Privacy notice

Contents

1. Who we are
2. Website
3. The berryl app
4. Who receives data
5. International transfers
6. How long we keep data
7. Your rights (all users)
8. EU, EEA, Switzerland and United Kingdom
9. United States, including consumer health data
10. Australia
11. New Zealand
12. Children
13. Partners, creators and collaboration requests
14. When you write to us
15. Changes and contact

1. Who we are

Tavimo UG (haftungsbeschränkt), Quellenstraße 7a, 70376 Stuttgart, Germany
Email: privacy@berryl.app
Full details in the legal notice.

We are the “controller” under the EU and UK GDPR, the “regulated entity” under the Washington My Health My Data Act, the “business” under California law and the “APP entity” or “agency” under the Australian and New Zealand privacy laws.

2. Website

Visiting the website (server logs)

When you visit this website, our hosting provider processes technically necessary data: IP address, date and time, page requested, browser and operating system, and the page you came from. This is needed to deliver the website and protect it against misuse. The logs are deleted after 7 days.

Hosting provider: Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany; servers in data centers in Germany. We have a data processing agreement with Hetzner (Art. 28 GDPR).

No cookies, no tracking, no third-party servers

The website sets no cookies and uses no analytics or advertising services. Fonts and scripts are hosted on our own server, so no data is sent to third parties such as Google when you visit.

Links from our ads

If you arrive through one of our ads, the web address may contain campaign parameters (for example the ad platform and an ad number such as “cr017”). The website keeps them only in this browser tab (session storage) and adds them to the Google Play link, so that we can count installs per ad. They contain no personal details. Before you reach the website or the store, an ad link may pass through our own redirect, which counts the click with the ad number, platform, device type and time only, without IP address or cookie.

Trying things out on the website

On some pages you can try the app, for example by setting up a supplement routine. Your browser stores these entries on your device only (local storage). They are not sent to us. You can delete them with “Clear all” or in your browser settings. Photos you choose on the home page to try it out also stay in your browser.

Links to the app stores

When you tap a link to Google Play or the App Store, you leave our website. The privacy policies of Google or Apple apply there.

3. The berryl app

Account

To use the app you create an account with email address and password. We use this data to provide the app to you.

Your entries and health data

In the app you store, for example: profile details such as height, weight, age, sex and goals; your supplements and medications with times of day; what you have ticked off; meals with nutrition values; and body measurements. Much of this is health data (“special category data” under the GDPR and UK GDPR, “consumer health data” under Washington and Nevada law, “sensitive personal information” under California law, “sensitive information” under the Australian Privacy Act). We collect and use it only with your explicit consent, which you give when you set up the app, and only to provide the features you use. You can withdraw your consent at any time in the app settings or by email. Without this data the app does not work.

Database and servers

Your account and entries are stored by Supabase in a data center in Frankfurt am Main, Germany (region eu-central-1). Access is restricted so that each account only sees its own data. Supabase acts as our processor (service provider, Art. 28 GDPR). The contracting party is Supabase Inc. (USA). We have a data processing agreement with Supabase; for possible access from the USA, for example by technical support, the standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR).

Recognition by photo

When you take a photo of a label or a meal, it is sent to Google Gemini for recognition and analyzed there. We do not store meal photos. Label photos are kept only briefly in protected storage and deleted after analysis. We only keep the recognized text, for example the name and amounts of the supplement. Google (Google Ireland Limited, Ireland, and Google LLC, USA) acts as our processor and does not use the photos to train its AI models. The legal basis is your consent to the processing of your health data (Art. 9(2)(a) GDPR). Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework, under which Google LLC is certified, and in addition on standard contractual clauses.

Help chat

Under Account → Help you can ask questions about how berryl works. Before your first question, berryl asks for your consent (version “hilfe-chat-v1”); without it, no question goes to the AI. For this, berryl sends only your question together with excerpts from our help articles to Google Cloud (Vertex AI, Gemini model, data center in Frankfurt). Your entries, your name, your email and your user ID are not sent; the help chat never looks into your account. Google processes the data as our processor and does not use it for training. The AI only picks matching sections of the help articles; what is shown is the text of the articles word for word, with the name of the article and marked as an AI answer. Every question – including one related to health, for example about amounts, values or medications – goes to the AI, provided there are help articles in your language for your device; only attempts to get around the chat’s rules are answered by berryl with a fixed sentence, without asking the AI. The AI classifies the question itself: as a health question (fixed note), as a question about the app (a section of a help article, word for word) or as another topic (“nothing found”). Please do not enter names or health values.

We do not store the question or the answer. For 180 days we only store that a question was asked: the time, the kind of question (health question, rejected attempt at manipulation or other question), whether something was found, which articles were shown and the number of text units processed (tokens) – to enforce the limit of 20 questions per hour and 100 per day and to detect misuse. “Report a problem” opens a prepared email in your mail app with your question, the type of device and the app version; you can change it before sending, and it only goes out when you send it.

The legal basis is your consent (Art. 6(1)(a) GDPR, and for health information in a question explicitly under Art. 9(2)(a) GDPR). We store when you consented and to which version. You withdraw it with “Withdraw consent” on the help page; this takes effect immediately.

Barcode lookup

When you scan a product barcode, the app asks the open database Open Food Facts (France) for this barcode. The barcode and, for technical reasons, your IP address are sent, but no account data.

Health apps and wearables (optional)

If you allow it, berryl reads values from Health Connect on your device. If you connect a wearable (WHOOP, Oura or Withings), you sign in there yourself and allow access. berryl then fetches values such as steps or sleep once a day. You can disconnect at any time. This is based on your consent.

Reminders

The app schedules reminders directly on your phone. No data is sent to a push service for this.

Purchases and subscriptions

You subscribe through Google Play or the App Store. We do not receive your payment details. We only learn whether a subscription is active and what was purchased. To manage subscriptions from both stores in one place, we use RevenueCat (RevenueCat, Inc., USA) as our processor. RevenueCat receives a random ID of your account and the store’s purchase data (product, period, status), but no health data and no payment details. The legal basis is the performance of the subscription contract (Art. 6(1)(b) GDPR); standard contractual clauses apply to the transfer to the USA.

Which ad brought you (Android, statistics only)

If you installed berryl on Android through one of our ads, Google Play passes the ad platform and our ad number (for example “meta, cr017”) to the app (install referrer). The app stores this with your account so that we can see how many sign-ups and subscriptions each ad brought. Our internal reporting only receives totals per ad and day, never individual accounts, and no health data. Nothing is sent to ad platforms. The entry is deleted with your account. The legal basis is our legitimate interest in measuring the success of our advertising (Art. 6(1)(f) GDPR). You can object; an email to privacy@berryl.app is enough, and we will delete the entry.

No analytics or advertising tools

The app has no tools for audience measurement, crash analytics or advertising built in. We do not use your data for targeted advertising, and we do not sell it or “share” it for cross-context behavioral advertising.

No automated decisions

berryl makes no decisions with legal or similarly significant effects based solely on automated processing. Notes on nutrient values are information. What you do with them is up to you.

4. Who receives data

All of these act on our behalf (processors or service providers), except Google Play, Apple and Open Food Facts, which act on their own responsibility. We do not sell personal data, including consumer health data, and have not done so in the past 12 months. We disclose data to authorities only where the law requires it.

5. International transfers

We are based in Germany and store your account in the EU. If you use berryl from the United Kingdom, the United States, Australia or New Zealand, your data is therefore transferred to and stored in Germany. Some service providers may access data from other countries, especially the USA. For transfers out of the EU or UK we use an adequacy decision (for example the EU-US Data Privacy Framework and its UK Extension) or standard contractual clauses. Specifically: for possible access by Supabase from the USA, standard contractual clauses apply; for Google, the EU-US Data Privacy Framework, under which Google LLC is certified, and in addition standard contractual clauses; for RevenueCat and Anthropic, standard contractual clauses. For New Zealand, we disclose data overseas only where the recipient is subject to privacy laws with comparable safeguards, such as the GDPR, or is bound by contract to protect it (Information Privacy Principle 12). For Australia, we take reasonable steps under Australian Privacy Principle 8 to ensure that overseas recipients handle your data in line with the Australian Privacy Principles.

6. How long we keep data

We keep your data as long as you have an account. You can delete your account yourself at any time: in the app under Account → “Settings” → “Delete account” (instantly) or without the app by email to support@berryl.app (within 30 days), see Delete your account. We then delete your account and all data you stored in berryl. What a practice created about you itself (its record, invoices) is the practice’s responsibility and stays there; the link to your account is removed. Store purchases (time, product, price) are kept for the statutory retention periods with a pseudonymous ID that no longer belongs to any account. Deleting does not cancel a running subscription. The legal basis for keeping these records is our legal obligations (Art. 6(1)(c) GDPR with German tax and commercial law, § 147 AO and § 257 HGB). Deleted data disappears from the database backups after 30 days at the latest.

7. Your rights (all users)

Wherever you live, you can ask us to:

• tell you what data we hold about you and give you a copy (access, portability),
• correct wrong data,
• delete your data (you can also delete your account directly in the app),
• stop using it on the basis of your consent (withdraw consent at any time, with effect for the future).

Email privacy@berryl.app. We may need to confirm your identity, usually by a reply from the email address of your account. We respond within the deadlines that apply to you (generally within 30 days in the EU, UK, Australia and New Zealand, and within 45 days in the US states with consumer privacy laws). Using your rights will not put you at a disadvantage with us.

8. EU, EEA, Switzerland and United Kingdom (GDPR, UK GDPR)

Legal bases

• Account, app features, subscriptions: performance of our contract with you (Art. 6(1)(b) GDPR / UK GDPR).
• Health data: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR / UK GDPR).
• Wearables and Health Connect: your consent (Art. 6(1)(a) and Art. 9(2)(a)).
• Server logs, security, our redirect for ad links: our legitimate interest in a secure website and in measuring which ads work (Art. 6(1)(f)).
• Records we must keep: legal obligation (Art. 6(1)(c)).

Your additional rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3)).

You can complain to a data protection supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (the data protection commissioner of the German state of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, or the authority where you live. In the United Kingdom this is the Information Commissioner’s Office (ICO, ico.org.uk). In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) applies under the Swiss Federal Act on Data Protection.

9. United States, including consumer health data

Consumer health data privacy policy (Washington, Nevada and similar laws)

This section is our consumer health data privacy policy under the Washington My Health My Data Act (RCW 19.373), Nevada SB 370 and similar state laws, such as the Connecticut consumer health data provisions.

• Categories of consumer health data we collect: supplements and medications you take with amounts and times; meals and nutrition values; body measurements (height, weight); goals; data you choose to import from Health Connect or wearables (for example steps and sleep); photos of meals and labels (processed for recognition, not stored as images).
• Sources: you, your device (Health Connect) and wearable providers you connect.
• Purposes: only to provide the app features you request (logging, totals, reminders, comparisons with reference values) and to keep the service secure.
• Categories we share and with whom: we do not share consumer health data with third parties other than our processors listed in section 4 (database hosting, photo recognition), who may use it only on our behalf. Your photos go to Google Gemini for recognition.
• Sale: we do not sell consumer health data.
• Consent: we collect consumer health data only with your consent, and we would ask for separate consent before any sharing beyond what is needed for the service you request.
• Your rights: confirm whether we collect, share or sell your consumer health data; access it, including a list of all third parties and affiliates with whom we shared it; withdraw consent; and have it deleted (including from our processors). Email privacy@berryl.app. If we decline your request, you can appeal by replying to our decision with the subject “Appeal”; if the appeal is denied, you may contact the Washington State Attorney General.
• No geofencing: we do not use geofences around health care facilities.

California (CCPA as amended by CPRA) and other state privacy laws

The California Consumer Privacy Act and comprehensive privacy laws in states such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon apply to businesses above certain thresholds. Whether or not they apply to us, we follow these principles:

• Categories collected in the last 12 months: identifiers (email address); account and purchase status; sensitive personal information (health data as described above, account login); internet activity on our website only in server logs; inferences are not drawn for profiling.
• Purposes: as described in section 3. We use sensitive personal information only to provide the service you request, so a “limit the use of my sensitive personal information” link is not required.
• Sale and sharing: we do not sell personal information and do not share it for cross-context behavioral advertising. We do not knowingly sell or share data of consumers under 16.
• Your rights: to know, access, correct and delete, to opt out of sale, sharing and targeted advertising (we do none of these), and not to be discriminated against for using your rights. You may use an authorized agent. Where state law gives you a right to appeal a decision, reply to our decision with the subject “Appeal”.
• Global Privacy Control: since we do not sell or share data and set no tracking cookies, there is nothing further for an opt-out signal to switch off; we honor it nonetheless.
• Retention: see section 6.

Not a HIPAA service

berryl is a consumer app. We are not a health care provider or health plan, and data you enter in berryl is generally not covered by the Health Insurance Portability and Accountability Act (HIPAA).

10. Australia (Privacy Act 1988)

We handle personal information in line with the Australian Privacy Principles (APPs). Health information is “sensitive information”; we collect it only with your consent and only where it is reasonably necessary for the app (APP 3). We use it only for the purpose it was collected for (APP 6). You can access and correct your information (APPs 12 and 13). You may use the app without your real name, but an email address is needed for an account (APP 2). Your data is stored in Germany and may be accessed by service providers in other countries, especially the USA (see section 5, APP 8).

If you have a complaint, please contact us first at privacy@berryl.app. We will reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC, oaic.gov.au).

11. New Zealand (Privacy Act 2020)

We handle personal information in line with the Information Privacy Principles (IPPs) of the Privacy Act 2020. We collect only what we need for the app (IPP 1), tell you why (IPP 3), keep it safe (IPP 5) and let you access and correct it (IPPs 6 and 7). Your data is disclosed overseas to Germany and to service providers as set out in section 5 (IPP 12). If there is a privacy breach that is likely to cause serious harm, we will notify you and the Privacy Commissioner.

If you have a complaint, please contact us first at privacy@berryl.app. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

12. Children

berryl is meant for adults. You must be at least 16 years old to create an account. We do not knowingly collect data from children under 13. If we learn that a child under 16 has given us data, we delete it. If you believe this has happened, please contact us.

13. Partners, creators and collaboration requests

This section applies to people who work with berryl or whom we approach about working together. Health data from the app is not part of it: partners and creators receive no data about the people who use their code, only numbers.

Partner program (own code in the partner area)

To sign up you need a confirmed berryl account (email address). We store your name, country, language, up to five channels, your code, and the version and time of the partner terms you accepted. For payouts you enter the account holder, IBAN, tax status and, if any, your VAT ID; if you are a business, also your address, because it must appear on the credit note (German VAT Act, § 14(4) UStG). For your code we store how often it was redeemed, how many people took out a subscription, the commission and the payouts. To calculate the commission, berryl records internally which account came through which code – without health data.

Legal basis: performance of the partner terms (Art. 6(1)(b) GDPR); for credit notes and bookkeeping our legal obligations (Art. 6(1)(c) GDPR with German tax and commercial law).

The data is stored in the app database at Supabase in Frankfurt. For the monthly payout, our internal management tool (CRM, also Supabase, data center in Ireland) copies each night – only for partners with a balance of at least €50 and complete details – the code, country, account holder, IBAN, tax status, VAT ID, address and the date of the partner terms; no email address and nothing about buyers. Only the owner and bookkeeping have access. Payment is made by SEPA transfer via our business bank.

Whether the app shows you the invitation “Become a berryl partner” is checked within your own account: country, account age and whether you logged something on at least 7 days. The result is only a yes or no and does not leave berryl (legitimate interest, Art. 6(1)(f) GDPR; you can object).

Creators with a contract

If we work with you under a creator contract, our CRM stores your name, contact details (email, phone if given), channels, approximate reach, contract details, your code and its numbers, and for payouts the account holder, IBAN, tax status, tax number or VAT ID, country and your consent to self-billing. On request your own berryl account gets Premium, linked to your code. Legal basis: the contract (Art. 6(1)(b) GDPR); for credit notes and bookkeeping our legal obligations (Art. 6(1)(c) GDPR). Payout details are visible only to the owner and bookkeeping.

When we contact you about working together

We contact creators, nutrition professionals and practices whose work fits berryl. Your details come from sources you published yourself: your profile (e.g. Instagram, TikTok, YouTube), your website or your legal notice. We only email addresses given there expressly for business or collaboration inquiries, and we record where we found them.

We store your name, company if any, business email or practice address, links to your profiles, approximate reach and topics, where we found the address, and our contact history (when we wrote and whether you replied). The purpose is a request to work together; the legal basis is our legitimate interest in introducing berryl to suitable partners (Art. 6(1)(f) GDPR). We follow up at most once. If you reply, we no longer write automatically, only personally if you want.

An AI assistant (Claude by Anthropic) prepares the personal sentence and the draft of an email, using only the public details above. A person checks and approves every email. Anthropic (Anthropic Ireland, Limited, Ireland, and Anthropic PBC, USA) acts as our processor and does not use the data for training; standard contractual clauses apply to the transfer to the USA. We send emails via Google Workspace (Gmail) and letters via a printing and mailing service; both act as our processors. The CRM is hosted by Supabase in Ireland.

Objection: a short reply such as “not interested” is enough (Art. 21 GDPR). We will not write to you again. To make sure of that, we keep only a one-way checksum (hash) of your address on a block list. If no collaboration comes about, we delete the other details 12 months after our last email.

How long we keep partner and creator data

We keep partner and creator data while we work together. If you delete your berryl account or the contract ends, your code is switched off. Commissions, credit notes and payouts are kept as long as commercial and tax law requires (in Germany 8 years for accounting records, 6 years for business letters, § 147 AO, § 257 HGB); then we delete them.

14. When you write to us

If you send us an email (for example to contact@berryl.app or support@berryl.app), we process your address, your name if you give it, and the content in order to reply to you. Emails are stored with Google Workspace (Google Ireland Limited) as our processor. We delete them once your request has been dealt with and no retention obligation applies.

If you use the contact form on this website, we process your email address, your name if you give it, and your message. Messages from the form are stored in our CRM at Supabase in Ireland and forwarded to contact@berryl.app. We delete them from the CRM after 180 days.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) or our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). Please do not send us health values by email or through the form.

15. Changes and contact

We update this notice when the app or the law changes and show the date below. For material changes, we inform you in the app. Questions: privacy@berryl.app.

The German version (Datenschutzerklärung) applies to users in Germany, Austria and Switzerland.

Last updated: 6 November 2026.