Who is responsible for your data?
The data controller is Trisand (individual company, address: 7 rue des Grands Airs 31320 Péchabou France, siren: 941811846), publisher of Nurimoa (nurimoa.com website and app.nurimoa.com application).
For any question about your data or to exercise your rights: contacts@nurimoa.com.
What data is collected?
- Your account: email address, first name, last name (optional), password (stored hashed, never in plain text), language.
- Your health data: sex, age, height, weight, target weight, body measurements, body composition, basal metabolic rate, activity level, calorie and macronutrient goals. This is sensitive data within the meaning of Article 9 of the GDPR.
- Your journal: meals, foods and quantities, times, recipes, recurring meals and foods, physical activities.
- Your photos (plate, nutrition label, recipe), only when you use photo analysis: they are sent for analysis and are not kept by Nurimoa.
- The foods you create: they are shared by default with other users (name and nutritional values), without your name or any information about you.
- Your review, if you publish one: rating, text, date of first use, and your first name with the initial of your last name only if you agree to it.
- Your subscription: plan, dates, Stripe customer and subscription identifiers. Nurimoa never sees your card number: payment takes place on Stripe's page.
- Technical data: date of last login, dates on which you accepted the Terms and consented to the processing of your health data.
Why, and on what basis?
- Providing the service (account, journal, calculations, statistics, exports): performance of the contract (Terms). For your health data, in addition: yourexplicit consent, asked through a dedicated checkbox, separate from accepting the Terms.
- Analysing your photos with artificial intelligence: performance of the contract and your consent, since the analysis only runs when you start it.
- Managing your subscription and payments: performance of the contract and accounting obligations.
- Sending you service emails (signup, password, payment, inactivity, moderation of your review): performance of the contract.
- Protecting signup against bots: legitimate interest (security of the service).
- Publishing your review on nurimoa.com: your consent, which you can withdraw by deleting your review.
Your data is not sold, not used for advertising, and not shared with third parties for commercial purposes.
Who has access to it?
Nurimoa's publisher, and the following service providers (processors), only for what their task requires:
- OVHcloud (France, European Union): hosting of the application and database.
- Mailjet (France, European Union): sending emails.
- Anthropic (United States): artificial-intelligence analysis of photos, only when you use it. The transfer outside the European Union is governed by the European Commission's standard contractual clauses. Your photos are not used to train its models and Anthropic deletes them within 30 days, except where required by law or to combat misuse.
- Stripe (Ireland and United States): subscription payments.
- Cloudflare (United States): anti-bot check (Turnstile) at signup.
- YouTube (Google): only if you play a video on nurimoa.com. The video is only loaded on click, and YouTube may then set trackers.
Looking up a product by barcode queries Open Food Facts with that barcode only: no data about you is sent to it.
How long is it kept?
- As long as your account exists, for your account data, health data and journal.
- Inactive free or trial accounts: after 365 days without logging in, you are warned by email; without a new login, the account and all its data are deleted 15 days later.
- Deleting your account, from your profile, at any time: your data is erased, your review included. It may remain in the database backups, made every night and kept for 3 days, that is 3 days at most.
- Photos: not kept by Nurimoa once the analysis is done.
- Billing data: 10 years, as required by accounting obligations.
Cookies and storage in your browser
Nurimoa uses no advertising cookies and no analytics tools. The application and the website only store in your browser what they need to work, which does not require your consent:
- Your session (application): your login token and the account information needed for display, until you log out or the session expires.
- Your language (application and website): to show the language you chose.
The third-party services mentioned above (Cloudflare at signup, Stripe at payment, YouTube when playing a video) apply their own rules.
Your rights
At any time, you can:
- access your data and correct it, directly in the application;
- erase it, by deleting your account from your profile;
- get it back in a reusable format (portability): CSV export from the application whatever your plan (plus a PDF report on paid plans), or simply on request by email;
- withdraw your consent to the processing of your health data: as it is essential to the service, this means deleting your account;
- ask for a processing to be restricted, or object to it;
- set instructions on what happens to your data after your death.
Write to contacts@nurimoa.com: you will get an answer within one month. If you believe your rights are not respected, you can lodge a complaint with theCNIL.
Security
Exchanges are encrypted (HTTPS), passwords are stored hashed (irreversibly) and access to data is restricted to the publisher and the service providers listed above.
Minimum age
As Nurimoa processes health data, the application is reserved for adults (18 and over).
Changes
This policy may change along with the service. The date of the last update is shown at the top of this page; in case of a significant change, you will be informed in the application.