• AI model provider — generating plans and coaching responses.
• Email delivery — transactional and newsletter emails.
• Apple / Google — app distribution, sign-in, and in-app purchases.

Each provider is bound by a contract limiting use of your data to providing the service. We may also disclose data where legally required, or in connection with a merger or acquisition — in which case we will notify you beforehand.

Our providers may process data in the United States and other countries. Where personal data leaves the EEA or the UK, we rely on Standard Contractual Clauses and equivalent safeguards, together with encryption in transit and at rest.

• Account, nutrition, and health data: kept while your account is active.
• Inactive accounts: we delete or anonymize data after 24 months of inactivity, after notifying you by email.
• AI conversations: kept until you delete them or delete your account.
• Payment and invoice records: retained by our processor for up to 7 years for tax and accounting law.
• Security and crash logs: up to 12 months.
• Backups: purged on rotation within 90 days of deletion.

Data is encrypted in transit (TLS) and at rest. Access to production data is restricted to authorized personnel, database access is enforced by row-level security so users can only read and write their own records, and secrets are stored in a managed vault. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant supervisory authority as required by law.

Depending on where you live, you may have the right to access, correct, export (portability), restrict, or object to the processing of your data, to withdraw consent, and to delete your data. California residents may request disclosure of the categories of data collected and opt out of “sharing”; we do not sell personal information. Exercise any right from your account page or by emailing privacy@nutrivex.ai. We respond within 30 days and never charge for a first request. You may also lodge a complaint with your local data protection authority.

You can delete your account and associated personal data at any time from your account settings, in the mobile app, or by emailing us. Full instructions, what is deleted, and what we are legally required to keep are on our Account Deletion page. Requests are completed within 30 days.

We will update this page when our practices change and revise the “last updated” date. For material changes we will notify you by email or in the app before they take effect.

Privacy questions: privacy@nutrivex.ai. General support: our contact page or support@nutrivex.ai.