This Privacy Policy explains how NutriOS (“we”, “us”, “our”) collects, uses and protects personal data when you use our website and meal-planning service. We operate the service from Sylhet, Bangladesh and serve customers primarily in the European Union.
1. Who we are
2. What data we collect
- Account data: your name, email address and password (stored only as a secure hash).
- Practice data: country, measurement units, branding assets such as your logo, and the default settings you configure in your dashboard.
- Client data you enter: your clients’ names, contact details, biometrics (age, weight, height) and preferences. This data is stored on your behalf solely to generate meal plans. You remain the data controller of your clients’ information; we process it only on your instruction.
- Payment data: handled entirely by our payment providers. We never see or store your full card number.
- Usage data: technical logs, credit consumption and feature usage needed to operate and secure the service.
- Affiliate data: if you join our affiliate program, we process your name, email, phone number and platform link to run the partnership and pay commissions.
3. Why we process data (legal bases)
- Contract: to provide the service you signed up for, including accounts, AI meal-plan generation, PDF delivery, email sending and support.
- Legitimate interest: service security, fraud and abuse prevention, and product improvement.
- Consent: optional marketing communications, which you can withdraw at any time.
4. Third-party tools and processors
We share only the minimum data necessary with trusted providers, all bound by data-processing agreements:
- Payments: Paddle, Lemon Squeezy and Stripe, acting as merchant of record for subscriptions and one-time purchases.
- AI and automation: n8n (workflow orchestration), Claude (Anthropic) and Gemini (Google) for drafting meal-plan content. Payloads travel over encrypted, signed connections, are never used to train models, and are not retained after your plan is delivered.
- Email delivery: transactional providers for account, billing and plan-delivery messages.
5. International transfers
Some of our providers are located outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses, together with encryption in transit and at rest.
6. Retention
Account, plan and client data are retained while your subscription is active. When you delete your account, personal data is removed within 30 days, except records we must keep for accounting or legal reasons.
7. Your rights (GDPR)
You may request access, correction, export, restriction or erasure of your personal data, and object to processing, by emailing support@nutrios.eu. You may also lodge a complaint with your local data-protection authority.
8. Security
We protect your data with encrypted connections (HTTPS/TLS), hashed passwords, signed webhook payloads, and least-privilege access to our systems. No system is perfectly secure, so we review and improve our safeguards continuously.
9. Children
The service is intended for professionals and is not directed at children. We do not knowingly collect data from anyone under 18.
10. Changes and contact
We may update this policy as the service evolves; the “Last updated” date above always reflects the current version. Questions?