Privacy Policy
Executive Summary: Privacy-by-Design
Unitrition is a food composition calculator and meal builder utility analyzing open nutritional databases (USDA FoodData Central, ANSES CIQUAL, Open Food Facts). In Zero-Knowledge Guest Mode, all Bread Units (BU / ХЕ), meal balancing, and nutrient queries execute 100% locally in your browser storage (IndexedDB) with zero server transmission. If you register, accounts are isolated with Row Level Security in Supabase. Payments are processed by Paddle.com as our Merchant of Record (Unitrition never accesses or stores credit card numbers). Unitrition does NOT process Protected Health Information (HIPAA PHI) or Special Category Health Data (GDPR Art. 9).
1. Data Architecture & Information We Process
Unitrition is engineered following the core principle of data minimization. The information processed depends strictly on how you utilize the platform:
A. Guest Mode (100% Local / Zero-Knowledge)
Requires no registration. All food selections, Bread Unit (ХЕ) calculations, meal pairings, and plates execute and persist solely inside your client browser storage (IndexedDB and LocalStorage). This data is never transmitted to our servers or third parties.
B. Registered Accounts (Supabase RLS)
If you choose to create an account to synchronize plates across devices, we store your email address, profile name, and meal templates you deliberately save in a PostgreSQL database secured with Row Level Security (RLS).
Unitrition is descriptive food composition software. It is not a medical device (SaMD Class II) and does not collect medical histories, blood glucose readings, prescriptions, or therapeutic dosing data. Consequently, Unitrition does not collect or process Special Category Health Data under GDPR Article 9 or Protected Health Information (PHI) under HIPAA.
2. Payment Processing & Subscriptions (Paddle MoR)
For Unitrition Pro digital subscriptions, we partner exclusively with Paddle (Paddle.com Market Limited & Paddle Payments Limited) acting as our Merchant of Record (MoR). Paddle assumes full legal and fiscal liability for all financial transactions:
- PCI-DSS Level 1 Certification: All payment card processing occurs through encrypted Paddle-hosted checkout elements.
- Zero card number storage: Unitrition never accesses, handles, or stores your full credit or debit card numbers.
- Global Tax Compliance: Paddle calculates, collects, and remits VAT, Sales Tax, and GST directly to national tax authorities.
3. Ephemeral Vision AI Processing
When you voluntarily utilize the photo meal recognition feature, image data is transmitted ephemerally to computer vision models (OpenAI / Google Gemini) under strict security boundaries:
5. Subprocessors & International Data Transfers
To operate our platform, we engage the following third-party infrastructure providers (subprocessors), ensuring valid transfer mechanisms (EU-U.S. Data Privacy Framework or European Commission Standard Contractual Clauses - SCCs):
| Subprocessor | Function | Location | Transfer Safeguard |
|---|---|---|---|
| Vercel Inc. | Edge CDN hosting & serverless compute | EE. UU. / Global | EU-U.S. Data Privacy Framework (DPF) |
| Supabase Inc. | Encrypted PostgreSQL DB & User Auth | EE. UU. (Infraestructura AWS Frankfurt) | EU-U.S. DPF / Almacenamiento en la UE |
| Paddle.com Market Ltd | Merchant of Record, billing & tax | Reino Unido / Irlanda | Decisión de Adecuación de la UE / PCI-DSS |
| Google LLC | Google Analytics 4 & Gemini Vision AI | EE. UU. | EU-U.S. Data Privacy Framework (DPF) |
| OpenAI, LLC | Ephemeral meal photo ingredient parsing | EE. UU. | Cláusulas Contractuales Tipo (SCCs) |
6. Data Retention Periods (GDPR Art. 13(2)(a))
We retain personal data only for as long as strictly necessary to fulfill the operational and legal purposes described:
- Guest Mode Local Data: Persists on your device indefinitely until you clear browser data or use our data rights portal.
- Registered Account Profiles: Retained while your account remains active. Upon deletion request, account records are purged within 30 days.
- Billing & Transaction Records (Paddle): Maintained by Paddle for 7 to 10 years in strict compliance with statutory tax, accounting, and anti-fraud laws.
- Server Access Logs: Anonymized IP addresses and edge firewall logs are retained for 30 to 90 days solely for DDoS mitigation and infrastructure security.
7. Legal Bases for Processing (GDPR Art. 6)
Under European GDPR and UK Data Protection regulations, our processing is justified under the following legal bases:
1. Contractual Necessity (Art. 6(1)(b)): To provision your account, synchronize saved meal templates, and provide Unitrition Pro features.
2. Explicit Consent (Art. 6(1)(a)): For activating optional Google Analytics 4 performance metrics.
3. Legitimate Interest (Art. 6(1)(f)): To secure our platform infrastructure, prevent automated abuse, and guarantee uptime.
4. Legal Obligation (Art. 6(1)(c)): For tax, invoicing, and statutory reporting obligations managed through Paddle.
8. Your Privacy Rights (GDPR & CCPA/CPRA)
Regardless of your geographical location, Unitrition grants you full control over your personal information:
Use our self-service portal to purge local IndexedDB databases or reset cookies in one click.
9. Children's Privacy (COPPA & GDPR Art. 8)
Unitrition is food composition utility software intended for general adult audiences. We do not knowingly collect personal data from children under 16 years of age (in the European Economic Area & UK) or under 13 years of age (in the United States and rest of world). If a parent or guardian discovers that a child has created an unauthorized account, please contact us at support@unitrition.info for immediate account purge.
10. Browser Signals, Supervisory Authorities & Contact
Global Privacy Control (GPC) & Do Not Track (DNT): We honor Global Privacy Control (GPC) signals transmitted by compatible web browsers, automatically disabling all non-essential analytics.
Right to Lodge a Complaint with a Supervisory Authority (GDPR Art. 77): If you reside within the European Union or the UK and believe our data processing breaches applicable law, you have the right to lodge a formal complaint with your local Data Protection Authority. You may locate your national regulator through the European Data Protection Board (EDPB) Directory.
Contact Our Privacy Team
To exercise your rights of access, rectification, erasure, or submit any data privacy questions, contact our team. We respond to all verified inquiries within 30 calendar days: