Privacy Policy

Nutrition Budget by Zinzino · Version 1.0 — Draft · Effective: 14 August 2026

DATA CONTROLLER

ZINZINO AB

SOLD TO ADVERTISERS

NEVER

NUTRITION INSIGHTS

CONSENT ONLY

PRIMARY STORAGE

UNITED STATES

DELETE EVERYTHING

ON REQUEST

COMPLAINTS

IMY.SE

§1 What is a privacy policy?

In this privacy policy, we explain who is responsible for the processing of personal data that occurs when you use Nutrition Budget. We describe which personal data we process when you provide information to us in various situations, how and why we process it, what legal support we rely on to justify the processing, and which third parties may process personal data so that we can provide the Service. You also receive information about your rights and how to exercise them.

§2 Important terms

"Personal Data" means any information relating to an identified or identifiable natural person — for example a name, an identification number, location data, an online identifier such as an IP address, or factors specific to a person's physical, physiological, genetic, psychological, financial, cultural or social identity.

"Processing" means any operation performed on personal data, such as collection, registration, structuring, storage, adaptation, use, disclosure, combination, restriction, erasure or destruction.

§3 Who is responsible for the processing?

Zinzino AB (publ), Hulda Mellgrens gata 5, SE-421 32 Västra Frölunda, Sweden, is the data controller for the processing described in this policy ("we"). "You" means the person using Nutrition Budget.

You can reach us and our data protection function at [email protected].

§4 Which data we process, why, and on what legal basis

We only process the personal data necessary for the purposes below, and we collect it directly from you — when you register, and when you submit receipts, barcodes and images. Providing Account Data is necessary for us to enter into and perform the agreement with you; everything beyond that is your choice. If you have a Zinzino Partner, the app shows their name, photo and any contact details they publish, read from their page on Zinzino's shop when you look at them; Nutrition Budget does not store these details.

<table> <caption>Data we process, why, and on what legal basis</caption> <thead> <tr> <th scope="col">Category</th> <th scope="col">What it includes</th> <th scope="col">Purpose &amp; legal basis</th> </tr> </thead> <tbody> <tr> <td>Account Data</td> <td>Name, email address, country, language, time zone, login details, and the activation code you joined with (the ID of the Zinzino Partner whose link or code you used) and how it was set.</td> <td>Creating and maintaining your account, directing shop links to your Zinzino Partner, providing customer service. <em>Contract — Art. 6(1)(b)</em></td> </tr> <tr> <td>Basket Data</td> <td>Digital receipts, scanned paper receipts, barcode scans, retailer and product names, purchase dates and amounts, supplements you record, your shopping list, and foods you hide or mark as already at home.</td> <td>Itemizing purchases and computing your nutrition budget — the core Service. <em>Contract — Art. 6(1)(b)</em></td> </tr> <tr> <td>Image Data</td> <td>Photos you take of receipts, loose produce and meals.</td> <td>Recognizing items and estimating quantities; images are processed for recognition and are not used for any other purpose. Nutrition Budget does not store your photos: each one is read once and discarded, and only the items read from it are kept. <em>Contract — Art. 6(1)(b)</em></td> </tr> <tr> <td>Derived Nutrition Data</td> <td>Estimated intake of protein, vitamins, minerals, fiber, omega-3 and similar, and trends over time; and the household details you give to size it: for each person, including children, an age range, sex, activity, training and weight goals, pregnancy or nursing, an optional first name, and which supplements they take and how many a day; and your household's diet.</td> <td>Showing your funded, underfunded and empty nutrient lines. Because these insights can indicate information about your health, we process them only with your explicit consent, which you give in the app and can withdraw at any time. <em>Explicit consent — Art. 9(2)(a)</em></td> </tr> <tr> <td>User Data</td> <td>Technical information such as IP address, the country you connect from, device and operating system type and version, time settings, selected language, app events and crash logs; feedback you send from the app; and, before you sign in, a cookie that keeps track of your free report and any activation code you arrived with.</td> <td>Sign-in, security, keeping information accurate, and developing and improving the Service and the IT systems used to provide it. <em>Legitimate interest — Art. 6(1)(f)</em></td> </tr> <tr> <td>Marketing Data</td> <td>Contact details and service usage relevant to offers.</td> <td>Promoting our services to you, with the right to object at any time. <em>Legitimate interest — Art. 6(1)(f)</em></td> </tr> <tr> <td>Legal Data</td> <td>Records we must keep, e.g. accounting records.</td> <td>Fulfilling legal obligations, to the extent and for the time specified by law. <em>Legal obligation — Art. 6(1)(c)</em></td> </tr> </tbody> </table>

§5 How long we keep the data

Account, Basket and Derived Nutrition Data are processed for as long as your customer relationship with us remains in effect. If you ask us to delete your account, they are deleted or anonymized without undue delay, except where law requires longer retention. Image Data is not kept: a photo is discarded once the items on it have been read (see §7.2 for what our AI provider may keep).

Data processed for marketing purposes is processed for a maximum of one year after your customer relationship has ended. Data retained under legal obligations (such as accounting records) is kept for the period specified by law.

§6 Consent and the right to be forgotten

Where processing is based only on your consent — including Derived Nutrition Data — you may withdraw that consent at any time by contacting us. If you withdraw consent, the personal data processed only on that basis will be deleted (the "right to be forgotten"). If the data is also processed for other purposes, it will simply no longer be processed for the consent-based purpose.

Because Derived Nutrition Data is the core of the Service, withdrawing that consent means Nutrition Budget can no longer show you a nutrition budget; your account otherwise remains yours.

§7 Who can receive your data

Your personal data is primarily processed internally within Zinzino and by companies in the same group. In relevant parts it may be provided to suppliers who help us produce and deliver the Service — for example cloud hosting providers, sign-in providers, receipt and barcode data providers, customer service systems, and the issue tracking system where we sort the feedback you send from the app — who process it as our data processors under data processing agreements.

Every photo you take or pick, and any receipt text you paste, is sent to an AI model to read the items on it, and the name of an item we cannot find in our own datasets may be sent to it to estimate its nutrition. The model runs on Microsoft Azure under our own account. We minimize what is shared for this purpose and do not permit these providers to use your data to train their models. Microsoft's automated abuse monitoring may keep a request it flags for up to 30 days for human review. When you scan a barcode, only its number is sent to public product databases (Open Food Facts and the US National Institutes of Health's Dietary Supplement Label Database) to look the product up.

We may also disclose data where required to fulfil obligations under law or decisions of governmental authorities, or to prevent illegal use of the Service.

§8 Where your data is stored

Your personal data is stored in IT infrastructure provided by our data processors, in the United States. Microsoft Azure, in its East US 2 region, runs the Service and its AI model and holds the Service's database and the feedback you send. Clerk, a US company, handles sign-in and holds your login details. GitHub, where we sort feedback, keeps the reports we track there. Cloudflare carries traffic between your device and the Service. Microsoft may serve an AI request from a data center in another region, but stores the data at rest in the United States.

§9 Transfers outside the EU/EEA

Because your personal data is stored in the United States (see §8), using Nutrition Budget transfers it outside the EU/EEA. Some of our processors, for example cloud and AI service providers, may also process data in other countries outside the EU/EEA, including Canada.

For Canada, the European Commission has decided that an adequate level of protection exists. For transfers to the United States and other third countries without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses, supplemented where relevant by the EU–US Data Privacy Framework for certified recipients. You can obtain information about these safeguards, and copies of relevant clauses, by contacting us.

§10 Your right of access

You are entitled to information about the data we process about you and a copy of that data, free of charge, by contacting us. For additional copies we may charge an administrative fee corresponding to our costs.

§11 Correction and deletion

If you believe any data about you is incorrect, you are entitled to request that it be corrected or deleted. Contact us and tell us what you believe is incorrect and why. You can also correct misread receipt items directly in the app.

§12 Your right to object

You are entitled to object to processing based on legitimate interest (see §4). For marketing, you may object at any time, and your data will then no longer be processed for marketing purposes. For other objections, we will weigh your grounds against our reasons for continuing.

§13 Restriction of processing

You may request that processing of your personal data be limited (frozen) — for example while we verify data you believe is incorrect, where processing would be unlawful, where we no longer need the data but you need it for a legal claim, or while an objection from you is being assessed.

§14 Data portability

You are entitled to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transfer it to another controller, where the processing is based on your consent or on our agreement with you. To receive this export, including your basket history and nutrition ledger, contact us (see §17).

§15 Complaints

We take your privacy seriously and want your personal data to always be processed properly and securely. If you have comments on our handling of personal data, please contact us.

If you believe our processing is incorrect in some manner, you are entitled to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), the supervisory authority for these matters. More information is available at imy.se. You may also contact the supervisory authority in your own EU/EEA country.

§16 Children's privacy

Nutrition Budget is not targeted towards, nor intended for use by, anyone under the age of 18. By using Nutrition Budget you represent that you are 18 years of age or older. If we become aware that a registered user is under 18, we will cancel the registration and delete the associated data.

§17 Contact

Zinzino AB (publ), Hulda Mellgrens gata 5, SE-421 32 Västra Frölunda, Sweden · [email protected].