1. Who We Are
Legal Entity
Poslovno svetovanje in storitve Gašper Kovač, s.p.
Cesta na Štibuhu 7, 2380 Slovenj Gradec, Slovenia
Tax ID (DDV): SI50991256
Company ID: 9116800000
Nectryn is an AI-powered meal planning service and kitchen assistant designed for busy entrepreneurs across Europe. We help you save time on meal decisions while maintaining your health goals.
2. What Data We Collect
We collect and process the following categories of personal data:
2.1 Account Information
| What we collect | First name, last name, email address, password (hashed) |
| Why | To create and manage your account |
| Legal basis | Performance of contract (GDPR Art. 6(1)(b)) |
| Retention | Until you delete your account |
2.2 Health & Dietary Data (Special Category)
| What we collect | Health conditions (e.g., diabetes, PCOS, thyroid disorders, Celiac disease), food allergies and intolerances, daily calorie needs, dietary preferences |
| Why | To generate personalized, safe meal plans that respect your health requirements |
| Legal basis | Explicit consent (GDPR Art. 9(2)(a)) |
| Body metrics note | Your weight, height, age, sex, and activity level are processed only in your browser. These raw body metrics are never stored in our database. Only the resulting calorie target is saved. |
| Retention | Until you withdraw consent or delete your account (30-day grace period) |
2.3 Meal Planning Data
| What we collect | Meal preferences, recipe swaps, favorites, cooking history, grocery lists, AI learning data |
| Why | To improve meal recommendations over time |
| Legal basis | Legitimate interest (product improvement) with opt-out option |
| Retention | 24 months of inactivity, then anonymized |
2.4 Payment Information
| What we collect | Payment method details (via Stripe), subscription status (active/trialing/canceled), subscription plan type (monthly/annual/early-bird/beta), trial end date, subscription end date, beta tester status, transaction history. We store a Stripe Customer ID to link your account to Stripe's systems. |
| Why | To process payments and manage your subscription |
| Legal basis | Performance of contract (GDPR Art. 6(1)(b)) |
| Processor | Stripe (PCI-DSS compliant, GDPR Data Processing Agreement in place) |
| Retention | Financial records: 7 years (Slovenian tax law); payment methods: until removed or subscription cancelled |
2.5 Technical & Usage Data
| What we collect | IP address, device information, usage statistics, authentication cookies |
| Why | Security, fraud prevention, product improvement |
| Legal basis | Legitimate interest (GDPR Art. 6(1)(f)) with opt-out for non-essential analytics |
| Retention | 12 months for analytics; indefinitely for security logs |
2.6 Communications
| What we collect | Email communications, support tickets, feedback |
| Why | To provide customer support and respond to inquiries |
| Legal basis | Legitimate interest (customer service) |
| Retention | 3 years after last contact |
3. How We Use Your Data
| Purpose | Data Used | Legal Basis | Retention |
|---|---|---|---|
| Account management | First name, last name, email, password | Contract (Art. 6(1)(b)) | Until account deletion |
| Meal plan generation | Health conditions, allergies, calorie needs, preferences | Explicit consent (Art. 9(2)(a)) | Until withdrawal or 30 days post-deletion |
| AI personalization | Recipe swaps, favorites, cooking history | Legitimate interest with opt-out | 24 months of inactivity |
| Payment processing | Payment details, email | Contract (Art. 6(1)(b)) | Per Stripe DPA |
| Customer support | All account data as needed | Legitimate interest (Art. 6(1)(f)) | 3 years after last contact |
| Product improvement | Anonymized usage patterns | Legitimate interest with opt-out | 12 months |
| Marketing emails (optional) | First name, email, preferences | Consent (Art. 6(1)(a)) – opt-in only | Until unsubscribe |
| Security & fraud prevention | IP address, device info, usage patterns | Legitimate interest (Art. 6(1)(f)) | Indefinitely for security logs |
We may use your first name to personalize in-app messages and email greetings (for example, showing “Good evening, [First name]” in your dashboard), without changing the substance of decisions we make about you.
We do NOT:
- • Sell or rent your data to third parties
- • Use your data for automated decision-making with legal effects
- • Profile you for marketing purposes without explicit consent
- • Share health data with advertisers or data brokers
5. Data Storage & Security
5.1 Where We Store Your Data
- Primary database: Supabase EU (Frankfurt, Germany)
- Backups: EU region only (automated, encrypted)
- CDN/Edge: Vercel edge network (EU nodes prioritized)
5.2 Security Measures
- Encryption at rest: AES-256 (Supabase default)
- Encryption in transit: TLS 1.3 for all connections
- Row-Level Security: RLS policies enforce user data isolation
- Password security: Bcrypt hashing via Supabase Auth
- 2FA: Available via Google OAuth
- Backups: Daily automated backups (90-day retention)
- Security monitoring: Real-time alerts for suspicious activity
5.3 Data Breach Notification
If a data breach affects your personal data, we will notify the Slovenian Data Protection Authority (IP RS) within 72 hours, notify you via email if there is a high risk to your rights, and provide details on the breach and mitigation steps.
6. Your Privacy Rights (GDPR)
As an EU resident, you have the following rights:
6.1 Right to Access (Art. 15)
What: Get a copy of all your personal data we hold
How: Settings → Privacy → Export My Data (JSON format)
Response: Immediate download (or within 30 days if manual review needed)
6.2 Right to Rectification (Art. 16)
What: Correct inaccurate or incomplete data
How: Settings → Account
Response: Immediate
6.3 Right to Erasure / "Right to be Forgotten" (Art. 17)
What: Delete your account and all associated data
How: Settings → Privacy → Delete My Account
Response: 30-day grace period, then hard delete; financial records kept 7 years per Slovenian tax law
6.4 Right to Data Portability (Art. 20)
What: Receive your data in machine-readable format (JSON)
How: Settings → Privacy → Export My Data
Response: Immediate download
6.5 Right to Restriction of Processing (Art. 18)
What: Pause processing your data while disputing accuracy
How: Email privacy@nectryn.com
Response: Within 30 days
6.6 Right to Object (Art. 21)
What: Opt out of processing based on legitimate interest
How: Marketing: click "Unsubscribe" in any email; Analytics: Settings → Privacy
Response: Immediate
6.7 Right to Withdraw Consent (Art. 7(3))
What: Withdraw consent for health data processing or marketing
How: Settings → Privacy → Manage Consents
Response: Immediate
6.8 Right to Lodge a Complaint (Art. 77)
Contact the Slovenian Information Commissioner (IP RS):
- Website: https://www.ip-rs.si/
- Email: gp.ip@ip-rs.si
- Phone: +386 1 230 97 30
- Address: Dunajska cesta 22, 1000 Ljubljana, Slovenia
7. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Active accounts | Indefinite (while subscribed) | Service delivery |
| Canceled accounts | 90 days, then anonymized | Re-activation window |
| Deleted accounts | 30-day grace period, then hard delete | Recovery window |
| Backups (deleted accounts) | Purged after 90 days total | Technical limitation |
| Inactive accounts (no login 24+ months) | Email warning at 18 months → Delete at 24 months | Data minimization |
| Health data (consent withdrawn) | Deleted immediately | GDPR Art. 7(3) |
| Financial records | 7 years (anonymized after account deletion) | Slovenian tax law |
| Security logs (fraud/abuse) | Indefinite (anonymized after account deletion) | Legal obligation |
| Analytics data | 12 months | Product improvement |
| Support tickets | 3 years after last contact | Customer service |
9. International Data Transfers
While we primarily store data in the EU (Germany), some processors are based in the United States:
| Processor | Location | Safeguard Mechanism |
|---|---|---|
| OpenAI | United States | Standard Contractual Clauses (SCCs) + Zero Data Retention |
| Spoonacular | United States | SCCs + Anonymized API calls (no PII) |
| Stripe | US & EU | SCCs + EU data residency options |
| Vercel | US & EU | SCCs + EU edge caching |
| Google Analytics | United States | SCCs + IP anonymization + Consent-based |
Even when data is transferred outside the EU, you retain all GDPR rights (access, deletion, etc.).
10. Children's Privacy
Nectryn is not intended for children under 16 years old (GDPR minimum age).
- If you are under 16, you must have parental consent to use Nectryn
- If we learn we have collected data from a child under 16 without parental consent, we will delete it immediately
- Parents: To request deletion of your child's data, email privacy@nectryn.com
11. Changes to This Privacy Policy
We may update this policy to reflect new features, legal requirements, or improved security practices.
How we notify you
- Major changes: Email notification 30 days before effective date
- Minor changes: Posted on this page with updated "Last Updated" date
- Your options: If you disagree with changes, you can delete your account before the effective date
Last material update: June 2, 2026 — Clarified collection and use of first and last name for personalization.
12. Contact Us
General Support
Email: info@nectryn.com
Poslovno svetovanje in storitve Gašper Kovač, s.p.
Cesta na Štibuhu 7, 2380 Slovenj Gradec, Slovenia
13. Legal Basis Summary (GDPR Compliance)
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Account creation & management | Contract | Art. 6(1)(b) |
| Health data for meal plans | Explicit consent | Art. 9(2)(a) |
| Payment processing | Contract | Art. 6(1)(b) |
| AI personalization (meal learning) | Legitimate interest (opt-out available) | Art. 6(1)(f) |
| Marketing emails | Consent (opt-in) | Art. 6(1)(a) |
| Analytics (Google Analytics) | Consent (opt-in) | Art. 6(1)(a) |
| Security & fraud prevention | Legitimate interest | Art. 6(1)(f) |
| Customer support | Legitimate interest | Art. 6(1)(f) |
| Legal compliance (tax records) | Legal obligation | Art. 6(1)(c) |
This Privacy Policy is GDPR-compliant and tailored for Nectryn's operations in the European Union.