Privacy policy

1. Who processes your data

The data controller is [company name, Hong Kong] (BR no. […], registered office: […]). Data questions: info@sagenourish.com.

Our representative in the EU under Article 27 GDPR: [EU representative — to be appointed].

2. What we collect

Account data: email address and user identifier.

Questionnaire data: sex, age, height, weight, activity level, goal, diet and dietary restrictions. This is health data — a special category under Article 9 GDPR.

Check-in data: weight, sleep, energy, appetite and any notes you write yourself.

Order data: first and last name, email, city, delivery address and order contents. No phone number is requested.

Technical data: the IP address at the time of a request, used to rate-limit our API. There are no advertising trackers and no browsing profiles.

3. Legal bases

Questionnaire and check-in data: your explicit consent (Article 9(2)(a) GDPR). It is asked for separately, before the questionnaire, and can be withdrawn at any time.

Account and order data: performance of a contract (Article 6(1)(b)).

Technical data: our legitimate interest in protecting the service from abuse (Article 6(1)(f)).

Accounting records for paid orders: compliance with a legal obligation (Article 6(1)(c)).

4. What we use it for

Health data is used to calculate your individual calorie and macronutrient targets, build your menu and produce personal recommendations. It is not used for advertising and is not shared with anyone for marketing.

We do not make automated decisions that produce legal effects for you. A meal plan is a recommendation, not a decision.

5. AI processing

Your personal plan and the assistant's answers are produced by Claude, a language model from Anthropic. When a plan is generated and during a conversation with the assistant, questionnaire and plan data are sent to Anthropic.

This means health data leaves our systems and is processed by an external provider. If you do not want that, do not fill in the questionnaire and do not use the assistant: the rest of the site works without sending any such data.

6. Who receives your data

We use the following service providers, acting as processors:

Supabase — storage of the account, profile, plan and orders.

Anthropic — AI processing (see section 5).

Vercel — site hosting and request handling.

Hostinger — the mail service through which order emails are sent.

The payment provider that issues the invoice. Card details are handled entirely on their side and never reach us.

The supplier and the carrier receive the name and address needed to ship the parcel.

7. Transfers outside the EU

We are based in Hong Kong and some providers are in the United States. Your data is therefore transferred outside the European Economic Area to countries without an adequacy decision.

Such transfers rely on the European Commission's Standard Contractual Clauses. You can request a copy at the address in section 1.

8. How long we keep it

Profile, plan and check-ins are kept while your account exists and are deleted whenever you ask — with a button in your cabinet or by writing to us.

Records of paid orders are kept longer where accounting or tax law requires it. They survive the deletion of an account, limited to what reporting requires.

9. Your rights

If the GDPR or the UK GDPR applies to you, you have the right to: access your data and get a copy, correct inaccuracies, request erasure, restrict processing, object to processing, and receive your data in a portable, machine-readable form.

You can export and delete your data yourself in the Profile tab of your cabinet. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Withdrawing consent for health-data processing ends the personal plan: without questionnaire data it cannot be calculated.

You also have the right to lodge a complaint with the data protection authority in your country.

10. US residents

We do not sell personal data and do not share it for targeted advertising. California residents may request details of collection, deletion and correction.

Questionnaire and check-in data are consumer health data under the laws of certain states, including Washington. We process it only with your separate consent and do not disclose it to anyone beyond the service providers listed in section 6.

11. Hong Kong

As a Hong Kong company we comply with the Personal Data (Privacy) Ordinance. We do not use your data for direct marketing without separate consent.

12. Storage in your browser

The site stores your profile, plan and cart in your browser's local storage so they work without signing in. These are not advertising cookies: there are no third-party trackers or surveillance analytics on this site.

You can clear the local copy with the "Clear profile" button in your cabinet.

13. Children

The service is for people aged 18 and over. We do not knowingly collect children's data.