Privacy Policy
Last updated: 7 July 2026
1. Data controller
The data controller is Deyi Zhao, operating under the trade name Mythie NutriLogic. Contact: hello@mythienutrilogic.com.
2. What data we collect
We collect data in two contexts: (A) the Mythie web app at mythienutrilogic.com/app, and (B) marketing waitlist forms on our website. We only collect what is needed for each purpose.
A. Web app (account required)
| Data | Why we collect it |
|---|---|
| Email & password (hashed) | To create and secure your account (Supabase Auth). |
| Barcode scans & audit history | To look up products and show green/yellow/red audit results linked to your account. |
| Cat profile (life stage, neutered, allergies) | Required to tailor audit results. Allergies are pet dietary data, not human health data — stored with your account. |
| Package photos you upload | To verify unlisted products. Photos are stored in a private EU bucket, accessible only to you and our review team. EXIF metadata (GPS, device) is stripped before upload. |
| Feedback you submit | To improve the beta product. |
| Privacy consent at registration | To prove you accepted this policy before using the app. |
B. Marketing waitlist (optional forms)
| Data | Why we collect it |
|---|---|
| First name or username | To personalise our messages to you. |
| Email address | To notify you when the beta launches and contact you about your participation. |
| Country | To prioritise testers from our launch market (France) and tailor product availability. |
| Number of cats | To understand household profiles and prioritise multi-cat testers for relevant features. |
| Cat name(s) and gender(s) | To personalise the beta experience and tailor nutrition recommendations to each cat's profile. |
| Main need | To match you with beta test waves that test the features most relevant to you, and to inform product design. |
| Consent choices | To prove and respect your consent (required beta consent, optional promo consent). |
| Language preference | To communicate with you in your chosen language. |
| Submission timestamp | To document when consent was given (GDPR accountability). |
We do not collect: payment data, government IDs, precise geolocation, human health data (GDPR special categories), or data about other household members. Package photos may incidentally show background details — please frame the label only.
3. Legal basis for processing
Legal bases depend on the activity:
- Web app account & audits — contract / steps at your request before a contract (GDPR Art. 6(1)(b)): providing the food-audit service you signed up for.
- Package photos — same contract basis; you choose whether to upload them.
- Marketing waitlist — your consent (Art. 6(1)(a)), collected via checkbox on waitlist forms.
- Launch offers email (optional, separate checkbox on waitlist forms).
- Anonymous website analytics — legitimate interest in understanding aggregate traffic (Art. 6(1)(f)), only after you accept the cookie banner — see Section 8.
You can withdraw marketing consent at any time — see Section 6. Withdrawing consent does not affect the lawfulness of past processing.
4. Who we share your data with
We do not sell your data. We do not share it with brands, retailers, or advertisers. We use the following processors (each with a GDPR-compliant Data Processing Agreement):
- Supabase (Supabase Inc., EU hosting region) — account authentication, app database, private photo storage. Policy: supabase.com/privacy.
- Vercel (Vercel Inc.) — website and app hosting. Policy: vercel.com/legal/privacy-policy.
- Brevo (Sendinblue SAS, Paris, France) — marketing contact list and transactional emails. Policy: brevo.com/legal/privacypolicy.
- Cloudflare Turnstile (optional, when enabled) — bot protection on marketing forms. Policy: cloudflare.com/privacypolicy.
We may disclose data to public authorities if legally required (e.g., court order).
5. How long we keep your data & where it is stored
Retention periods vary by data type:
- App account — until you request deletion or 24 months after your last login, whichever comes first.
- Audit & intake records — 24 months after creation, then anonymised or deleted.
- Package photos — deleted within 12 months after product verification, or sooner on account deletion.
- Marketing contacts (Brevo) — until you unsubscribe or 24 months after your last interaction.
App and photo data are stored in the EU (Supabase EU region). Marketing data is stored in the EU/EEA (Brevo). We do not transfer your personal data outside the EU/EEA unless a processor provides EU Standard Contractual Clauses — Supabase and Vercel publish these in their DPAs.
6. Your rights
Under GDPR, you have the following rights at any time and free of charge:
- Access — ask us what data we hold about you (Art. 15).
- Rectification — correct inaccurate data (Art. 16).
- Erasure — ask us to delete your data (Art. 17).
- Restriction — ask us to pause processing (Art. 18).
- Portability — receive your data in a machine-readable format (Art. 20).
- Object — object to processing (Art. 21).
- Withdraw consent — at any time, without affecting the lawfulness of past processing (Art. 7).
To exercise any right — including account deletion — email hello@mythienutrilogic.com from the address linked to your account. We respond within 30 days. For marketing emails, use the unsubscribe link in any message.
7. Right to lodge a complaint
If you believe we have mishandled your data, you have the right to lodge a complaint with a data protection authority. We encourage you to contact us first, but you may also approach:
- France — CNIL (Commission Nationale de l'Informatique et des Libertés), cnil.fr.
- Germany — BfDI (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit) or your federal state's authority. bfdi.bund.de.
- Elsewhere in the EU/EEA — your national data protection authority.
8. Cookies & local storage
We do not use advertising or cross-site tracking cookies.
Strictly necessary — Supabase Auth stores a session token in your browser (local storage) to keep you logged in. This is required for the app to work and does not need consent.
Analytics (optional) — Our marketing pages may load Vercel Web Analytics after you accept the cookie banner. It collects anonymous, aggregated page-view data without advertising cookies. You can refuse via the banner; refusal does not block access to the site or app.
Waitlist forms may save a local backup in your browser's local storage — this never leaves your device and can be cleared in browser settings.
9. Changes to this policy
We may update this policy as the product evolves. When we make significant changes, we will notify registered beta testers by email and update the date at the top.
10. Contact us
Mythie NutriLogic
Email: hello@mythienutrilogic.com
For any question about your data — access, deletion, or anything else — write to us. We answer within 30 days, usually within a week.