Privacy Policy

Last Updated: February 2026

1. Introduction

Ideava Ltd ("we", "us", "our") operates the Nouviva food diary and nutrition tracking application ("Service"). We are committed to protecting your privacy and being transparent about how we collect, use, and protect your personal data.

This Privacy Policy explains:

What personal data we collect
How we use your data
Who we share your data with
Your rights regarding your data
How we protect your data

Company Details:

Company Name: Ideava Ltd
Registration: England and Wales
Company Number: 16905030
Registered Office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Data Protection Contact: https://nouviva.com/contact

2. Legal Basis and Controller

Ideava Ltd is the data controller for the personal data processed through the Nouviva Service. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. Information We Collect

3.1 Essential Account Information

What we collect:

Email address (required for account creation and communication)
Password (stored encrypted)
Account creation date and last login
Subscription plan type (Free, Premium, or Pro)

Legal basis: Contractual necessity (to provide the Service)

3.2 Optional Personal Information

What we may collect (if you choose to provide it):

Display name or username
Dietary preferences (vegetarian, vegan, pescatarian, etc.)
Dietary goals (weight loss, muscle gain, maintenance, etc.)
Allergies or food restrictions (nuts, dairy, gluten, etc.)
Food preferences and dislikes
Age or age range
Gender
Location (country/region/postcode area only)
Household information (number of adults and children in household)
Shopping preferences (preferred stores, weekly budget, shopping frequency)
Cooking habits (skill level, time constraints, batch cooking preferences)
Meal kit usage (current and past meal kit services)
Health conditions (if you choose to share)
Supplements currently used
Weight information (current weight and target weight, if provided)
Exercise habits and preferences

Legal basis: Consent (you explicitly choose to provide this information)

Important: You are never required to provide optional personal information. The Service works with just an email address. Optional information helps personalize your experience but is entirely your choice. Health and weight data are considered sensitive personal data and are only collected if you voluntarily provide them.

3.3 Food Diary, Recipes, and Activity Data

What we collect:

Food diary entries (meals, snacks, drinks, descriptions)
Exercise and activity logs (type, duration, intensity, steps, calories burned)
Timestamps of all entries (date and time)
Nutrition scores and AI-generated insights for your entries
AI-generated recommendations and suggestions
Weekly summary reports and personalized recommendations
Personal notes you add to diary days
Saved recipes (your own creations and AI-generated recipes)
Recipe photos you upload
AI-generated recipe images (via DALL-E)
Recipe ingredients, instructions, and nutrition information
Meal plans (weekly meal planning data)
Shopping lists (items, quantities, affiliate product links)
Achievement progress and milestones
Streak tracking (current streak, longest streak)
Points and gamification progress
Virtual garden progress (decorative feature)
App usage patterns (features used, time spent)
Device type and browser information
Storage usage tracking (for uploaded photos)

Legal basis: Contractual necessity and legitimate interests (improving the Service)

3.4 Payment Information

What we collect:

Billing name and address
Last 4 digits of payment card
Payment transaction history
Subscription plan and billing cycle
Monthly top-up credits (for pay-as-you-go features)
Credit usage and remaining balance
VAT number (if provided)

Important: We do NOT store full payment card details. Payment processing is handled by our third-party payment processor (Stripe) who stores payment information securely in compliance with PCI DSS standards.

Legal basis: Contractual necessity (to process payments)

3.5 Technical and Analytics Data

What we collect automatically:

Browser type and version
Device type (desktop, mobile, tablet)
Operating system
Pages visited and features used
Error logs and performance data
Cookie data (see Section 8)
AI API usage (models used, tokens consumed, costs)
Feature usage tracking (for rate limiting and fair usage)
Account status (banned status, if applicable, for moderation)

Admin Audit Logs (for security and compliance):

IP address (collected only when admin actions are performed)
User agent
Admin action performed
Timestamp

Important: IP addresses are only logged for administrative audit trails (when admins perform actions on accounts) and for security purposes. We do not routinely collect or store IP addresses for regular user activity.

Legal basis: Legitimate interests (maintaining security, improving Service, analytics, compliance)

3.6 Communication Data

What we collect:

Support ticket history
Email correspondence with us
Feedback and survey responses

Legal basis: Legitimate interests (customer support) and consent (where applicable)

3.7 Family and Child Profiles (Optional Feature)

IMPORTANT NOTICE ABOUT CHILD DATA:

If you use the Family Feature to track nutrition for your children, you must understand and accept the following:

1. Parental Supervision Required:

You MUST provide direct adult supervision when children use this feature
Children under 18 must NEVER use the Service independently or unsupervised
The Service is NOT designed for unsupervised use by children
You are responsible for monitoring all use of child tracking features

2. AI Approximations Apply to Child Data:

All nutrition information for children is AI-generated and approximate
The AI cannot accurately measure portions or assess children's specific nutritional needs
Children's nutritional requirements vary significantly by age, activity level, and development
You MUST consult pediatricians or registered pediatric dietitians for children's nutrition advice
Never make dietary decisions for children based solely on AI approximations

What we collect about children:

Child's first name or nickname
Child's age or age range
Child's dietary restrictions and allergies
Child's food preferences and dislikes
Food diary entries logged for the child
Exercise entries for the child
AI-generated nutrition insights and scores for the child's meals
Achievement progress for the child
Timestamps and usage patterns

Legal basis: Parental consent and legitimate interests (providing family nutrition tracking)

Important Parental Rights and Responsibilities:

Only parents or legal guardians should create and manage child profiles
By creating a child profile, you confirm you have parental authority for that child
You consent to processing your child's nutrition data through our AI systems
You acknowledge that all child nutrition data is approximate and not reviewed by pediatric nutrition professionals
Child profiles are linked to and controlled entirely by your parent account
You can view, modify, or delete child profiles and all associated data at any time
Child data is subject to the same security protections as adult data
Children cannot create their own accounts - the minimum age for accounts is 18
Child data is never shared, sold, or used for marketing purposes
You can export your child's data or delete it completely through your account settings

AI Processing of Child Data: When you log food entries for a child profile, that data is processed by OpenAI's AI models (same as adult data) to generate nutrition scores and recommendations. These are approximations and should not be relied upon for children's health decisions. OpenAI retains this data for 30 days for abuse monitoring, then deletes it. You acknowledge this processing when using the Family Feature.

Your Responsibility as Parent:

Verify all nutritional information independently
Check all ingredients for allergens
Consult pediatric healthcare professionals
Supervise all use of the Service related to your child
Do not rely solely on AI-generated recommendations for children

3.8 User Consent and Privacy Preferences

What we collect:

Your consent choices (marketing emails, data sharing, analytics)
Timestamps of when you provided or withdrew consent
Privacy Policy version you agreed to
Cookie preferences

Legal basis: Legal compliance (GDPR requires us to maintain consent records)

Your control: You can update your privacy preferences at any time in your profile.

4. How We Use Your Data

4.1 Primary Purposes

We use your personal data to:

Provide the Service: Create and maintain your account, store your food diary, generate nutrition insights
Process payments: Bill your subscription and process transactions
Communicate with you: Send account notifications, respond to support requests, provide Service updates
Improve the Service: Analyze usage patterns to enhance features and fix issues
Ensure security: Detect and prevent fraud, abuse, and security threats
Comply with legal obligations: Meet regulatory and legal requirements

4.2 AI Processing

We use artificial intelligence (large language models and image generation) from OpenAI to:

Analyze food diary entries and generate nutrition scores
Provide APPROXIMATE nutrition information (not precise measurements)
Provide personalized nutrition recommendations
Suggest meal improvements
Generate recipe ideas based on your preferences
Create recipe images
Generate weekly summaries and insights

Important limitations:

AI-generated nutrition information is approximate and may be inaccurate
Portion sizes cannot be accurately measured from text descriptions or photos
You should verify all nutritional information independently if accuracy matters
See our Terms and Conditions for full AI disclaimer

4.3 Marketing and Communications

With your consent, we may send you:

Product updates and new feature announcements
Tips and educational content about nutrition
Personalized meal suggestions
Promotional offers (rare, we're bootstrapped!)

You can opt-out of marketing emails at any time via the unsubscribe link or in your account settings.

We will always send (even if you opt-out of marketing):

Account security notifications
Subscription and billing updates
Critical service announcements
Responses to your support requests

4.4 Anonymized Data for Service Improvement

If you opt-in (in your profile settings), we may use anonymized and aggregated data to:

Improve AI accuracy
Develop new features
Understand common dietary patterns
Generate insights about nutrition trends

Anonymization means:

Your identity cannot be determined from the data
Data is combined with other users' data
No personally identifiable information is retained
Cannot be traced back to you

You can opt-out of this anonymized data sharing at any time in your profile settings.

5. Who We Share Your Data With

5.1 Essential Service Providers

We share your data with third-party service providers who help us operate the Service:

Hosting and Infrastructure:

Railway: Cloud hosting for database and application (United States)
- Stores: All account data, food diaries, recipes, user preferences
- Purpose: Provide core Service functionality

AI Services:

OpenAI: AI processing for nutrition analysis and recipe generation (United States)
- Receives: Food diary entries, recipe requests, user preferences
- Purpose: Generate nutrition scores, recommendations, and recipe content
- Retention: 30 days for abuse monitoring, then deleted
- Important: OpenAI does NOT use API data to train models
- See Terms and Conditions Section 11.4 for details

Storage:

Cloudflare R2: Image storage (Global network)
- Stores: Recipe photos, AI-generated recipe images
- Purpose: Fast, reliable image delivery

Payment Processing:

Stripe: Payment processing (United States and EU)
- Receives: Payment information, billing address, transaction data
- Purpose: Process subscription payments and manage billing
- Compliance: PCI DSS Level 1 certified

Email Services:

Resend: Transactional email delivery (United States)
- Receives: Email address, email content (account notifications, shopping lists)
- Purpose: Deliver emails reliably

Analytics (Optional):

PostHog: Product analytics (if you opt-in)
- Receives: Anonymized usage data
- Purpose: Understand feature usage and improve Service
- You can opt-out in your privacy settings

5.2 Legal Requirements

We may disclose your personal data if required by law, regulation, legal process, or governmental request, including to:

Comply with court orders or subpoenas
Enforce our Terms and Conditions
Protect our rights, property, or safety
Protect the rights, property, or safety of others
Detect, prevent, or address fraud or security issues

5.3 Business Transfers

If Ideava Ltd is acquired, merged, or sells assets, your personal data may be transferred to the new owner. We will notify you of any such transfer and your options.

5.4 What We Never Do

We NEVER:

❌ Sell your personal data to advertisers or data brokers
❌ Share your food diary with third parties for marketing
❌ Provide your data to insurance companies
❌ Share child data with third parties (except essential service providers)
❌ Use your data for purposes beyond those described in this Privacy Policy without your consent

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

6.1 Right of Access

You can request a copy of all personal data we hold about you. We will provide this in a commonly used, machine-readable format.

How to exercise: Via account settings ("Export Data") or contact us at https://nouviva.com/contact

6.2 Right to Rectification

You can correct inaccurate or incomplete personal data.

How to exercise: Update information in your profile settings or contact us

6.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data. We will delete your data unless we have legal obligations to retain it.

How to exercise: Delete your account in settings or contact us

Note: Deletion is permanent and irreversible. All data, including food diaries and recipes, will be deleted.

6.4 Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances.

How to exercise: Contact us at https://nouviva.com/contact

6.5 Right to Data Portability

You can receive your personal data in a structured, commonly used, machine-readable format and transfer it to another service.

How to exercise: Use "Export Data" feature in account settings

6.6 Right to Object

You can object to processing based on legitimate interests or for marketing purposes.

How to exercise: Opt-out in privacy settings or contact us

6.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

How to exercise: Update consent settings in your profile

6.8 Right to Complain

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

ICO Contact:

Website: https://ico.org.uk/
Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

7. Data Retention

7.1 Active Accounts

We retain your personal data for as long as your account is active and as needed to provide the Service.

7.2 Deleted Accounts

When you delete your account:

Most data is deleted immediately
Some data may be retained in backups for up to 30 days
Financial records retained for 7 years (legal requirement)
Anonymized usage analytics may be retained indefinitely

7.3 Child Profile Data

When you delete a child profile:

All child-specific data is deleted immediately
Child data may remain in backups for up to 30 days
OpenAI retains child diary data for 30 days (abuse monitoring), then deletes it

7.4 Legal Holds

We may retain data longer if required by law or to defend legal claims.

8. Cookies and Tracking

8.1 What Are Cookies

Cookies are small text files stored on your device that help websites function and provide analytics.

8.2 Cookies We Use

Essential Cookies (Cannot be disabled):

Session cookies (keep you logged in)
Authentication tokens
Security cookies (CSRF protection)

Analytics Cookies (Optional):

PostHog analytics (if you opt-in)
Feature usage tracking
Error tracking

8.3 Your Cookie Choices

You can control cookies through:

Your browser settings
Our cookie preference center (in account settings)

Note: Disabling essential cookies will prevent you from using the Service.

8.4 Do Not Track

We do not currently respond to "Do Not Track" browser signals, but you can opt-out of analytics in your account settings.

9. Data Security

9.1 Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

Technical Measures:

Encryption in transit (TLS/HTTPS)
Encryption at rest for sensitive data
Secure password hashing (bcrypt)
Regular security updates and patches
Firewall protection
Access controls and authentication

Organizational Measures:

Limited employee access to personal data
Security training for team members
Regular security audits
Incident response procedures

9.2 Payment Security

Payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. We do not store full payment card details.

9.3 Breach Notification

If a data breach occurs that poses a risk to your rights:

We will notify you within 72 hours of becoming aware
We will notify the ICO as required by law
We will provide information about the breach and mitigation steps

9.4 Limitations

No system is 100% secure. While we implement strong security measures, we cannot guarantee absolute security. You use the Service at your own risk.

10. International Data Transfers

10.1 UK and EU Users

Your data is stored and processed in the following locations:

Railway hosting: United States (primary database and application hosting)
Cloudflare R2: Global network (recipe images and uploaded photos)
OpenAI: United States (AI processing, data retained for 30 days then deleted)
Stripe: United States and EU (payment processing)

10.2 Safeguards

When data is transferred outside the UK/EU, we ensure appropriate safeguards:

Standard Contractual Clauses (SCCs) with processors
Adequacy decisions where applicable
Compliance with UK GDPR international transfer requirements

11. Children's Privacy and Family Feature

11.1 Account Age Requirement

Nouviva accounts are only available to users aged 18 and over. You must be at least 18 years old to create an account and use the Service.

11.2 Family Feature for Parents

Parent-Managed Child Profiles: If you are a parent or legal guardian, you may create child profiles within your account to track your children's nutrition. The Family Feature is designed for parents to monitor and improve their family's eating habits.

CRITICAL REQUIREMENTS FOR USING CHILD TRACKING FEATURES:

By creating a child profile, you confirm and agree that:

You are the parent or legal guardian of the child
You have parental authority to provide the child's information
You will provide direct adult supervision for all use of child tracking features
Children will NEVER use the Service unsupervised
You understand that all nutrition information is AI-generated and approximate
You will NOT rely solely on AI recommendations for children's nutrition
You will consult pediatricians or registered pediatric dietitians for children's nutrition advice
You are responsible for verifying all nutritional information and allergens
You consent to processing your child's nutrition data through our AI systems
You understand that child data is subject to this Privacy Policy
You are responsible for the accuracy of the information provided

What you can do with child profiles:

Log food and exercise entries for your children (with supervision)
View AI-generated nutrition approximations for your children's meals
Track achievements and progress for your children
Generate meal plans and shopping lists for your family
Export your child's data at any time
Delete child profiles and all associated data at any time

What you must NOT do:

❌ Allow children under 18 to use child tracking features unsupervised
❌ Rely solely on AI approximations for children's nutritional decisions
❌ Make dietary restrictions for children based only on AI recommendations
❌ Use the Service as a substitute for pediatric nutrition advice

11.3 Children Cannot Create Their Own Accounts

Children under 18 cannot create their own Nouviva accounts. All child data must be managed through a parent's account using the Family Feature.

If we discover that a child under 18 has created their own account without parental consent:

We will delete the account immediately
We will delete all associated data
We will notify the email address associated with the account

11.4 Parental Rights and Control

As a parent using the Family Feature, you have full control over your child's data:

Right to access: View all data associated with your child's profile
Right to rectification: Correct any inaccurate information
Right to deletion: Delete child profiles and all associated data at any time
Right to export: Download your child's data in machine-readable format
Right to object: Stop processing of child data by deleting the profile

11.5 How Child Data Is Processed

Child data collected through the Family Feature is:

Processed in the same way as adult user data
Sent to OpenAI for AI analysis (nutrition approximations, recommendations)
Generated as approximations, not precise nutritional assessments
Subject to the same security protections
Never shared with third parties for marketing purposes
Never sold to data brokers or advertisers
Stored on secure servers (Railway hosting)
Encrypted in transit and at rest
Retained by OpenAI for 30 days (abuse monitoring), then deleted

Important Reminder: All nutrition information for children is AI-generated and approximate. Do not use it as a substitute for professional pediatric nutrition advice.

11.6 Report Underage Account

If you believe a child under 18 has created their own account (not a parent-managed child profile), please contact us immediately via:

Contact Form: https://nouviva.com/contact
Subject line: "Underage Account Report"

We will investigate and delete the account if confirmed.

12. Changes to This Privacy Policy

12.1 Updates

We may update this Privacy Policy from time to time. When we make material changes:

We will update the "Last Updated" date
We will notify you via email or in-app notification
We will provide 30 days' notice for significant changes
Continued use after changes constitutes acceptance

12.2 Previous Versions

We maintain an archive of previous Privacy Policy versions available upon request.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

13.1 Categories of Personal Information

We collect the following categories (as defined by CCPA):

Identifiers (email, name)
Commercial information (purchase history)
Internet activity (usage data)
Professional information (if provided)

13.2 Your California Rights

You have the right to:

Know what personal information we collect, use, and share
Delete personal information (with exceptions)
Opt-out of sale of personal information (Note: We do not sell personal information)
Non-discrimination for exercising your rights

13.3 Exercising California Rights

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

Contact Form (Recommended):
https://nouviva.com/contact

Email:
[email protected]

Postal Address:
Ideava Ltd
71-75 Shelton Street
Covent Garden
London WC2H 9JQ
United Kingdom

Response Time: We aim to respond to all privacy inquiries within 5 business days.

15. Summary for Quick Reference

What we collect:

Email (required), password (encrypted)
Optional profile info (dietary preferences, goals, health data, weight)
Food diary, exercise logs, recipes, meal plans, shopping lists
Achievement progress and streaks
Child profile data (if using Family Feature): child's name, age, dietary info, food entries
Payment data via Stripe
Usage data and analytics

Why we collect it:

Provide the Service (food diary, AI nutrition approximations, recipes, meal planning)
Process payments for Premium subscriptions
Improve features and fix issues
Ensure security and prevent abuse

Who we share with:

Hosting: Railway (stores all data)
AI: OpenAI (GPT-4, DALL-E for nutrition approximations and recipe images)
Images: Cloudflare R2 (recipe photos)
Payments: Stripe (payment processing)
Email: Resend (account emails, shopping lists)
Analytics: PostHog (optional, anonymized usage data)
Never sold to advertisers or data brokers

Your control:

Access, correct, delete, or export your data anytime
Delete child profiles and data anytime
Opt-in required for marketing and anonymized data sharing
Delete your account and all data at any time

Family Feature - CRITICAL REQUIREMENTS:

Parents can create child profiles to track children's nutrition
Parental supervision REQUIRED at all times
All nutrition information for children is AI-generated and approximate
NOT a substitute for pediatric nutrition advice
You must verify all information independently
Parental consent required
Full parental control over child data
Children under 18 cannot create their own accounts

Security:

Encrypted storage and transmission
Regular security updates
Breach notification within 72 hours
PCI DSS compliant payment processing via Stripe

Your rights:

Full UK GDPR rights (access, deletion, portability, rectification)
Complain to ICO if unhappy
Withdraw consent anytime

Contact: https://nouviva.com/contact or [email protected]

By using Nouviva, you acknowledge that you have read and understood this Privacy Policy, including the important limitations and requirements for child tracking features.