Privacy Policy

This Privacy Policy explains how Nuri App Ltd ("Nuri," "we," "us") collects, uses, shares, and protects personal data when you use the Nuri mobile app (the "App").

This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and applicable data protection laws in jurisdictions where we operate. Specific notices for residents of California, Brazil, Canada, and other regions appear below.

SPECIAL CATEGORY DATA

Because the App serves women managing health conditions, you may share information about your health (including diagnoses, allergies, medications, pregnancy status, symptoms you log, or data from Apple Health). This is "special category" personal data under GDPR/UK GDPR and is treated with additional safeguards. We process this data only with your explicit consent or another lawful basis, and you may withdraw consent at any time.

1. Data Controller

The data controller is Nuri App Ltd, registered at 167-169 Great Portland Street, London, England, W1W 5PF, company number 17351532. You can contact us at join@nurirecipes.com.

2. Personal Data We Collect

Account data: name, email address, password (hashed), date of birth or age confirmation, profile photo, country.
Health and dietary data (special category): health conditions, allergies, intolerances, dietary preferences, food restrictions, weight (if voluntarily entered), symptoms you log in the App. Only collected with your explicit consent.
Apple Health data (optional): If you choose to connect Apple Health, Nuri reads your menstrual cycle and step count data to personalise your recipe recommendations. This data is processed on your device only. We do not upload, store or keep a copy of your Apple Health data on our servers, we never share it with third parties, and we never use it for advertising or marketing. The only thing we record is whether you've connected Apple Health. You can disconnect at any time in your iPhone's Settings → Privacy & Security → Health → Nuri.
Device and app data: device model, operating system version, app version, language, time zone, crash logs and diagnostics, IP address, and approximate location derived from your IP address.
Usage data: screens viewed, recipes saved or rated, search queries, features used, and time spent in the App.
Purchase data: if you subscribe in the App, payment is handled by Apple. We receive your subscription status and transaction details, not your card details.
Notification data: if you allow push notifications, a device token so we can send them.
Communications data: messages you send to support, survey responses, content of reviews and comments.

3. How We Use Your Data and Lawful Bases

Under GDPR/UK GDPR we must have a lawful basis for each use of your data:

Provide the service (contract, Art. 6(1)(b)): create and manage your account, deliver content, manage subscriptions.
Personalise recipe recommendations based on your health profile, symptom logs, and Apple Health data if connected (explicit consent, Art. 6(1)(a) and Art. 9(2)(a) for health data). You may withdraw consent at any time in the App's settings.
Send push notifications you have opted into (consent). Turn them off anytime in iPhone Settings.
Improve and secure the App (legitimate interests, Art. 6(1)(f)): analytics, crash reporting, debugging, abuse prevention. We balance these interests against your rights.
Marketing communications (consent or, where permitted, soft opt-in legitimate interests). You can unsubscribe anytime.
Comply with legal obligations (legal obligation, Art. 6(1)(c)): tax, accounting, regulatory requests.
Establish, exercise, or defend legal claims (legitimate interests; for health data, Art. 9(2)(f)).

4. Automated Decision-Making

We may use automated systems to suggest recipes based on your stated preferences and health data. These suggestions do not have legal or similarly significant effects on you, and you can always ignore or override them. You can turn off personalisation in the App's settings.

5. How We Share Your Data

We do not sell your personal data. We share data only with:

Service providers acting as our processors under contract, including Supabase (database, authentication, and hosting), Apple (App Store purchases),
Authorities, when required by law, court order, or to protect rights and safety;
Successors in a merger, acquisition, or asset sale, subject to equivalent privacy commitments.

Apple Health data is never used for advertising or marketing, never sold, never shared with third parties except the processors needed to run the features you use, and never stored in iCloud.

A current list of key sub-processors is available on request by emailing join@nurirecipes.com.

6. International Data Transfers

Because we operate internationally, your data may be transferred to and processed in countries outside your country of residence, including the United States, the United Kingdom, and the EU. Our primary database is hosted by Supabase in Ireland (EU).

Where we transfer personal data out of the EEA, UK, or other regulated regions, we use appropriate safeguards: the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, adequacy decisions, or equivalent mechanisms. You may request a copy of the relevant safeguards by writing to join@nurirecipes.com.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

Account data: while your account is active and for 12 months after closure, then deleted or anonymised;
Health, symptom data: deleted within 30 days of account deletion or withdrawal of consent, except where retention is required by law;
Transaction and tax records: 7 years to meet tax and accounting obligations;
Marketing data: until you unsubscribe, plus a short suppression record to honour your opt-out;
Backups: rotated out within 90 days.

Data the App stores on your phone is removed when you delete your account or the App.

8. Your Rights

Subject to applicable law, you have the following rights:

Access: request a copy of your personal data.
Rectification: correct inaccurate or incomplete data.
Erasure ("right to be forgotten"): ask us to delete your data, subject to legal exceptions.
Restriction: limit how we process your data while a dispute is resolved.
Portability: receive your data in a structured, machine-readable format and transmit it to another controller.
Objection: object to processing based on legitimate interests or for direct marketing.
Withdraw consent: where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.
Lodge a complaint with your supervisory authority (e.g., ICO in the UK, your national Data Protection Authority in the EU). We'd appreciate the chance to address your concerns first.
Delete your account in the App: Profile > Settings > Delete account. This deletes your account and associated data as set out in Section 7. Deleting your account does not cancel an App Store subscription; cancel it in iPhone Settings.

To exercise any other right, email join@nurirecipes.com. We will respond within one month, extendable by two months for complex requests.

9. Security

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit (TLS) and at rest, role-based access controls, periodic security reviews, and vendor due diligence. No system is 100% secure; if we suffer a breach affecting your data, we will notify you and the relevant authority where required by law.

10. Age Requirement

The App is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has provided us with personal data, contact join@nurirecipes.com and we will delete it.

11. Cookies and Tracking

The App does not use cookies. It does not track you across apps and websites owned by other companies, and we do not use your device's advertising identifier.

12. Device Permissions

The App may ask for the following permissions. Each is optional, and you can change it at any time in iPhone Settings:

Apple Health: to personalise recipes using the health data you choose to share.
Notifications: to send reminders and updates you've opted into.

13. Region-Specific Notices

California (CCPA/CPRA): you have the right to know what personal information we collect, to delete it, to correct it, to limit use of sensitive personal information, and to opt out of any "sale" or "sharing" for cross-context advertising. We do not sell or share personal information, including that of users under 18. To exercise these rights, email join@nurirecipes.com.
Brazil (LGPD): you have rights of confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. Contact us at join@nurirecipes.com.
Canada (PIPEDA / Quebec Law 25): you may access and correct your personal information and file a complaint with the Office of the Privacy Commissioner of Canada or the CAI in Quebec.
Other regions: additional rights may apply under your local law. Contact join@nurirecipes.com to learn more.

14. Health Data Specific Notice

Nuri is not a healthcare provider and is not a HIPAA "covered entity" in the United States. The health-related data you share with us, including symptom logs and Apple Health data, is treated as sensitive personal data under GDPR/UK GDPR and equivalent regimes. We never use it to decide insurance eligibility, employment, or credit. We will not share it with third parties for marketing purposes.

15. Changes to This Policy

We may update this Privacy Policy. If changes are material, we will notify you by email or in-app notification at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

16. Contact Us

Questions, requests, or complaints? Email join@nurirecipes.com or write to 167-169 Great Portland Street, London, England, W1W 5PF, attention: Privacy. This address is our registered office for statutory purposes only; for all correspondence, please use email.