Privacy Policy of Nourea

Nourea is provided by STANIMEROS PANTELEIMON, a sole trader based in Thessaloniki, Greece (ΓΕΜΗ 183133106000, VAT EL165099427). We decide why and how your data is used (the "controller"). Contact: hello@stanimeros.com.

This is what Nourea handles. Each item is explained in the sections below.

You can sign in with email and password, Google or Apple. If the provider shares them, we receive your name, email and profile photo, plus your account ID. We never see your Google or Apple password.

Nourea asks for health-related information such as weight, height, body measurements, medication, family history, smoking and your meals. This is special-category data. We process it only with your explicit consent (Art. 9(2)(a) GDPR) and only to provide the app, including AI-generated plans. We never use it for advertising.

You can withdraw consent at any time by deleting the data or your account in the app. Nourea is not medical advice.

To build your meal plan and shopping list, the information you enter in the app is sent through our servers on Google Cloud to the Google Gemini API on a paid tier. Google does not use it to train its models. Please do not enter more than the app asks for.

Reminders, such as meal times, are scheduled on your device. They are not sent through our servers.

Nourea uses Firebase Analytics to see how the app is used. It records app interactions, device and app identifiers (on Android this can include the advertising ID), and your approximate country. We use it in aggregate to fix problems and improve the app, not for advertising.

Firebase Crashlytics sends us a report when the app crashes. It includes your device model, operating system version and the state of the app at the time.

Under the GDPR we rely on these legal bases:

• • Contract, Art. 6(1)(b): to provide the features you asked for and your account.
• • Consent, Art. 6(1)(a): for the device permissions you allow, such as notifications or location. You can withdraw consent at any time in your device settings.
• • Explicit consent, Art. 9(2)(a): for health data. It is processed only where you enter it.
• • Legitimate interests, Art. 6(1)(f): crash reports, aggregated usage analytics and security, so we can keep the service working and improve it.
• • Legal obligation, Art. 6(1)(c): records we must keep by law, such as accounting records.

We use these providers to run Nourea. Some process data on our behalf. Others, such as the app stores, process it under their own policies.

Google Firebase and Google Cloud, for:

• • Firebase Authentication: sign-in and accounts
• • Cloud Firestore: database for app data
• • Google Cloud: our servers and server-side processing
• • Firebase Analytics: usage analytics
• • Firebase Crashlytics: crash reports
• • Firebase App Check: checks that requests come from the real app.

Google processes this data under its Privacy Policy.

Other providers:

• • Google Gemini API: processes the content you send to AI features (paid tier, not used to train models).

We do not sell your personal information or use it for advertising.

Some of the providers above, such as Google, may process data in the USA. These transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

• • Account and app data: until you delete it or your account. We handle deletion requests within 30 days.
• • Crash reports: about 90 days.
• • Usage analytics: up to 14 months.
• • Data on your device: until you clear it or uninstall the app.
• • Records we must keep by law are kept for the required period.

Giving us data is not a legal requirement. Some features need it, and without it those features will not work.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

You can ask us to:

• • give you access to your data
• • correct it
• • delete it
• • restrict how we use it
• • stop using it for certain purposes (object)
• • give you a copy you can move elsewhere (portability)

You can withdraw your consent at any time. You can object at any time to processing based on legitimate interests, such as analytics and crash reports.

To use these rights, email hello@stanimeros.com or use the data deletion page. We reply within one month. You can also complain to the Hellenic Data Protection Authority at www.dpa.gr.

Data is encrypted in transit (HTTPS) and stored with Google Cloud/Firebase, which encrypts data at rest. We limit access to what is needed to run the service. No system is completely secure.

Nourea is not intended for children under 15. We do not knowingly collect their data. If you think a child has given us data, contact hello@stanimeros.com and we will remove it.

If we change this policy, we update the date at the top of this page.

Questions about this policy or your data: hello@stanimeros.com.

Thessaloniki, Greece