Menuvivo privacy policy (EN)

This policy explains what data we process, why we do it, on what legal basis, and what rights you have.

1. Data controller and contact

The controller of your personal data is Juliusz Ćwiąkalski, conducting business under the name JCw Solutions Juliusz Ćwiąkalski, entered in the Central Registration and Information on Business (CEIDG), NIP 913-150-47-11, REGON 021461414 (hereinafter: the “Controller”, the “Service Provider”).

Privacy contact: contact@menuvivo.com.

2. Scope

The policy applies to the processing of personal data in connection with:

1. using the Menuvivo app available at https://app.menuvivo.com,
2. using the information website https://www.menuvivo.com (if available),
3. communicating with us (e.g., e-mail, in-app chat – if available).

3. Categories of data we process

The scope of data depends on how you use Menuvivo. We may process:

1. Account and authentication data: user identifier with the Authentication Provider, basic profile data provided as part of login (e.g., name/profile name, e-mail address, profile photo – if the provider makes it available).
2. Group (family) subscription data: role (Subscription Administrator / Subscription Member), information about invitations, membership, and account relationships within the subscription.
3. Content and application data: inventory, lists, meal plans, dietary preferences, notes, corrections, and other content entered by the user.
4. Photos and related data: photos (e.g., of the fridge/pantry/products) and metadata and processing results (e.g., labels, recognized products, corrections).
5. Technical data and logs: IP address, device/browser identifiers, timestamps, error information, server logs, and security events.
6. Billing data (if we introduce payments): data necessary for settlements and accounting documentation (e.g., invoice data, payment history). In such a case, we may use a payment operator (it will be indicated in the app or in this policy after payments are implemented).
7. Communication and mailing data: e.g., e-mail address, communication preference information, contact history (if you write to us or subscribe to a mailing list).

4. Purposes and legal bases for processing (GDPR)

We process data for the following purposes, on the following legal bases:

1. Entering into and performing a contract / providing the service Creating and maintaining an Account, authentication, providing app functionality, handling a Group (family) Subscription and sharing data within it. Basis: Art. 6(1)(b) GDPR (contract).

2. Security, abuse prevention, stability, and diagnostics Detecting abuse, preventing fraud, ensuring system security, keeping logs, diagnosing errors, auditing, and accountability. Basis: Art. 6(1)(f) GDPR (the Controller’s legitimate interest).

3. Legal obligations Fulfilling obligations under applicable law (e.g., tax/accounting settlements – where applicable, complaint handling, responding to requests from authorized authorities). Basis: Art. 6(1)(c) GDPR (legal obligation).

4. Contact and service-related communication Responding to messages, handling inquiries, technical and security communications, information about changes to the terms/policies (when required). Basis: Art. 6(1)(b) and/or (f) GDPR (depending on the nature of the contact).

5. Analytics and usage measurement (cookies / similar technologies) Measuring traffic and behavior in the website/app to better understand how the product works and improve the user experience. Basis: as regards cookies and similar technologies: consent under ePrivacy/telecommunications laws; and as regards further processing of data: Art. 6(1)(a) GDPR (consent). We run analytics tools only after your consent (see the “Cookies” section).

6. Mailing (e.g., product updates / mailing list) If you subscribe to a mailing list or consent to such communication, we may send e-mail messages. Basis: as a rule, Art. 6(1)(a) GDPR (consent) and ePrivacy provisions regarding marketing communications (if marketing content is involved).

7. AI improvement based on photos (opt-in) Using photos and related data for research and development purposes (e.g., training/testing/fine-tuning AI models) only if you enable the voluntary opt-in setting in the app. Basis: Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time with effect for the future (details in the “Retention period” section).

8. Photo recognition and external AI processing When you ask us to recognise a photo, the photo and the related recognition data are processed to suggest ingredients and products. Recognition is optional; you can add items manually instead. If you use recognition, the photo may be transferred to external AI providers as described in section 7. Basis: Art. 6(1)(a) GDPR (consent), given before the photo is sent to an external provider. You may withdraw this consent at any time with effect for the future.

9. Special categories of data (Art. 9) Inferred diet or health information (for example, information that may be derived from the food you photograph) may constitute special-category data under Art. 9 GDPR. Where we process such data on the basis of consent, that consent is explicit. This description reflects our current assessment and is not a final legal characterisation.

5. Data sources

In most cases you provide data to us directly (e.g., you create content in the app). Some data may come from the Authentication Provider (e.g., account identifier, e-mail) – to the extent it makes it available as part of login.

6. Recipients of data (who we may share data with)

We may disclose data to recipients only to the extent necessary for the operation of the service or for the purposes described in this policy, in particular:

1. Hosting, infrastructure, and operational tool providers We use AWS (Amazon Web Services) cloud infrastructure to maintain systems, databases, and backups.

2. Authentication providers Entities enabling login (e.g., Google; other providers in the future). The scope of data depends on the chosen login method.

3. Analytics providers (after consent to cookies) We use PostHog Cloud EU — run only after obtaining your consent to cookies/similar technologies. In the future, we may also use other analytics tools – also only after consent.

4. Mailing / communication providers We may use Brevo as a tool for managing mailing lists and sending e-mail messages (to the extent we use it).

5. AI providers (processing at your request) and AI providers as part of opt-in training Menuvivo may use external providers of AI models and/or AI infrastructure. The current providers are OpenAI (United States) and, where enabled, DeepSeek (People’s Republic of China). We also use Google (United States) for sign-in identity only. Depending on the function, data may be transferred to such a provider for processing (e.g., photo analysis, generating suggestions). If you enable AI Improvement opt-in, your materials may be used in R&D processes in accordance with your consent. The current list, destinations, and safeguards are set out in section 7.

6. Payment operators and accounting providers (if we implement payments) For the implementation of payments and the fulfillment of tax/accounting obligations.

7. Authorized authorities If required by law, we may disclose data to authorized authorities (e.g., based on a valid request).

7. Transfers of data outside the EEA (international transfers)

Some of our providers are located outside the European Economic Area (EEA). We describe below the current recipients and the transfer position for each of them.

1. OpenAI (United States) — recognition processing. OpenAI’s published data processing addendum offers Standard Contractual Clauses (Module Two or Module Three) or an adequacy route, and states participation in the EU–US Data Privacy Framework. Whether the addendum is incorporated into our account, and which module applies, is still being confirmed. API data is not used for training unless the customer explicitly opts in (the default since 1 March 2023); we do not opt in.
2. DeepSeek (People’s Republic of China) — recognition processing where enabled. We have not identified a lawful transfer mechanism for this provider. No standard contractual clauses, no adequacy decision, and no equivalent instrument is in place for our account. For that reason, DeepSeek is not enabled for real households: it is used only in staging with synthetic data. Its terms allow training on inputs with an opt-out; we do not claim a training exclusion for DeepSeek.
3. Google (United States) — sign-in identity only. We use Google for authentication (OAuth/OpenID Connect). No analytics data is transferred to Google.
4. Control statement. We do not enable a provider for real households unless a lawful transfer mechanism and the required contractual safeguards are in place. A provider’s published terms are not, by themselves, evidence that a mechanism is in place for our account.
5. Other providers. AWS (eu-west-1) and PostHog Cloud EU process data in the EU; Brevo is used for e-mail. No third-country transfer is evidenced for these providers. If that changes, we will update this policy.

8. Retention period (data retention)

We apply the principle: we store data only for as long as is necessary to achieve the purpose.

Category	What we keep	Retention period
Recognition photos — not opted in to AI Improvement	Photos and recognition results	Deleted after about 30 days when marked for that retention
Recognition photos — AI Improvement opted in	Photos and related data	Kept while the opt-in is active; the link to your Account is then severed after about 30 days
Account and application data	Inventory, lists, plans, preferences, and other content	Until termination; then a 30-day read-only export grace window, then deletion of operational data, subject to the claims and legal-obligation retention below
Technical and security logs	Logs, error information, and security events	As long as needed for security and accountability, then deleted or anonymised
Billing data (if applicable)	Invoice data and payment history	The period required by law
Backups and point-in-time recovery	Backup copies	Up to about 35 days

1. Account data and application data. When your Account is terminated, we keep your operational data available in read-only form for 30 days so that you can retrieve it (the export grace window). After that window we delete the operational data, subject to the backup and legal-retention limits in the table and to the retention needed to handle or defend claims and to fulfil legal obligations.

2. Technical and security logs are stored for the period necessary to ensure security and accountability, and then deleted or anonymized.

3. Billing data (if applicable) is stored for the period required by law.

4. AI Improvement (opt-in):

   1. if you withdraw consent (disable opt-in), new photos will not be used for AI Improvement;
   2. photos previously collected for AI Improvement are deleted or excluded from future training datasets within a reasonable time, as a rule within 30 days;
   3. we may complete ongoing in-progress processes (“jobs”) in which data is already being processed;
   4. withdrawing consent does not mean “unlearning” AI models that were already trained before consent was withdrawn;
   5. where a photo has already been de-linked, we may be unable to identify and delete that copy. De-linking cannot be undone.

5. Irreversibility. De-linking is irreversible: once we have severed the link between a photo and your Account and user identifiers, we cannot link that copy back to you. Where de-linked data can no longer be identified, we cannot delete that copy on your request.

9. Your rights

You have rights under the GDPR, in particular:

• the right of access to data,
• the right to rectification,
• the right to erasure,
• the right to restriction of processing,
• the right to data portability,
• the right to object (when we process data under Art. 6(1)(f) GDPR),
• the right to withdraw consent (when we process data on the basis of consent) – including consent to AI Improvement (opt-in),
• the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (PUODO).

To exercise your rights, contact us: contact@menuvivo.com. This is the channel we currently operate; the app does not currently provide an automated export or erasure function.

Limits when exercising erasure. We delete the live account and application data we can identify. Some data may remain for a limited period: backup and point-in-time-recovery copies (up to about 35 days), security and audit logs kept for security and accountability, and data already sent to an external AI provider, which is subject to that provider’s retention and deletion terms. Where a photo has been de-linked and can no longer be identified, we cannot delete that copy on request.

10. Children (13+) and Group Subscription

1. The minimum age for using the app is 13 years.
2. In the Group (family) Subscription model, the contract is concluded by the Subscription Administrator (18+), who invites and removes Subscription Members.
3. Subscription Members within the same group may see shared resources and User Content in accordance with the app’s functionality (e.g., inventory, lists, plans, fridge/pantry photos, product thumbnails). This means that when you add content to shared areas, it is also available to other members of your group.
4. AI Improvement (opt-in): for a Minor User under 16, we do not accept an AI Improvement opt-in without an attestation of parental responsibility. The Subscription Administrator may manage the opt-in for a Minor User only where they make that attestation. An adult Subscription Member decides on the opt-in independently for their own Account. To make or change an attestation, contact contact@menuvivo.com. The app does not currently verify age at sign-up; the Subscription Administrator is responsible for the attestation.

11. Automated decision-making and AI

Menuvivo uses AI to generate suggestions (e.g., meal proposals, product recognition). Recognition and recipe suggestions may be inaccurate, incomplete, or fabricated, and require human verification. They are not professional, medical, or nutritional advice. We do not make decisions about you that produce legal effects or similarly significantly affect you solely in an automated manner.

AI providers and training. Recognition requests may be processed by OpenAI (United States) and, where enabled, DeepSeek (People’s Republic of China). The purpose is to turn a photo into ingredient and product suggestions. Training status: OpenAI — NO (API data is not used for training unless the customer explicitly opts in; the default since 1 March 2023, and we do not opt in); DeepSeek — YES (its terms allow training on inputs with an opt-out, so training is possible and no exclusion is claimed). See section 7 for transfers and safeguards.

12. Cookies and similar technologies (ePrivacy)

1. The website/app may use cookies and similar technologies:

   • necessary for operation (e.g., security, maintaining basic settings),
   • analytics – only if you give consent.

2. Analytics after consent (cookie opt-in): We use analytics tools (PostHog Cloud EU) only after obtaining your consent. For rejected consent, we operate in cookieless mode – no analytics tools are loaded, and no network calls are made to analytics providers.

3. Consent cookie mv_consent_v1: We use a consent cookie (mv_consent_v1) scoped to .menuvivo.com to share your consent decision between www.menuvivo.com and app.menuvivo.com. This way, you set your preferences only once for all our subdomains. The cookie stores your choice (rejected, accepted_analytics, or accepted_analytics_replay), expires after 180 days, and uses Secure and SameSite=Lax attributes.

4. Global Privacy Control (GPC): If your browser sends a GPC signal, we default to rejecting analytics cookies, but you can override this in our consent banner/modal.

5. Analytics providers:

   • PostHog Cloud EU: Used only after consent for analytics and/or session replay. Data is processed in the EU, retained for 12 months, and may involve international transfers within the EU/EEA. PostHog receives a random analytics identifier, and after you sign in, pseudonymous user and tenant identifiers. It also receives the free-text search queries you type on our site. We do not include your name or email address in analytics events.

6. Cookie table:

   Category	Purpose	Providers	Expiry	Legal Basis
   Essential	Security, basic functionality	Menuvivo	Session/180 days	Legitimate interest
   Analytics	Usage measurement, improvements	PostHog Cloud EU	12 months	Consent
   Session Replay	User interaction recording	PostHog Cloud EU	12 months	Consent

7. You can change your cookie consent at any time in the privacy settings modal (accessible via the banner or footer “Cookie settings” link) or by deleting cookies in your browser. Blocking necessary cookies may affect service functionality.

13. Security

We apply technical and organizational measures appropriate to the risks, in particular limiting access to data, encrypting transmission, access control mechanisms, and security monitoring.

14. Changes to the privacy policy

1. We may update this policy for important reasons (e.g., changes in the law, changes in providers, changes in functionality).
2. In the event of material changes, we will inform the Subscription Administrator in advance (as a rule, at least 14 days), indicating the effective date of the changes.
3. The changes do not infringe Consumers’ rights under mandatory provisions of law.