1. Data controller
The controller for the processing of personal data within the meaning of the GDPR is:
Arc Nova GmbH, Wulfter Heide 5, 49082 Osnabrück, Germany
Email: n.seidel@arc-nova.io
Represented by Nick Sebastian Seidel.
2. Categories of data we process
- Account data: email address, display name, hashed password, language preference.
- Profile & dietary data: dietary preferences, allergies, goals (calories, macros), diary entries.
- Content data: recipes, cookbooks, meal plans, shopping lists, images.
- AI inputs: the text / URLs you send to the AI and the resulting responses.
- Support correspondence: emails you send to our support.
- Technical data: IP address, browser/OS, timestamps, error logs (security and reliability).
- Cookies / local storage: sign-in, language preference, session management — no marketing cookies.
3. Purposes and legal bases
- Performance of the contract (Art. 6(1)(b) GDPR): providing the service, account and subscription management, AI features.
- Legitimate interests (Art. 6(1)(f) GDPR): operational security, abuse and fraud prevention, product improvement, logging.
- Consent (Art. 6(1)(a) GDPR) for optional processing where collected.
- Legal obligations (Art. 6(1)(c) GDPR), e.g. retention of tax-relevant records.
4. Recipients / processors
We work with the following service providers:
- Supabase — database, authentication, storage (EU hosting where possible).
- Paddle.com Market Ltd — Merchant of Record for all payments, subscription management, invoicing and sales-tax compliance. Paddle is an independent controller for payment processing.
- Lovable Cloud / Cloudflare — hosting of the web app and edge functions.
- Lovable AI Gateway and underlying AI providers (e.g. OpenAI, Google) for AI generation.
- Tax / legal advisors where necessary, and authorities where required by law.
5. International transfers
Some providers are located outside the EU/EEA (e.g. USA). Transfers are based on the EU Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, an adequacy decision (EU-U.S. Data Privacy Framework).
6. Retention
Account and content data are stored while your account exists. After deletion we delete or anonymise personal data within 30 days, unless statutory retention obligations apply (e.g. commercial and tax retention periods of up to 10 years for invoice data held by Paddle as Merchant of Record).
7. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
- Complaint to a supervisory authority, e.g. the State Commissioner for Data Protection of Lower Saxony (Germany).
To exercise your rights, an informal email to n.seidel@arc-nova.io is sufficient.
8. Security
We use appropriate technical and organisational measures, in particular encryption in transit (TLS) and at rest, access controls, logging and regular updates.
9. Cookies and local storage
We use strictly necessary cookies and browser local storage for sign-in, session management and language preference. We currently do not use marketing or tracking cookies. If we ever introduce analytical cookies, we will obtain your prior consent.
10. Changes to this Privacy Notice
We may update this Privacy Notice when the service or legal requirements change. The current version is always available on this page.
Contact
Privacy questions: n.seidel@arc-nova.io.