Privacy
What Nutrivo collects, where it goes, and who can see it — described from the system as it is actually built, not from a template.
Last updated 2 August 2026
What we hold
Your account. An email address and authentication record, so you can sign in and so we can attribute a sign-off to a named person.
Your label artwork. The files you upload or photograph, the text and measurements extracted from them, and the findings produced. Artwork is the confidential part of this service and is treated as such: it is stored per-organisation and access is enforced in the database itself, not merely in the application.
A record of what happened. Checks, verdicts, sign-offs and an append-only audit trail. This is the product — it is what makes a certificate meaningful — so it is retained for as long as your workspace exists.
Where it is processed
| Who | What for | Where |
|---|---|---|
| Supabase | Database, authentication, artwork storage | EU — Ireland (eu-west-1) |
| Render | The check worker | EU — Frankfurt |
| Vercel | The web application | Global edge network |
| Anthropic | Reading the label — including sending a rendered image of your artwork | United States |
| Sentry | Error reporting | See Sentry's terms |
| Resend | Email delivery (only once email-in is enabled for you) | See Resend's terms |
Your artwork leaves the EU. Reading a label involves sending an image of the page to Anthropic in the United States. We are telling you this plainly because it is the disclosure most easily buried: if your artwork is commercially sensitive pre-launch, that transfer is a fact you need before you upload it, not after.
What we have not built yet
Automatic deletion schedules are not implemented. Your data persists until you ask us to remove it, and today that request is handled by a person rather than a button. We would rather say this than publish a retention policy the system does not enforce.
Export and erasure requests are handled manually. They are honoured — they are simply not yet self-serve.
Your rights
Under the GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing, or complain to your national supervisory authority. Write to us and we will act on it.
Who to contact
Nutrivo is operated by the entity named in your contract. For any privacy question, or to exercise any right above, contact us at the address given there and we will respond.
This notice describes how Nutrivo handles your data. It is not the same thing as the compliance advice the product produces — every finding cites its own legal source, and Nutrivo is not a substitute for your regulatory experts. How the check works →