Privacy Policy
Last updated: 29.06.2026
SOFTITURA LLC (“we”) respects your privacy. This Policy explains what data we collect when you use Vitra (the “Service”), why we collect it, and how you can control it.
1. Data we collect
1.1. Account data
- email address (when registering via email);
- OAuth identifier and profile info (name, avatar) — when signing in via Google;
- display name, locale, preferences you provide in Settings.
1.2. Nutrition data
- photos of meals you upload for AI analysis;
- meals you log manually or via AI (name, calories, macros, time);
- goals (target calories, macros, weight goal) you set in the app;
- generated meal plans and shopping lists.
1.3. Technical data
- IP address, browser/device user agent, language;
- aggregated usage analytics (pages opened, features used);
- error and performance logs.
2. Why we process this data
- provide and maintain core Service features;
- generate personalised AI analyses, plans and recommendations;
- process subscriptions and trials;
- improve the product (aggregated and anonymised analytics);
- respond to support requests;
- comply with legal obligations.
3. Legal basis (GDPR)
We rely on: (a) performance of contract — to deliver features you requested; (b) your consent — for optional analytics and marketing; (c) legitimate interest — for product improvement and fraud prevention; (d) legal obligation — for tax/accounting records.
4. Sub-processors
To deliver the Service we use:
- cloud hosting and database provider (storage of your data);
- AI gateway and LLM/image providers — receive only the necessary content (photo or text of a meal) for the duration of the request;
- payment provider — processes payments (we do not store full card data);
- email provider — sends transactional emails.
All sub-processors are bound by data-processing agreements.
5. Sharing
We do not sell your personal data. We share data only with the sub-processors above and only as needed to deliver the Service, or when required by law.
6. Storage and retention
Your data is stored on our backend infrastructure with encryption in transit and at rest. We retain account data while your account is active, and for up to 30 days after deletion (longer where required by law).
7. International transfers
Your data may be processed outside your country. We use providers offering adequate protection (Standard Contractual Clauses or equivalent safeguards).
8. Your rights
You have the right to: access, correct, delete, restrict or export your personal data; withdraw consent; object to processing; lodge a complaint with a supervisory authority. To exercise any of these, email privacy@vitra.fit.
9. Children
The Service is not intended for users under 16. We do not knowingly collect data from children.
10. Security
We apply technical and organisational measures: TLS encryption, row-level security in the database, principle of least privilege, audit logs of admin actions, regular dependency updates.
11. Changes
We will update this Policy when needed; the “Last updated” date reflects the current version.