Privacy Policy

1. Information Collection

When you sign in to NutriAudit with your Google account, we only collect the following public information:

• Email address: Used to identify you and create your account.
• Name: Used to display your nickname in the app.
• Profile photo: Used to display your profile picture in the interface.

We do not access your Google Contacts, Drive files, or other private data.

2. Image Data

The supplement image you select is sent to an AI processing provider to extract product and ingredient details from the label. NutriAudit does not currently add the original image to your cabinet; extracted product details may be saved in this browser or to your account after sign-in. Do not upload images containing faces, names, prescription labels, or other personal information.

3. Data Usage

The data we collect is used solely to provide core services (such as supplement safety audits). We do not sell your personal data to any third-party advertisers or data brokers.

When you arrive through an ad or partner link, we use a first-party attribution identifier for up to 30 days. It records limited channel, campaign, landing-path, and referring-domain data, plus only a hash of an ad click identifier, to measure conversion through report delivery and refund. Attribution records do not contain your email, full referring URL, supplement labels, ingredients, or health inputs, and we do not provide partners with personally identifying or health-content data.

When you arrive through a customer invite link, the same attribution record stores the invite code and the reward relationship between the inviting and invited accounts. This lets us issue a credit after the invited account completes its first real payment. The inviter sees only aggregate reward counts, never the invited person’s name, email, supplements, or health information.

4. Payments and Refunds

A Full Stack Audit is sold as a one-time digital service, not a subscription, and does not renew automatically. Payment is processed on the hosted checkout of our merchant-of-record provider, Waffo Pancake. NutriAudit does not receive or store your full card number, but it receives order, payment, and refund status to issue or revoke an audit credit.

An audit credit is consumed only after the complete report is successfully saved; a failed generation automatically returns the credit. If a service failure prevents delivery, you may request a refund through the customer portal linked from your payment receipt. Refund eligibility after successful delivery is assessed based on the circumstances and applicable law; this policy does not limit statutory consumer rights. After a refund completes, unused credit and paid access associated with the refunded order may be revoked.

Paid Positive Invite (Gift Full Audit)

This is the only invite path: after you complete one real production full-audit purchase, you receive your own full-audit credit plus one gift send so a friend can claim one full audit with the same rights as paid. There is no reverse “invite friends to pay so you earn another credit” program.

Creating a share link does not consume the send; only a successful redeem does. Each recipient may successfully claim only one friend gift sitewide. Self-redeem and test orders do not qualify. Failed claims do not reduce your remaining sends. If the related payment is later refunded and the gift has not been claimed, unused gift capacity may be revoked; a successfully claimed credit is generally not clawed back.

Legacy Customer Referral (Retired)

The legacy “invite a friend to pay so the inviter earns a credit” program is retired. No new rewards are issued. Previously granted unused credits still follow prior rules; new invites use the paid positive gift path only.

5. Terms of Service

NutriAudit is a decision-support tool, not medical advice. Audit progress scores and analyses are informational, do not establish personal safety, and must not replace professional medical advice, diagnosis, or treatment.

6. Acceptable Use

You may use NutriAudit for lawful personal education and decision support. You may not attack, disrupt, or place an unreasonable load on the service; bypass sign-in, payment, entitlement, or security controls; scrape data or reverse-engineer the service through unauthorized automation; or upload unlawful, infringing, malicious, or unnecessarily personal content. You may not represent an analysis as a medical diagnosis, prescription, or professional opinion.

7. Violations and Termination

If we reasonably believe an account is involved in fraud, abuse, a security attack, infringement, or another material violation of these terms, we may restrict or suspend the affected access, revoke credits associated with unpaid, refunded, or fraudulent transactions, and retain relevant records where necessary to investigate or meet legal obligations. Serious or repeated violations may result in account termination. These terms do not limit statutory consumer rights.

8. Data Storage and Security

Account data, saved audits, order status, and audit credits are stored on access-controlled hosted infrastructure. We use HTTPS in transit, sign-in-based access controls, database row-level permissions, server-only credentials, and minimized payment-event records. We do not store full card numbers or raw Waffo webhook bodies. No internet system can guarantee absolute security; contact us promptly if you suspect a security issue.

9. Third-Party Sharing and Disclosure

We transfer data to third parties only as needed to provide and protect the service: Google for sign-in and usage analytics; Microsoft Clarity for anonymized product behavior analytics (session recordings and heatmaps, with page text masked by default); AI processing providers to interpret supplement labels you submit and generate analyses; Supabase for account, audit, order, and entitlement storage; Vercel for hosting and runtime infrastructure; Waffo Pancake as merchant of record for checkout, taxes, receipts, refunds, and disputes; and an email provider for service messages you request. Each provider processes data under its own terms and privacy notice. We may also disclose limited data where legally required, necessary to protect users, or necessary to defend lawful rights. We do not sell personal data to advertisers or data brokers.

10. Contact Us

If you have any questions about this privacy policy, or wish to completely delete your account data, please contact our team.