Privacy policy
Last updated 23 September 2026
This policy explains how Nutivio collects, uses, shares and protects your personal data when you use the Nutivio mobile app and the Nutivio website, and the rights you have over that data. We have tried to write it plainly. If anything is unclear, please contact us using the details in section 14.
1. Who we are
Nutivio is a product and service operated by TASKWREN LIMITED, a private limited company registered in England and Wales (company number 17389116), whose registered office is at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Nutivio", "we", "us", "our").
We are registered with the UK Information Commissioner's Office (ICO) as a data controller under registration reference ZC232056.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the controller of the personal data described in this policy. Where you are in the European Economic Area, the EU General Data Protection Regulation (EU GDPR) may also apply, and this policy is written to meet both.
You can contact us about privacy at privacy@nutivio.com, and about anything else at support@nutivio.com.
2. The short version
- We collect only what we need to run Nutivio for you.
- We do not show advertising, we do not sell your personal data, and we do not share it with food brands, retailers or data brokers.
- Payments are handled by Apple or Google. We never see your card details.
- You can export your data and delete your account yourself, from within the app, at any time.
3. The personal data we collect
3.1 Account data. When you create an account we collect your first name, email address and password. Your password is never stored in readable form: we keep only a one-way cryptographic hash of it. We also record whether and when your email address was verified, and when your account was created.
3.2 Sign-in and security data. For each device you sign in on, we keep a session record containing the device name (if your device provides one), when the session was created and when it was last used. We store short-lived, single-use codes (in hashed form) when you verify your email, reset your password or change your email address.
3.3 Food preferences. If you have Premium, the preferences you choose in the app, such as allergens you wish to avoid, a vegetarian or vegan diet, avoiding palm oil, or monitoring sugar or salt. Some of these, particularly allergens, may indicate something about your health. See section 5 for how we treat them.
3.4 Scan history and favourites. The barcodes you scan (and the time of each scan), whether a scan was made with the camera or entered manually, and the products you save as favourites.
3.5 Search history. If you have Premium and use search, your recent search terms, so that you can see and reuse them. You can clear them at any time.
3.6 Reports, missing products and uploads. When you report a problem with a product or submit a product that is missing from our database, we collect the barcode, the details you enter, and any photos you upload. Photos should show the product and its packaging; please do not include people or personal documents in them.
3.7 Support requests and diagnostics. When you contact us through the app, we collect your message, the topic you choose, any product barcode or screenshot you add, and diagnostic information about your device: app version, platform (iOS or Android), operating system version, device model and language setting. We do not collect the contents of other apps or files on your device.
3.8 Subscription data. If you subscribe to Premium, we receive information about your subscription from our subscription provider (RevenueCat) and, through it, from the Apple App Store or Google Play: the plan, its status (for example trial, active, in a billing grace period, cancelled or expired), start, renewal and expiry dates, the store used, and whether your account has used a free trial. We do not receive your card or bank details, and we do not see your Apple ID or Google account password.
3.9 Technical logs. When the app or website communicates with our servers, our systems automatically record technical information needed to operate and secure the service, such as request times, the address requested, response codes, request identifiers, app version, platform and IP address. Our logs are designed not to contain passwords, sign-in tokens or the content of your data.
3.10 Data stored on your device (offline mode). If you have Premium, the app keeps a copy of products you have scanned, saved or favourited on your device so you can view them without a connection. This offline copy holds up to 500 products, each for up to 30 days, together with the preference alerts shown for them. It is stored on your device in encrypted form, is not shared with anyone, and is removed when you sign out. You can also clear it at any time in Account → Offline mode → Clear offline data.
3.11 Information we do not collect. We do not collect your precise location, contacts, photos library (other than photos you choose to upload), advertising identifiers or payment card details. The camera is used only to read barcodes and to take photos you choose to send us; camera images used for scanning are processed on your device and are not sent to us.
4. How we use your data and our lawful bases
Data protection law requires us to have a lawful basis for each use of your personal data.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, signing you in, verifying your email, resetting your password | Account data, sign-in and security data | Performance of our contract with you (our terms of use) |
| Providing the app's features: scanning, scores, history, favourites, the My food overview, better alternatives | Scan history, favourites | Performance of contract |
| Providing Premium (search, food preference alerts and offline mode), checking whether you are entitled to Premium, and managing free trials (one per account) | Subscription data, search history, food preferences, the offline copy stored on your device | Performance of contract; for allergen and health-related preferences, your explicit consent (see section 5) |
| Answering support requests | Support requests, diagnostics, account data | Performance of contract, and our legitimate interest in helping users and fixing faults |
| Reviewing product reports and missing products, and correcting product data | Reports, uploads, barcode | Our legitimate interest in keeping product information accurate for all users |
| Sending essential service emails (verification codes, password resets, email change confirmations, important changes to our terms or this policy) | Email address, first name | Performance of contract; legal obligation where we must notify you |
| Keeping Nutivio secure, preventing abuse and fraud (including repeated free trials), and diagnosing faults | Sign-in and security data, technical logs, subscription data | Our legitimate interest in running a secure, reliable service |
| Understanding how the service performs in aggregate (for example, how many scans succeed) | Technical logs and service records, in aggregated form | Our legitimate interest in improving Nutivio |
| Keeping financial records and complying with legal requests | Subscription transaction records | Legal obligation |
Where we rely on legitimate interests, we have considered your interests and rights and concluded they are not overridden. You can ask us for details of that assessment and you can object (see section 10).
We do not use your data for advertising, we do not build advertising profiles, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The Nutivio Score is calculated about products, not about you, and your preferences never change it.
5. Food preferences that may reveal health information
Some food preferences, such as an allergen you avoid, could reveal information about your health, which data protection law treats as a special category of data. We process these preferences only to show you alerts and to tailor better alternatives, and only because you choose to enter them, which we treat as your explicit consent.
You can withdraw consent at any time by switching the preference off in Account → Food preferences. This does not affect anything we did before you withdrew it. We never use preferences for advertising and never share them with brands.
6. Who we share your data with
We share personal data only with the service providers we need to run Nutivio ("processors"), and only as much as each one needs. They act on our instructions under written contracts, must keep your data secure, and may not use it for their own purposes.
| Provider | What they do for us | Data involved |
|---|---|---|
| Railway | Hosts our servers and database | All data held by the service |
| Cloudflare (R2) | Stores uploaded photos and screenshots | Uploaded images and associated file details |
| Our transactional email provider | Delivers verification, password-reset and service emails | Email address, first name, email content |
| RevenueCat | Manages subscriptions and confirms Premium status with the stores | Your Nutivio account identifier (a random ID, not your email) and subscription data |
Apple and Google. When you subscribe, you buy the subscription from Apple (App Store) or Google (Google Play) under their own terms and privacy policies. They process your payment details and share subscription status with us through RevenueCat. Apple and Google are independent controllers of the data they process for payments.
Open Food Facts. Product information comes from Open Food Facts. We do not send your personal data to Open Food Facts when you scan.
We may also disclose personal data where required by law, to respond to valid legal requests from authorities, to protect the rights, safety and property of our users or others, or as part of a sale or reorganisation of our business, in which case the recipient would be bound by this policy.
We do not sell personal data.
7. International transfers
Some of our providers are based in, or store data in, countries outside the UK and the European Economic Area, including the United States. When personal data is transferred outside the UK or EEA, we make sure it is protected by an approved safeguard, such as:
- a UK adequacy decision (for example the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified);
- the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
- for EEA users, the EU Standard Contractual Clauses.
You can ask us for more information about the safeguards used for a particular provider.
8. How long we keep your data
We keep personal data only for as long as we need it for the purposes in this policy.
| Data | How long |
|---|---|
| Account data, food preferences, scan history, favourites | Until you delete them or delete your account |
| Search history | Until you clear it or delete your account |
| Sign-in sessions | Until you sign out or the session expires (30 days after last use); expired session records are deleted within 90 days |
| Offline copy on your device (Premium) | Up to 500 products, each for up to 30 days; removed when you sign out or clear it |
| Verification and reset codes | Expire after 15 minutes; deleted shortly afterwards |
| Support requests and their diagnostics and screenshots | 24 months after the request is closed, then deleted |
| Product reports, missing-product submissions and their photos | As long as they are relevant to the product record. When you delete your account, they are separated from your account so they no longer identify you |
| Uploads that were started but never completed | Deleted automatically by a routine clean-up |
| Subscription transaction records | Up to 6 years after the end of the financial year they relate to, to meet UK tax and accounting obligations |
| Technical logs | Up to 30 days, unless needed longer to investigate a specific security incident |
| Backups | Overwritten on a rolling cycle of up to 35 days |
When you delete your account, we delete or anonymise your personal data promptly, except where we must keep it for the reasons above. Deleted data may remain in backups until they are overwritten; we do not restore it from backups except to recover from a serious incident, and would delete it again if we did.
9. How we protect your data
We use appropriate technical and organisational measures, including encryption of data in transit, hashing of passwords with a modern memory-hard algorithm, short-lived sign-in tokens that can be revoked, access controls that limit our staff to the data their role requires, audit logging of administrative actions, and logging designed to exclude sensitive values. No system is perfectly secure, but we work to protect your data and will notify you and the regulator of a personal data breach where the law requires.
10. Your rights
Under data protection law you have the right to:
- access the personal data we hold about you;
- rectification of data that is inaccurate or incomplete;
- erasure of your data;
- restrict our processing in certain circumstances;
- object to processing based on our legitimate interests;
- data portability, receiving your data in a structured, machine-readable format;
- withdraw consent at any time where we rely on consent.
Many of these you can exercise yourself in the app:
- Export your data: Account → Privacy → Export my data.
- Correct your details: Account → Personal information.
- Change your food preferences: Account → Food preferences.
- Delete history items or all history: in the History tab.
- Delete your account and data: Account → Privacy → Delete my account.
For anything else, contact us at privacy@nutivio.com. We will respond within one month, and may need to confirm your identity first. Exercising your rights is free, unless a request is manifestly unfounded or excessive.
Complaints. If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, or, if you are in the EEA, to your local data protection authority.
11. Children
Nutivio is not directed at children. You must be at least 13 years old to create an account. In countries where a higher age applies to consenting to online services (up to 16 in some EEA countries), you must meet that age or have permission from a parent or guardian. We do not knowingly collect personal data from children below these ages. If you believe a child has created an account, please contact us and we will delete it.
12. Cookies and similar technologies
The app does not use cookies or any similar technology for tracking or advertising, and contains no advertising or third-party analytics trackers. It stores sign-in tokens securely on your device so that you stay signed in, and may keep a small amount of data on your device so the app works smoothly, including the encrypted offline copy described in section 3.10.
The website (nutivio.com) sets no cookies of its own and uses no analytics, advertising or tracking. Our network provider, Cloudflare, may set a short-lived security cookie (__cf_bm or cf_clearance) when it needs to check for automated traffic. The staff admin panel uses a sign-in cookie and a display-setting cookie. All of these are strictly necessary, so they do not require consent, but you can block or delete them in your browser settings. The full list is at nutivio.com/cookies.
13. Changes to this policy
We may update this policy from time to time, for example when we add a feature or change a provider. The date and version at the top show when it was last changed. If we make a significant change, we will tell you in the app or by email before it takes effect.
14. Contact us
- Privacy questions and requests: privacy@nutivio.com
- General support: support@nutivio.com, or in the app at Account → Help centre
- Post: TASKWREN LIMITED, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom