Regional Privacy Policy

1. Purpose of This Regional Privacy Policy

This Regional Privacy Rights and Compliance Policy explains the additional privacy rights and choices that may apply to you under the laws of the European Union, the United Kingdom, and California, where applicable.

It supplements our main Privacy Policy, which describes how NutritionLedger collects, uses, shares, and protects information across our website, desktop application, and related Services. This document focuses on the specific rights and procedures available to individuals in those regions.

Capitalized terms used but not defined in this Regional Privacy Policy have the meanings given to them in the main Privacy Policy or our Terms of Service.

2. Who This Policy Applies To

This Regional Privacy Policy applies to you if you are located in, or your personal information is processed in connection with, any of the following jurisdictions, where applicable:

• the European Union and the European Economic Area (“EEA”);
• the United Kingdom (“UK”); and
• the State of California, United States, only where required by applicable law.

NutritionLedger is based in the United States. We may offer our website, account, and license services to individuals in these regions. However, the core health and nutrition features of the desktop application are local-first, meaning that data entered into the app remains on your device and is not processed by NutritionLedger.

We do not currently operate a physical establishment in the EU, UK, or California, and we do not appoint a formal representative in those regions. If that changes, this policy will be updated.

Nothing in this policy is intended to imply that a particular law applies to NutritionLedger if the applicable legal thresholds are not met.

3. Relationship to Our Privacy Policy

This Regional Privacy Policy works together with our main Privacy Policy. The main Privacy Policy explains the types of information we collect, how we use it, and the third parties we work with. This document describes the additional rights that may be available to you under EU, UK, and California law.

If there is any conflict between this Regional Privacy Policy and the main Privacy Policy, this Regional Privacy Policy will apply to the extent necessary to satisfy the applicable regional legal requirements.

Our main Privacy Policy remains the primary source of information about our data practices. You should read both documents to fully understand how your personal information is handled.

The main Privacy Policy is incorporated by reference into these regional disclosures.

4. European Union & EEA Privacy Rights

If you are located in the European Union or the European Economic Area (“EEA”), the General Data Protection Regulation (“GDPR”) may apply to our processing of your personal information. This section explains the additional rights and information that may apply to you.

4.1 Data Controller

For the purposes of the GDPR, the data controller for the personal information collected through the NutritionLedger website, account system, license purchase, and support channels is:

You may contact us at [email protected] for privacy-related inquiries.

4.2 Important Note About Local Health Data

NutritionLedger is a local-first application. Health, nutrition, exercise, and other wellness data that you enter into the desktop application is stored only on your own device. We do not collect, access, or process that data. Therefore, the GDPR rights described in this section apply primarily to the account, purchase, support, and website usage information described in our main Privacy Policy.

4.3 No EU Representative

We are based in the United States and currently do not appoint a formal EU representative under Article 27 of the GDPR. We rely on the exemption in Article 27(2) because our processing is occasional, does not involve large-scale processing of special category data, and is unlikely to result in a risk to the rights and freedoms of individuals.

You may contact us directly at [email protected] with any privacy questions or requests.

4.4 Your Rights

Under the GDPR, you may have the following rights, subject to certain exceptions:

• Right of access — to request a copy of the personal information we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete information.
• Right to erasure — to request deletion of your personal information in certain circumstances.
• Right to restrict processing — to request that we limit how we use your information.
• Right to data portability — to receive your information in a portable, machine-readable format.
• Right to object — to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — to withdraw consent at any time where processing is based on consent.

These rights are not absolute and may be limited by applicable law, legal obligations, or our legitimate business interests.

4.5 Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you.

5. UK Privacy Rights

If you are located in the United Kingdom, the UK General Data Protection Regulation and the Data Protection Act 2018 may apply to our processing of your personal information. This section explains the additional rights and information that may apply to you.

5.1 Data Controller

For the purposes of UK data protection law, the data controller for the personal information collected through the NutritionLedger website, account system, license purchase, and support channels is:

You may contact us at [email protected] for privacy-related inquiries.

5.2 Important Note About Local Health Data

As described in our main Privacy Policy, NutritionLedger is a local-first application. Health, nutrition, and wellness data that you enter into the desktop application remains on your own device and is not processed by us. The UK GDPR rights described in this section therefore apply primarily to the account, purchase, support, and website usage information we actually collect.

5.3 No UK Representative

We are based in the United States and currently do not appoint a formal UK representative under Article 27 of the UK GDPR. We rely on the exemption in Article 27(2) because our processing is occasional, does not involve large-scale processing of special category data, and is unlikely to result in a risk to the rights and freedoms of individuals.

You may contact us directly at [email protected] with any privacy questions or requests.

5.4 Your Rights

Under UK data protection law, you may have the following rights, subject to certain exceptions:

• Right of access — to request a copy of the personal information we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete information.
• Right to erasure — to request deletion of your personal information in certain circumstances.
• Right to restrict processing — to request that we limit how we use your information.
• Right to data portability — to receive your information in a portable, machine-readable format.
• Right to object — to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — to withdraw consent at any time where processing is based on consent.

These rights are not absolute and may be limited by applicable law, legal obligations, or our legitimate business interests.

5.5 Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you.

6. GDPR/UK GDPR Legal Bases

Under the GDPR and UK GDPR, we must have a lawful basis for each processing activity involving personal information. The table below summarises the primary legal bases we rely on. The main Privacy Policy describes each processing activity in more detail.

• Account creation and management: Performance of a contract.
• License verification and activation: Performance of a contract.
• Payment processing: Performance of a contract; compliance with legal obligations for tax and accounting.
• Customer support: Performance of a contract; legitimate interests in providing effective support.
• Marketing communications: Consent, where required by law. You may withdraw consent at any time.
• Strictly necessary cookies and essential security: Legitimate interests in providing a secure and functioning website.
• Non-essential cookies and analytics: Consent, which you may withdraw at any time through our Cookie Preference Center.
• Security and fraud prevention: Legitimate interests; compliance with legal obligations.
• Retention of purchase records: Legal obligation (tax and accounting).
• Enforcement of terms and legal claims: Legitimate interests; compliance with legal obligations.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to processing based on legitimate interests by contacting us at [email protected].

If our processing is based on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing that occurred before the withdrawal.

7. Your GDPR/UK GDPR Rights

This section summarises the individual rights available to you under the GDPR and UK GDPR. These rights apply to the personal information we process through the website, account system, license purchase, and support channels. They do not apply to Local Health Data, because that information remains on your device and is not in our possession or control.

The following rights may be exercised by contacting us at [email protected]. We may need to verify your identity before fulfilling certain requests.

7.1 Right of Access

You may request confirmation of whether we process personal information about you and, if so, request a copy of that information along with details about how and why it is processed.

7.2 Right to Rectification

You may request that we correct inaccurate or incomplete personal information we hold about you. Where appropriate, you may also update your Account Information directly through the NutritionLedger website.

7.3 Right to Erasure

You may request that we delete personal information we hold about you in certain circumstances, such as when the information is no longer necessary for the purposes for which it was collected, or when you withdraw consent and no other legal basis applies.

This right is not absolute. We may retain information where necessary to comply with legal obligations, establish or defend legal claims, or perform a contract with you.

7.4 Right to Restrict Processing

You may request that we restrict the processing of your personal information where you contest its accuracy, the processing is unlawful, or we no longer need the information but you require it for legal claims.

7.5 Right to Data Portability

Where processing is based on consent or on the performance of a contract and is carried out by automated means, you may request a copy of your personal information in a structured, commonly used, machine-readable format. You may also request that we transmit that information to another controller where technically feasible.

7.6 Right to Object

You may object to processing based on legitimate interests, including profiling, and you have an absolute right to object to direct marketing. If you object, we will stop processing unless we demonstrate compelling legitimate grounds that override your rights, or unless the processing is necessary for legal claims.

7.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing that occurred before withdrawal. For marketing emails, you may also use the unsubscribe link in each email.

8. How to Exercise Your EU/UK Rights

To exercise any of the rights described in this Regional Privacy Policy, please contact us at:

[email protected]

8.1 Information to Include in Your Request

To help us process your request efficiently, please include:

• your full name;
• the email address associated with your NutritionLedger account;
• the specific right you wish to exercise; and
• any relevant details about your request.

8.2 Identity Verification

To protect your privacy and security, we may need to verify your identity before fulfilling certain requests, such as access or deletion. We may ask you to provide additional information to confirm that you are the person associated with the account.

We will only use the information you provide for verification purposes and will not retain it longer than necessary to complete the request.

8.3 Response Time

We will respond to valid requests within one month of receipt. If your request is complex or you have submitted multiple requests, we may extend this period by an additional two months. We will inform you if an extension is necessary.

If we refuse a request, we will explain the reasons and inform you of your right to complain to a supervisory authority and to seek a judicial remedy.

8.4 Fees

We do not charge a fee to process a privacy request unless the request is manifestly unfounded, excessive, or repetitive. In such cases, we may charge a reasonable fee or decline to act.

8.5 Local Health Data

If your request relates to Local Health Data stored in the desktop application, please note that we do not have access to that information. You can access, export, or delete Local Health Data directly using the controls provided in the NutritionLedger application.

9. Complaints and Supervisory Authorities

If you believe that our processing of your personal information violates applicable data protection law, you have the right to lodge a complaint with a supervisory authority in the country where you live, where you work, or where the alleged infringement occurred.

9.1 European Union and EEA

Each EU/EEA member state has an independent data protection authority. You may find the appropriate authority for your country by visiting the European Data Protection Board’s website or by contacting your local authority directly.

9.2 United Kingdom

In the United Kingdom, the relevant supervisory authority is the Information Commissioner’s Office (“ICO”). You may contact the ICO or submit a complaint through its website.

9.3 Contact Us First

We encourage you to contact us first at [email protected] so that we can attempt to resolve your concern directly. We will respond to legitimate inquiries within a reasonable time.

10. International Data Transfers

NutritionLedger is based in the United States. The website, account system, license purchase, and support information we collect is processed and stored in the United States.

When you use the NutritionLedger website or contact us, your Account Information, Purchase Information, and Support Communications may be transferred to, and processed in, the United States and any other country where we or our third-party service providers operate.

Some of our third-party service providers, such as Stripe, Google Analytics, Zendesk, AWS SES, ConvertKit, GitHub, and website hosting providers, may process information in countries outside your own. These countries may have data protection laws that differ from those in your jurisdiction.

10.1 Local Health Data

Your Local Health Data remains on your device and is not transferred to NutritionLedger servers. Therefore, international transfer concerns do not apply to that information.

If you choose to use the Personal Agent, health-related messages may pass through Telegram’s servers, which may be located outside your country. That transfer is controlled by Telegram and is subject to Telegram’s privacy policy and terms of service.

10.2 Safeguards

Where required by applicable law, we ensure that appropriate safeguards are in place when personal information is transferred internationally. For transfers from the European Union or EEA, we rely on Standard Contractual Clauses or an adequacy decision where applicable. For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses where applicable.

If you would like more information about the safeguards used for a specific transfer, you may contact us at [email protected].

By using the Services, you acknowledge that your information may be transferred to, and processed in, countries other than your country of residence.

11. California Privacy Rights

This section applies only if and to the extent that NutritionLedger is subject to the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”). As of the date of this policy, NutritionLedger does not meet the statutory thresholds that would require full CCPA compliance. However, we provide the following disclosures voluntarily to support transparency and consumer choice.

If you are a California resident, you may have certain rights regarding your personal information. Those rights apply to the account, purchase, support, and website usage information we collect. They do not apply to Local Health Data, because that information remains on your device and is not collected or processed by NutritionLedger.

11.1 Categories of Personal Information We Collect

We may collect the following categories of personal information, as described in our main Privacy Policy:

• Identifiers — such as name, email address, username, IP address, and similar identifiers.
• Commercial information — such as records of products purchased, transaction identifiers, and license activation details.
• Internet or other electronic network activity — such as browsing history, pages visited, and interactions with the website.
• Geolocation data — approximate location derived from your IP address.

11.2 Purposes for Collecting Personal Information

We collect and use personal information for the following business or commercial purposes:

• creating and managing your account;
• processing your license purchase and verifying activation;
• providing customer support;
• sending transactional and, with your consent, marketing communications;
• improving our website and understanding how visitors use it; and
• protecting the security and integrity of our Services.

11.3 No Sale or Sharing for Cross-Context Behavioral Advertising

NutritionLedger does not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use targeted advertising cookies or other mechanisms that would constitute a “sale” or “sharing” under the CCPA.

11.4 Sources of Personal Information

We collect personal information directly from you when you create an account, make a purchase, or contact us, and automatically from your device when you visit our website.

11.5 Retention

We retain personal information as described in our main Privacy Policy. Purchase records may be retained for tax and accounting purposes. Account Information is generally retained for no longer than one year after account closure, unless a longer period is required by law.

12. California Categories of Personal Information

The table below describes the categories of personal information we may collect and the categories of sources, purposes, and third parties associated with each category. This information is provided for transparency and applies to the website, account, purchase, and support data described in our main Privacy Policy.

We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information for any purpose that would require a right to limit under the CCPA.

13. California Right to Know

If you are a California resident and the CCPA applies to NutritionLedger, you may have the right to request that we disclose certain information about our collection and use of your personal information over the past twelve (12) months.

This may include:

• the categories of personal information we have collected about you;
• the categories of sources from which the personal information was collected;
• the business or commercial purpose for collecting the personal information;
• the categories of third parties with whom we share personal information; and
• the specific pieces of personal information we have collected about you.

13.1 How to Make a Request

To make a right-to-know request, please contact us at [email protected] with the subject line “California Right to Know Request.”

13.2 Verification

We may need to verify your identity before responding to your request. This helps protect your privacy and prevent unauthorized access to your information.

13.3 Response Time

We will respond to verifiable requests within the time period required by applicable law. If we need more time, we will inform you of the reason and extension period.

14. California Right to Delete

If you are a California resident and the CCPA applies to NutritionLedger, you may have the right to request that we delete personal information that we have collected from you, subject to certain exceptions.

14.1 What This Right Covers

You may request deletion of personal information we hold about you through the website, account system, license purchase, and support channels. We will evaluate your request and determine whether any legal exceptions apply.

14.2 Exceptions

We may retain personal information where necessary to:

• complete a transaction or provide a requested service;
• detect and prevent security incidents or fraudulent or illegal activity;
• comply with a legal obligation, including tax and accounting requirements;
• exercise or defend legal claims; or
• otherwise use the information internally in a lawful manner that is compatible with the context in which you provided it.

14.3 How to Make a Request

To make a deletion request, please contact us at [email protected] with the subject line “California Deletion Request.”

We may need to verify your identity before processing your request.

14.4 Account Deletion vs. Local Data

Deleting your NutritionLedger account does not automatically delete the Local Health Data stored on your device. If you wish to remove that information, you must delete it using the controls provided in the desktop application, or by removing the application data from your device.

15. California Right to Correct

If you are a California resident and the CCPA applies to NutritionLedger, you may have the right to request that we correct inaccurate personal information that we maintain about you.

15.1 What This Right Covers

This right applies to the account, purchase, support, and website usage information we collect and retain through our systems. It does not apply to Local Health Data, because that information is stored only on your device and is not within our control.

15.2 How to Make a Correction Request

You may request a correction by contacting us at [email protected] with the subject line “California Correction Request.”

You may also update certain Account Information, such as your name or email address, directly through the NutritionLedger website by logging into your account and editing your profile.

15.3 Verification

We may need to verify your identity before making changes to your personal information. We will only use the information you provide for verification purposes.

15.4 Local Health Data

Because your Local Health Data is stored on your device, you can correct that information directly within the NutritionLedger desktop application using the edit and update features provided for each category of data.

16. California Right to Opt Out of Sale/Sharing

Under the CCPA, California residents may have the right to opt out of the “sale” of personal information and the “sharing” of personal information for cross-context behavioral advertising.

16.1 Our Practice

NutritionLedger does not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use targeted advertising cookies or other mechanisms that would constitute a “sale” or “sharing” under the CCPA.

Because we do not engage in these activities, there is no need for you to exercise an opt-out right in this context. This section is provided for transparency and to clarify our practices.

16.2 Do Not Sell or Share My Personal Information

Even though we do not sell or share personal information, if you would like to submit a formal request concerning your personal information, you may contact us at [email protected] with the subject line “California Do Not Sell or Share Request.”

16.3 Local Health Data

Your Local Health Data remains on your device and is not sold, shared, or disclosed by NutritionLedger under any circumstances.

17. California Sensitive Personal Information

Under the CCPA, certain categories of information are considered “sensitive personal information,” including health information, precise geolocation, financial account details, and certain other categories specified by law.

17.1 Our Practice

NutritionLedger does not collect or process sensitive personal information through the website, account system, license purchase, or support channels. The health, nutrition, exercise, and wellness information that you enter into the desktop application is stored locally on your device and is not collected or accessed by us.

17.2 Right to Limit Use of Sensitive Personal Information

Because we do not collect or use sensitive personal information, the CCPA right to limit the use of sensitive personal information does not apply to our current processing activities.

If we ever begin collecting sensitive personal information, we will update this policy and provide a clear method for you to exercise any applicable rights.

17.3 Local Health Data

Your Local Health Data remains under your control on your device. You may view, edit, export, or delete that information at any time using the features provided within the NutritionLedger desktop application.

18. California Authorized Agents

If you are a California resident and the CCPA applies to NutritionLedger, you may designate an authorized agent to make a privacy request on your behalf. This section explains how that process works.

18.1 Who May Act as an Authorized Agent

An authorized agent may be:

• a person you have given written permission to act on your behalf; or
• a person or entity registered with the California Secretary of State who is authorized to act on your behalf.

18.2 How to Submit a Request Through an Authorized Agent

To submit a request through an authorized agent, the agent must contact us at [email protected] and provide:

• proof of their authorization to act on your behalf, such as a written and signed permission; and
• sufficient information to allow us to verify your identity and confirm that the request relates to you.

18.3 Verification

We may require you to verify your identity directly with us before we respond to a request submitted by an authorized agent. We may also deny the request if the agent does not provide adequate proof of authorization.

18.4 Local Health Data

Authorized agents cannot access or manage the Local Health Data stored in your desktop application because that data remains on your device and is not controlled by NutritionLedger. You remain responsible for managing that information yourself.

19. California Verification

Before fulfilling a California privacy request, we will take reasonable steps to verify your identity. This helps protect your personal information and prevent unauthorized access.

19.1 What We May Ask For

Depending on the type of request, we may ask you to provide information that allows us to confirm that you are the person associated with the Account. This may include:

• your full name;
• the email address linked to your NutritionLedger account;
• your order or transaction identifier; or
• another piece of information that matches our records.

19.2 Use of Verification Information

We will use the information you provide solely for verification purposes. It will not be used for marketing, shared with third parties, or retained longer than necessary to complete the verification process.

19.3 Failure to Verify

If we cannot verify your identity or authority to make a request, we may decline the request or ask for additional information. We will inform you if we are unable to verify your identity.

19.4 No Account Required

You do not need to create a NutritionLedger account to submit a privacy request. However, if you do not have an account, we may be limited in our ability to locate and verify information associated with you.

19.5 Local Health Data

Because Local Health Data remains on your device, we do not require, and cannot perform, verification for access to that information. You can access it directly through the NutritionLedger desktop application.

20. California Appeals

If you are a California resident and the CCPA applies to NutritionLedger, you may have the right to appeal a decision we make regarding a privacy request you submitted.

20.1 How to Submit an Appeal

If you believe that we incorrectly denied, in whole or in part, your request to know, delete, correct, or exercise any other applicable right, you may submit an appeal by contacting us at:

[email protected]

Please use the subject line “California Privacy Appeal” and include:

• your full name;
• the email address associated with your request;
• a brief explanation of the request you submitted; and
• the reason you believe our decision should be reviewed.

20.2 Appeal Review

Upon receiving an appeal, we will review the original request and our response. We will inform you of the result of the appeal in writing within the time required by applicable law.

If we deny your appeal, we will provide an explanation of the decision and, where applicable, information about how to contact the California Attorney General or another appropriate authority if you wish to escalate the matter.

20.3 Local Health Data

Appeals do not apply to Local Health Data, because that information is stored only on your device and is not under NutritionLedger’s control.

21. Non-Discrimination

If you exercise any privacy right described in this Regional Privacy Policy, NutritionLedger will not discriminate against you in violation of applicable law.

21.1 Our Commitment

We will not, because you exercised a privacy right:

• deny you access to the Services;
• charge you a different price or rate for the Services;
• provide you with a different level or quality of Services; or
• suggest that you may receive a different price, rate, level, or quality of Services.

21.2 Financial Incentives

NutritionLedger does not offer financial incentives, price differences, or service differences in exchange for the collection, sale, sharing, or retention of personal information.

21.3 Local Health Data

Because your Local Health Data is stored only on your device, exercising privacy rights related to that information has no effect on your account, license, or access to the Services.

22. Privacy Rights Contact Information

If you have any questions about this Regional Privacy Policy, or if you wish to exercise any of the privacy rights described above, please contact us using the details below.

Privacy and Data Requests

To submit a privacy request or to contact our Privacy Officer, please email:

[email protected]

General Support

For general account, billing, or technical support, please use the same email address or visit the support section of our website.

We will respond to legitimate privacy requests within a reasonable time and in accordance with applicable law.

23. Changes to This Regional Privacy Policy

We may update this Regional Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Services we provide.

When we make material changes, we will update the “Last Updated” date at the top of this page and may notify you by:

• posting a notice on the NutritionLedger website;
• sending an email to the address associated with your Account; or
• displaying a notice in the desktop application where appropriate.

Changes will become effective when the revised version is posted on the website, unless a different effective date is stated. Your continued use of the Services after the updated Regional Privacy Policy has been posted means that you accept the revised policy.

If you do not agree to the updated Regional Privacy Policy, you should stop using the Services and may close your Account.

It is your responsibility to review this Regional Privacy Policy periodically for changes.