Introduction
Wellnoria AB is the controller of personal data processed through Daily Simmer. Contact us at support@dailysimmer.com or through our contact form.
Definitions
| Term | Meaning |
|---|---|
| we, us, our | Wellnoria AB. |
| Service | Daily Simmer. |
| you, your | The individual whose personal data this Privacy Policy describes. |
What we process and why
Data comes from you and your use of Daily Simmer, and from sign-in, payment, app-store and assistant providers you choose, people who share content with you, and public pages you ask us to import.
| Data and source | Purpose and legal basis | Recipients | Retention |
|---|---|---|---|
| Account, identity, authentication and approximate-country data; recipes, images, profile details, collections, plans, lists, chats, prompts, attachments, assistant actions, preferences, block lists, connection data and other content, from you, your providers, connected assistants and people who share with you or block you | Provide requested features; operate, administer, support, secure, troubleshoot, enforce, maintain and improve the Service. Contract where objectively necessary for a requested feature or support; otherwise our legitimate interests in service administration, security, integrity, reliability and improvement. | Authorized staff; identity, hosting, database, storage, security, email and AI providers; the AI coding tool providers named below; connected assistants; calendar services you add a meal plan to; shopping-list or other services you send a list to; people you share with; and the public when you publish. | Account and content data remain while the relevant account, content or feature remains, and afterwards where needed for backups, deletion, a specific legal obligation, incident, dispute or claim. A pending assistant authorization is kept for up to 10 minutes; assistant connection, credential, client-registration and write records are each kept for up to 90 days. Deletion records follow a 90-day identifier-minimization and 10-year record-retention schedule, subject to routine cleanup and documented legal holds. |
| Health or other special-category information in chats or other content you write | Personalize and support requested features; handle legal claims; and, with your explicit consent, staff review of that information in chats. Contract or legitimate interests under Article 6 GDPR; Article 9(2)(a) for consent-based staff review and Article 9(2)(f) for legal claims. The quality review of chats described below, including reading by AI coding tools, does not look for this information and makes no decision about you. | Authorized staff; hosting, storage and AI providers; the AI coding tool providers named below. | Special-category data in content follows that content’s retention. |
| Public post text, comments, creator details, links and media from a public page you ask us to import | Retrieve, attribute and convert the named page into a recipe; check and improve import accuracy. Our legitimate interests in providing a user-directed import and in improving it. | Authorized staff; public-content retrieval, hosting, storage and AI providers. | The retrieved source copy is normally kept for about one hour; a video from the page sent to an AI provider for extraction is held there for up to 48 hours. A copy of the text used for extraction, with the resulting draft recipe, may be kept as a test case for checking import accuracy; it is deleted within 90 days unless selected for that testing, and a selected test case is deleted when it is no longer used for that testing or on a successful objection. The saved result follows the retention for user content. The creator's name, handle, profile link and a copy of their profile picture are kept while an imported recipe credits them, and removed on a successful objection. Information needed for objections, rights complaints or claims remains while necessary for that purpose. |
| Purchase, subscription, entitlement, refund and withdrawal data from you, payment providers and app stores; contact, support and feedback messages from you, including reports you make about another user's content and reports other users make about yours; email and push information generated when we communicate with you | Administer purchases and access; meet legal and accounting duties; handle requests, support and claims; review feedback to improve the Service; review reported content and accounts and enforce our Terms; send necessary or requested communications and optional marketing. Contract, legal obligations, our legitimate interests in support, claims, service improvement, safety and Terms enforcement, and consent for electronic marketing where required. | Authorized staff; analytics, customer-support, hosting, database, payment, entitlement, app-store, email, push-delivery and private staff-messaging providers. | Purchase and accounting records remain for the applicable statutory period and longer where necessary for a dispute or claim. Support records remain while needed to handle the matter and any related obligation or claim. Feedback is deleted with your account and otherwise about one year after you send it; the copy of it in our staff-messaging channel is kept until we remove it, including on a successful erasure request or objection. A report about your content is deleted with the reporter's account and otherwise about one year after it is sent. Communication data remains while the relevant account, request, preference or suppression record is needed. |
| Device, browser, IP address, attribution, feature-use, request, error, performance and other technical data generated through use of the Service, and interaction data showing how pages and screens are used | Provide essential device features and preferences; measure acquisition, use and reliability; secure the Service; prevent abuse; investigate faults; enforce limits and terms; and handle claims. Consent for non-essential device access and analytics where the law requires it; otherwise our legitimate interests in security, reliability, abuse prevention, limited product measurement and claims. | Hosting, analytics, security, logging and error-monitoring providers. | Analytics events and interaction data are kept for up to seven years. Unlinked attribution data is kept for up to 30 days; account-linked attribution remains while the account exists or until a successful objection. Operational logs and error events are generally kept for up to 30 days. Evidence for an identified incident, obligation, dispute or claim remains while necessary for that matter. |
When signed-in device analytics is enabled, we also share your account email address with a customer-support provider to match support requests from the same address.
We do not use your recipes, chats, images or other content to train AI models. Where an AI provider accepts a setting that refuses the collection of request data, we send it with every request. On the accounts we use for the AI coding tools described below, the setting that would let the provider use what it receives to improve its models is turned off.
You must provide the account and content data necessary for a feature you request; without it we cannot create the account or provide that feature. Preferences, health information, consent-based staff review of special-category chat content, analytics, marketing and push notifications are optional.
Limited account-linked measurement of completed service operations runs by default under our legitimate interests in service improvement, separately from the optional analytics choice, which governs device tracking on this browser or app. You may object on grounds relating to your particular situation through our contact form.
We review finished chat exchanges automatically to check and improve the assistant. A copy of the chat, without your name, email address or other account identity, is graded by AI providers; the grades change nothing in your chats or account and are kept until the chat or your account is deleted. When a grade is low, the assistant cannot complete an action or answers with a standard message in a chat, or a recipe you create receives a low review or fails, authorized staff investigate the cause with AI coding tools provided by Anthropic Ireland, Limited and OpenAI Ireland Limited. Through a read-only connection, the tool reads the chat's messages and the assistant's replies, the recipe as it was reviewed, the review's scores, findings and failure codes, what you asked for when creating or importing the recipe, and the diets saved on your account when the recipe was created, but not your name, email address or other account identity. We use those tools on individual plans, so each provider processes what the tool sends it as an independent controller under its own privacy policy rather than on our instructions, and may transfer it to the United States under its own safeguards. A provider may keep a session its own safety systems flag and use it to improve its models, or keep one for a legal, fraud or security reason. Anthropic otherwise keeps what it receives for 30 days; OpenAI keeps it until it is deleted from the account we use and for up to 30 days afterwards. Nothing the tool reads is copied into our issue trackers or other tools; they record only codes, counts, identifiers and a description of the fault in our own words. This reading does not depend on the optional staff-review permission. The review and this investigation rest on our legitimate interests in checking and improving the Service. You may object to this review on grounds relating to your particular situation through our contact form.
Our browser extension reads the address of a page or link only when you use it to save that page or link. It then sends Daily Simmer that address, the browser you use and the extension version, so that we can import the recipe and help you if the import fails. While your account is connected, the extension also receives your account name and the address of your profile picture from Daily Simmer each time you open it, to show which account is connected. It keeps them only in the browser’s session storage, which is cleared when you log out of the extension, when the connection ends and no later than the end of the browser session, and your browser loads the picture from our sign-in provider. We use and transfer information the extension receives only in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Dictation in the mobile app turns what you say into text with your device's own speech recognition, which needs your permission for the microphone and, on iOS, for speech recognition. The app starts dictation only when your device can recognize your language without a network service, so the recording and its recognition stay on your device. The recording is deleted once its words are placed in your message, you discard it or you leave the chat. Only the text you send reaches us, and we process it like any other chat message. While analytics is enabled, we record whether a message was typed or dictated, how long the dictation lasted and whether it worked, never the words.
We may occasionally ask you how likely you are to recommend Daily Simmer, with an optional reason and optional permission to contact you about your answer. We select whom to ask from the age and recent use of the account. Your answer is feedback under this Policy; a record of each invitation is kept for up to one year and a summary of your survey status while your account exists; and the limited measurement described above receives only a band of your score and where you were asked, not the exact score or your reason. This rests on our legitimate interests in understanding and improving the Service. An objection recorded as described above also stops further invitations. If we uphold it, we delete the invitation records, your survey status and any reason you gave, and keep your scores without a link to your account until they expire.
Authorized staff access
Authorized staff may access ordinary account data and ordinary user content for the purposes stated above. We rely on contract where the access is objectively necessary for a requested feature or support, and on our stated legitimate interests otherwise.
Ingredients to avoid and diets record what you want left out, without asking why, and are processed as ordinary preferences. You can edit or remove them at any time.
Chats and other content may reveal health information or another special category of personal data. Your optional account-level consent permits staff review of that information in chats for support, troubleshooting and service improvement. When you report a chat issue, the reporting form requests your explicit consent for staff to review special-category information in that chat to investigate the report. You may withdraw either permission at any time in Privacy settings. Each permission governs reading by staff themselves; the quality review described above may read a chat with AI coding tools without it. We may instead rely on another Article 9 condition where it applies.
Cookies and device storage
We use essential cookies and device storage for sign-in, security, preferences, offline data, drafts and feature state. Where the law requires prior consent, non-essential analytics cookies or device storage are used only after you agree; elsewhere, analytics starts by default. You may turn analytics off, or withdraw your consent, at any time through Privacy settings or the website’s Privacy choices.
Session storage ends with the session. Language and similar preference cookies last up to one year. Other local feature data remains until cleared by the feature, account, app, browser or device.
Sharing and public content
We disclose personal data to the recipient categories above, people you share with, the public when you publish, buyers or successors in corporate transactions, and authorities or advisers for legal obligations or claims. Identity providers, app stores, payment merchants, connected assistants, calendar services and other services you choose to send data to may process data under their own privacy notices.
Content you make public may be accessible through Daily Simmer, public links and search engines.
International transfers
Some recipients process data outside the EEA, including in the United States. Where GDPR applies, we use an applicable European Commission adequacy decision or the Commission’s Standard Contractual Clauses; a connected assistant, calendar service or other service you choose to send data to receives it because you ask us to provide that feature (Article 49(1)(b) GDPR). Contact support@dailysimmer.com for information about a particular transfer or a copy of its safeguard.
Your choices and rights
Depending on the processing, you may have rights to access, rectify or erase personal data, restrict processing, receive portable data, and object. We restrict processing you object to while we assess it, then stop unless compelling legitimate grounds or legal claims require it. You may withdraw consent at any time without affecting earlier lawful processing, and you may always object to direct marketing.
Contact support@dailysimmer.com or use our contact form to exercise a right. We may retain data where applicable law permits or requires it.
You may complain to the Swedish Authority for Privacy Protection (IMY) or another competent EEA supervisory authority.
Changes
If we intend to use personal data for a new purpose, we will provide the information required by applicable law before doing so.