Minnelea app privacy policy

Last updated: October 16, 2026

This policy explains how Azienda Agricola Minnelea di Rizzo Carmine (Via Serra 12, 84060 Moio della Civitella SA, Italy, VAT no. 06042760659), the data controller, processes the personal data of people who use the Minnelea app for iPhone and Android, in line with Regulation (EU) 2016/679 (GDPR). For purchases and browsing on minnelea.com, the shop privacy policy also applies.

What data we process and why

• Data that stays on your phone. Pantry, shopping list, meal plan, dish diary, rituals, "three good things", walks and their photos, phone-free dinners, garden and badges are stored only on your device and never reach our servers, except as described below for Wellbeing and Family.
• Step counter. It uses your phone's motion sensor, only with your permission. We do not use Apple Health (HealthKit) or Health Connect, and your steps never leave the device.
• Account. If you sign in, we process your email and, if provided, your name to manage your account and link orders and rewards (providers: Shopify and Supabase; Apple or Google if you sign in with them). Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).
• AI features. Photos, dictated voice and text you send to read or improve a recipe or to ask the Chef are processed on our behalf by an external artificial intelligence provider, only to generate the answer and only after your consent, which you can withdraw in the app's legal and privacy settings.
• Allergies and preferences. If you enter allergies or intolerances, we store them with your account to leave those ingredients out of suggestions. We only store them with your explicit consent (Art. 9(2)(a) GDPR), given with a separate tick box that you can untick at any time: the allergies are then deleted.
• Points, vouchers and birthday. Your points account is linked to your email: paid orders and product amounts, points, vouchers issued, weeks with the walk bonus (only the week and the points, no routes or durations) and, if you provide it, your birthday (day and month, no year). We use them to run the programme described in the points, vouchers and monthly challenge rules. Legal basis: performance of the service (Art. 6(1)(b) GDPR).
• Invite a friend. We process your invite code and the vouchers it generates, to know who invited whom.
• Monthly challenge. If you take part, we store your user ID, the day and how many dishes were counted, with no information about the dish. We use them to calculate the shared total and the voucher. We delete this data after 6 months; only the monthly totals remain, which identify no one.
• Notifications and statistics. Promotional notifications (OneSignal) and usage statistics (Firebase Analytics) are active only with your consent. The app contains no advertising tracking tools.
• Deleting your account. You can delete your account in the app's legal and privacy settings. We delete the app data, including the monthly challenge data; your points account is deleted if it exists only for the app, while it stays linked to your email if you also use the online shop. Order data is kept for as long as tax law requires.
• Report a problem. If you report an AI answer, we store the answer's text, your note and your user ID (if signed in), to check and fix it. Reports are deleted after 12 months.
• Gift card. If you send a gift card, the recipient's name and email and your message go straight to Shopify, which sends the gift card on the chosen day. The app does not store them.
• Notify me when it's back. If you set an alert while signed in, we store your user ID and the product you're waiting for, to send you a single notification when it's available again. After that the alert closes and the data is deleted within 30 days.
• Your cookbook. The recipes you save (written by you, imported from a link, a text or a photo) stay on your phone and, if you're signed in, a copy is kept on your account so you don't lose them when you change phone. They are private: only you can see them. Photos (notebook, dish) stay only on your phone. When you import a link, our server reads the public page on your behalf; if text or photos need to be read by AI, we send them to the AI provider only for that reading. Recipes are deleted when you delete them or delete your account.
• Features for Minnelea customers. Some features are included for people who have the Kit of the month or placed a paid order in the last 30 days. To check this we look up, with your account email, the orders in our shop (Shopify) and store the result for up to 24 hours: email, customer yes/no and amount spent in the period. Legal basis: performance of the service (Art. 6(1)(b) GDPR). Until January 20, 2027 the same features are also included for newsletter subscribers: for this we check, again with your account email, whether your subscription is active in our shop.
• AI limits and security. For every AI request we record its type, date and cost. The same limits apply to everyone (per minute, day, week and month): requests refused for going over a limit are recorded and deleted after 7 days. If too many refused requests arrive within a few minutes, AI on your account is paused for a limited time and we receive an email alert with your email and the reason (sending service: Resend). Legal basis: our legitimate interest in protecting the service from abuse (Art. 6(1)(f) GDPR).
• Wellbeing. Your first-run answers (what you want to bring to the table, time to cook, reminder slot), the day's small wins (portions of vegetables, fruit, legumes, oil, fish, water), progress and the 28-day challenge stay on your phone and, if you are signed in, a copy is kept on your account so you don't lose them when you change phone. There are no weight goals and no medical advice. Legal basis: performance of the service (Art. 6(1)(b) GDPR).
• Mood diary. The mood diary stays only on your phone. A copy is saved on your account only if you choose it with a separate explicit consent (Art. 9(2)(a) GDPR), which we record with the date and the version of the text. You can withdraw it at any time: the copy on your account is deleted immediately. The diary is not linked to what you eat.
• Family. If you create a family or join one with an invite code (up to 6 accounts), the shared shopping list and meal plan are stored on our server and the other members see your display name, the list and the plan. Nothing else about you. You can leave whenever you like. Legal basis: performance of the service (Art. 6(1)(b) GDPR).

Providers

The providers listed process data on our behalf, as data processors, only for the purposes described. If a provider processes data outside the European Union, the transfer relies on adequacy decisions or on the European Commission's standard contractual clauses.

Children

The app is not intended for children and we do not knowingly collect their data.

Your rights

You can ask to access, correct, delete, restrict or port your data, object to processing and withdraw your consent at any time, without affecting processing already carried out. You can do this in the app's legal and privacy settings or by writing to us. You also have the right to lodge a complaint with a data protection authority, in Italy the Garante per la protezione dei dati personali.

Changes

If we change this policy, we publish the new version here and update the date at the top; for important changes we also let you know in the app.

Contact

For privacy questions: info@minnelea.com, or Azienda Agricola Minnelea, Via Serra 12, 84060 Moio della Civitella (SA), Italy.