Version 1.0 · Last updated 6 August 2026 · Effective 6 August 2026
This policy explains what personal data NutriAI collects, why, what legal basis we rely on, who it is shared with, how long it is kept, and what rights you have. It is written to be understood, not to be impenetrable.
The data controller for NutriAI is:
General enquiries and privacy requests: privacy@nutriaiapp.com
We have not appointed a Data Protection Officer. Our processing does not meet the thresholds in Article 37 that would require one — we do not carry out large-scale systematic monitoring, and health data processing is limited to what individual users choose to record about themselves.
We only collect what the app needs to work. "Legal basis" is the justification GDPR requires for each purpose.
| Data | Why | Legal basis |
|---|---|---|
| Email address, and a display name if you give one | To create and secure your account, and to send verification and password-reset messages | Performance of a contract — Art. 6(1)(b) |
| Food entries — what you ate, when, and its estimated nutritional values | The core function of the app, and to sync your history across your devices | Performance of a contract — Art. 6(1)(b) Explicit consent for health aspects — Art. 9(2)(a) |
| Nutrition profile — age, weight, height, sex, activity level, goal | To calculate your daily calorie and macronutrient targets | Explicit consent — Art. 9(2)(a) |
| Chat messages you send to the assistant and its replies | To produce nutrition estimates and keep context across a conversation | Performance of a contract — Art. 6(1)(b) |
| Food photographs | Analysed to estimate the meal, then discarded — never stored by us | Explicit consent — Art. 9(2)(a) |
| Usage counts — number of AI requests per day and their cost to us | To enforce plan limits, prevent abuse, and manage our own costs | Legitimate interests — Art. 6(1)(f) |
| Subscription records — App Store transaction ID, product, expiry | To know what you are entitled to and to honour your purchase | Performance of a contract — Art. 6(1)(b) |
| Technical logs — IP address, timestamps, error details | Security, fraud prevention, and diagnosing faults | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. We use this basis only for keeping the service secure and available and for controlling our costs — never for marketing, profiling, or building a picture of you beyond what you enter yourself. You may object at any time (see Your rights).
Apple Health data — steps, active energy, heart rate, and workouts — is read on your device with your permission and is never transmitted to us. It is not stored on our servers, not shared, and not processed by us in any way. If you write nutrition back to Apple Health, that happens entirely on your device.
Providing this data is not a statutory requirement, but the app cannot function without an account and the food entries you choose to make.
Information about what you eat, your body measurements, and your fitness goals is special category data concerning health under Article 9 of the GDPR. It attracts stronger protection, and processing it requires your explicit consent rather than ordinary consent.
By creating a profile and logging meals you give that explicit consent. You may withdraw it at any time by deleting your account in the app, which erases the data. Withdrawal does not affect processing carried out before you withdrew.
We do not use your health data for advertising, we do not sell it, we do not share it with insurers or employers, and we do not use it to make any decision that produces a legal or similarly significant effect on you.
When you describe a meal or send a photograph, that content is transmitted to OpenAI, which returns an estimate of the food's nutritional content.
Automated decision-making. The nutritional estimates you see are produced automatically. They do not produce legal effects or similarly significantly affect you within the meaning of Article 22 — they are informational estimates that you can correct, override, or ignore, and nothing in the app acts on them without you. Your daily targets are calculated by a published formula (Mifflin–St Jeor) from figures you supply, and you can edit the result.
Estimates can be wrong. See Not medical advice.
We do not sell personal data and we do not share it with advertisers. We use the following processors, each under a data processing agreement:
| Processor | What they handle | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, account authentication (Cognito) | EU — Stockholm |
| OpenAI | Nutrition analysis of meal descriptions and photos | United States |
| Apple | App distribution, payment processing, subscription management | Per Apple's own policy |
| Cloudflare | DNS for our domain | Global |
We may also disclose data where we are legally required to — for example in response to a valid court order — or to establish, exercise, or defend legal claims. If we are ever compelled to disclose your data, we will tell you unless legally prohibited from doing so.
Payments. Subscriptions are purchased through Apple. We never see or store your card details, billing address, or any payment credentials. Apple provides us only with a transaction identifier and what was purchased.
Your account and food data are stored in the European Union (AWS Stockholm, eu-north-1).
Meal descriptions and photographs are transmitted to OpenAI in the United States for processing. This transfer is necessary to provide the service you have requested. It is made under the Standard Contractual Clauses adopted by the European Commission, which OpenAI incorporates into its data processing addendum.
You can avoid this transfer entirely by not using the AI features. The app will not function as intended without them, since analysis is its main purpose.
| Data | Retained |
|---|---|
| Account details | Until you delete your account |
| Food entries and profile | Until you delete your account |
| Chat history | Until you clear it in the app, or delete your account |
| Deleted food entries | Marked deleted immediately; permanently removed within 90 days. The delay exists so a deletion made on one device reliably reaches your others. |
| Food photographs | Not retained at all |
| Usage and cost records | 12 months, then deleted |
| Technical logs | 30 days |
| Subscription records | Up to 7 years after the subscription ends, where required for tax and accounting |
When you delete your account, your data is erased from our live systems immediately. Encrypted backups are overwritten on a rolling cycle and any residual copy is gone within 30 days.
If you are in the European Economic Area or the United Kingdom, you have the following rights. They apply to everyone using NutriAI, wherever you are — we do not think it sensible to give people different protection based on geography.
Most of these you can exercise yourself inside the app: your data is visible, editable, and deletable there, and Profile → Delete Account erases everything permanently.
For an export, or anything the app does not cover, email privacy@nutriaiapp.com. We will respond within one month, as GDPR requires. If a request is unusually complex we may extend this by two further months and will tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive.
We may ask you to verify your identity before acting on a request, to be sure we are not disclosing your data to someone else.
Under the California Consumer Privacy Act as amended by the CPRA, you have the right to know what personal information is collected and how it is used, to delete it, to correct it, to opt out of its sale or sharing, to limit use of sensitive personal information, and not to be discriminated against for exercising these rights.
We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We collect the sensitive personal information described in section 2 solely to provide the app, and we do not use or disclose it for any purpose that would require offering a right to limit.
To exercise any of these rights, email privacy@nutriaiapp.com.
NutriAI is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children.
If you believe a child has provided us with personal data, email privacy@nutriaiapp.com and we will delete the account and its data promptly.
If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will inform you directly without undue delay where the risk is high.
No system is perfectly secure, and we would rather say so than imply otherwise.
This website uses no cookies, no analytics, and no tracking pixels. Nothing is stored in your browser and no third party is contacted when you load this page.
The app contains no advertising SDKs, no analytics SDKs, and no cross-app tracking. It does not use Apple's Advertising Identifier and does not request App Tracking Transparency permission, because it has nothing to track you with.
NutriAI produces nutritional estimates using AI. Estimates can be inaccurate. The app is not a medical device, does not diagnose or treat any condition, and does not provide medical, dietary, or clinical advice.
Do not rely on it for decisions about your health. If you have a medical condition, are pregnant, have a history of disordered eating, or are making significant dietary changes, speak to a qualified professional.
If we change this policy materially we will update the version and date at the top, notify you in the app before the change takes effect, and — where the change requires it — ask for your consent again. Previous versions are available on request.
For any privacy question or request: privacy@nutriaiapp.com
If you are unhappy with how we have handled your data, you have the right to complain to a supervisory authority — in the EU, the authority in the country where you live, work, or where the issue arose; in the UK, the Information Commissioner's Office at ico.org.uk; in Israel, the Privacy Protection Authority. We would appreciate the chance to address it first.