1. Who we are
HA Transformer Code AB is responsible for personal data processed through Nulya, nulya.app, and support. For privacy requests, email nulya@transformercode.com. Nulya is for adults aged 18 and over.
2. Data we collect
- Account: email, sign-in details, name, age confirmation, language, and preferences.
- Information you enter: age, sex, height, weight, goals, nutrition, meals, water, activity, sleep, fasting, mood, and optional cycle records.
- AI submissions: selected photos, audio, food descriptions, clarification answers, and the resulting transcripts and estimates.
- With permission: steps, exercise duration, and sleep from Apple Health or Health Connect, imported and synced to your account.
- Subscription and transaction details from the stores; we do not receive your full payment-card details.
- Device and app information, network addresses, usage events, error information, and messages you send to support.
3. How we use it
We use this data to operate your account, sync records, provide nutrition estimates and goals, import health records, manage subscriptions, and answer support requests. Technical data helps us improve reliability, understand usage, and prevent abuse.
Legal bases are our agreement with you, legal obligations, and legitimate interests in service improvement and security. Sensitive health processing requires explicit consent where applicable. Optional inputs and permissions are voluntary; withholding them limits the related feature.
4. Sharing
We share only what the relevant service needs. We do not sell personal data or use health data for advertising. The website has no tracking cookies or analytics scripts.
- Supabase and Cloudflare store account records and submitted media; Netlify hosts our website.
- OpenAI or Google Gemini receives the photos, audio, text, or record context needed for requested AI features. Nutrition providers (USDA, Open Food Facts, FatSecret) receive search terms or barcodes.
- RevenueCat, Apple, and Google process subscription information. PostHog processes limited usage events and device information, excluding raw media, meal descriptions, body measurements, and email addresses.
5. Retention and deletion
Account records and saved analyses remain while needed for your account, until deleted. Our upload storage schedules photos for deletion after 24 hours and audio after 6 hours, sometimes sooner. Cleanup delays and separate AI-provider retention can apply.
Account deletion removes your account and associated records; remaining media and subscription identities are queued for cleanup. Legal, accounting, fraud-prevention, and security records remain only as required; restricted backups expire on the provider’s schedule. Support messages and technical logs remain only as needed to resolve requests, maintain security, or meet legal obligations.
6. Your choices and rights
Edit, export, or delete your data in the app, or email nulya@transformercode.com. Where applicable, you may request access, correction, deletion, portability, restriction, or object to processing. We verify ownership and respond within legal deadlines, normally one month under EU law. You may complain to your data-protection authority.
Withdraw consent by contacting us; earlier lawful processing is unaffected. Revoke optional camera, photo, microphone, health, or notification access in device settings. Revoking access stops future access but does not delete existing records.
7. Security and transfers
We use encrypted connections, access controls, and private media storage. Providers may process data outside the European Economic Area. Transfers require applicable safeguards, such as adequacy decisions or standard contractual clauses; contact us for a copy of relevant safeguards.
8. Updates
We update the date above when this policy changes, notify you of material changes, and obtain renewed consent where required.