Public compliance page
Data Processing Addendum
NutriMeter's draft DPA covering controller and processor roles, security, sub-processors, transfers, and deletion obligations.
Effective date: 15 June 2026Roles
For personal NutriMeter accounts, NutriMeter generally acts as a controller. Where a business customer separately instructs us to process personal data for its users, that customer is the controller and NutriMeter is the processor.
Scope and purpose
This DPA covers processing needed to provide nutrition logging, AI-assisted meal analysis, analytics, support, security, billing, and account administration.
Sub-processors
NutriMeter may use sub-processors for hosting, databases, AI analysis, analytics, payments, email, support, and app platform operations. We require sub-processors to protect personal data under written terms.
Security measures
We maintain appropriate technical and organizational measures including encryption in transit, access controls, monitoring, least privilege, backup controls, vendor review, and personnel confidentiality obligations.
Data-subject requests
Where NutriMeter acts as processor, we will reasonably assist the controller with access, deletion, correction, portability, objection, and restriction requests, taking into account the nature of processing.
International transfers
Where restricted international transfers occur, the parties will rely on standard contractual clauses, UK addendum or equivalent safeguards as applicable.
Breach notification
We will notify affected controllers without undue delay after becoming aware of a personal-data breach involving processor services and will provide reasonable information to support required notices.
Audit
We will make reasonable compliance information available and cooperate with audits required by data-protection law, subject to confidentiality, security, and operational safeguards.
Return or deletion
At termination, we will delete or return processor personal data on documented instruction unless law requires retention. Backup deletion may follow normal lifecycle schedules.