Privacy Policy
How FitVis Nutrition processes your personal data and what rights you have under GDPR.
Introduction
This Privacy Policy describes what personal data FitVis Nutrition ("we", "us", "our") collects while operating the FitVis Nutrition mobile application and website (the "App", the "Service"), why we process it, and what rights you have under the General Data Protection Regulation (GDPR).
Last updated: October 28, 2026
Your rights at a glance (GDPR)
Right to access
Find out what data we hold about you.
Right to rectification
Have inaccurate or incomplete data corrected.
Right to erasure
Ask us to delete your personal data.
Right to restriction
Restrict processing under certain conditions.
Right to portability
Receive your data in a machine-readable format.
Right to object
Object to processing based on legitimate interest.
Processing of personal data
1. Data Controller
The controller of your personal data is Jan Sebastián Kostlán (FitVis Nutrition), Company ID (IČO) 30021456, registered address Dětřichov 273, 464 01 Dětřichov, sole trader registered in the Czech Trade Licensing Register, e-mail [email protected]. For any questions or requests regarding the processing of your personal data, contact us at [email protected]. We have not appointed a data protection officer (we are not required to).
2. What data we collect
Registration data (email, name), account and subscription data, data you enter into the App (meals, weight, goals, health and nutrition preferences), technical data (device type, OS version, anonymized usage analytics), and newsletter data (email address) if you subscribe to it. If you scan a meal or a label, we process that photo; if you attach a product photo to a food proposal, we store it. Some data does not come from you directly: with your consent we import it from Apple Health or Google Health Connect and from a connected glucose sensor, and an expert you invited into the App may record data about you (notes, tags, recommendations).
3. Purposes and legal basis
Health data (weight, measurements, diet, cycle, pregnancy, watch and glucose-sensor data) is a special category of data. We process it solely on the basis of your explicit consent (Art. 9(2)(a) GDPR), given in the app at first login; the app cannot be used without it and you can withdraw it by deleting your account. Registration data, settings and subscriptions are processed to perform the contract (Art. 6(1)(b) GDPR), security and abuse prevention under our legitimate interest (Art. 6(1)(f) GDPR), and analytics, marketing notifications and the newsletter only on the basis of your separate consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings or via the link in the e-mail. Recommendations, tips and scores in the App are computed automatically from your data; they serve only as information and have no legal or similarly significant effects on you. We do not carry out automated decision-making within the meaning of Art. 22 GDPR.
4. Retention period
Account data is kept for as long as the account exists. After a deletion request the account is suspended for 30 days (restorable by logging in) and then permanently erased together with all health records; accounts deleted by an administrator follow the same path. Daily watch summaries shared with an expert are deleted after 90 days. Meal and label photos from scanning are never stored. Payment records and tax documents are kept for 10 years as required by accounting and tax law. Operational logs are kept for at most 90 days and encrypted backups roll over continuously, at the latest within 30 days. A newsletter address you do not confirm within 30 days is deleted; after you unsubscribe we keep only a hash of the address instead of the address itself, so that we never e-mail it again. Product photos attached to food proposals become part of the FitVis database (see the Terms of Use) and are kept after account deletion; they are stored without camera metadata and without any link to your account.
5. Data sharing and processors
We do not share or sell personal data to third parties for their own marketing purposes. Our servers and databases run in the EU (Oracle Cloud, EU region). We also use these processors: Google Ireland / Google LLC – meal and label photo recognition (Gemini API), push notification delivery (Firebase Cloud Messaging); Apple – App Store payments; Google Play – payments; Stripe – web payments and invoicing; Cloudflare – product photo storage (R2); PostHog (EU-hosted) – usage analytics only with your consent; Resend – transactional e-mail delivery. Sign-in with Google or Apple ID is provided by Google and Apple as independent controllers under their own policies – they are not our processors; we receive only your name, e-mail and account identifier from them. A nutrition expert you invite yourself sees the data you share with them and is a separate controller of it. Data processing agreements under Art. 28 GDPR are in place with all processors. If you turn on “Help improve food recognition” in the app, we keep your scan photos without camera metadata for 12 months in Cloudflare storage (EU) solely to improve recognition and fill gaps in the food catalogue; they are never shown to other users, sold or handed to the AI vendor for its training, and you can withdraw at any time in Settings, which deletes them.
6. International transfers
Some processors (Google, Apple, Stripe, Cloudflare, Resend) may also process data outside the European Economic Area, in particular in the USA. Transfers rely on the Commission's adequacy decision (EU–US Data Privacy Framework) and on the standard contractual clauses approved by the European Commission. Analytics data (PostHog) and the app database itself stay in the EU.
7. Data security
We take reasonable technical and organizational measures to protect your data, including encrypted data transfer, password hashing, and restricted access to production systems limited to authorized personnel.
8. Your rights under GDPR
You have the right to access, rectify, erase, and restrict the processing of your personal data, the right to data portability, and the right to object to processing based on legitimate interest. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You can exercise your rights by emailing [email protected]; we will respond within 30 days at the latest.
9. Right to lodge a complaint
If you believe our processing of your personal data infringes GDPR, you have the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, e-mail [email protected], www.uoou.gov.cz – or with the supervisory authority in your country of habitual residence.
10. The fitvis.app website
On this website we process: (a) contact-form data (name, e-mail, phone, role) – to reply to your message (Art. 6(1)(b) GDPR); it is sent through our own mail server and kept for at most 12 months; (b) your IP address and technical request data in server logs – for security and rate limiting (Art. 6(1)(f) GDPR); the rate-limit counter lives only in memory for a few minutes and is not stored anywhere else; (c) your e-mail address and language for the newsletter – based on your consent confirmed via the link in the e-mail (Art. 6(1)(a) GDPR); e-mails are sent through the SMTP server of our e-mail service provider (see the processors above); we use no external newsletter platform. The site's icons are loaded from Iconify (api.iconify.design), which sees your IP address in the process. The website sets no analytics or marketing cookies – see the Cookie Policy.
11. Children
The App is not intended for individuals under 16 years of age, and we do not knowingly collect personal data from children under that age.
12. Changes to this policy
We may update this Policy from time to time. We will notify you of material changes within the App or by email. The current version is always available on this page.
Contact
If you have questions about data protection or want to exercise your rights, email us at [email protected]