Last updated: 9 October 2026
This policy explains what personal data OGRAAL collects on its website ograal.com and in its app ograal.app, why, how long it is kept and how to exercise your rights. Our use of cookies is described in our Cookie Policy.
1. Data controller
Ingrid GALLERINI, qualified dietitian-nutritionist, publisher of OGRAAL
Registered Professional – ADELI number: 05 95 0083 5
Address: 22 Allée Raoul Vanderbecq, 05000 Gap
Email: ingrid.gallerini@nutrisport.diet
2. The data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password (encrypted), name or username, language; Google identifier if you sign in with Google | Create and manage your account | Performance of the contract (Art. 6(1)(b) GDPR) |
| Nutrition and sport profile: age, sex, height, weight, activity level, goals, sports, planned sessions, food preferences (including vegetarian mode), sports nutrition products and stock | Calculate your needs and generate your meal and fuelling plans | Performance of the contract; for health-related data (weight, height, body goals), your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time |
| Training data received from Nolio or Strava (completed sessions, energy expenditure), if you connect these services | Adjust your meals to your actual training | Your consent, given when you connect the service; you can disconnect it at any time |
| Photos of your fridge or cupboards, messages sent to the assistant | Suggest meals based on your food and answer your questions | Performance of the contract |
| Payment data (processed directly by Stripe: we never see your card number), subscription history, invoices | Manage paid subscriptions | Performance of the contract; accounting obligations (Art. 6(1)(c)) |
| Email address | Send service emails (account confirmation, password reset, important information) | Performance of the contract |
| Email address, first name | Send our news and tips, if you agreed to receive them | Your consent; unsubscribe link in every email |
| Email exchanges with us | Answer your requests and provide support | Legitimate interest (Art. 6(1)(f)) |
| Browsing data (pages viewed, actions, technical information) | Analytics, advertising on the ograal.com website | Your consent, collected through the cookie banner |
| Server technical logs (technical request ID, URL called, status, duration, error type), with no personal content | Security and proper operation of the service | Legitimate interest |
We do not sell your data. The health data in your profile is never sent to Google or used for advertising.
3. Automated recommendations
Your plans are calculated automatically by an engine based on nutrition rules defined by a dietitian-nutritionist. These recommendations have no legal effect on you and do not replace medical advice. Artificial intelligence (OpenAI) is only used to suggest dish names and analyse the photos you send; it does not determine your quantities.
4. Recipients and service providers
Your data is only accessible to the OGRAAL team as needed, and to our service providers, who process it on our behalf and on our instructions:
- Replit (app hosting) and Neon (database);
- OVH (hosting of the ograal.com website, in France);
- Stripe (payments);
- Resend (service emails);
- Mailchimp (Intuit, newsletters);
- OpenAI (photo analysis and assistant; under its API terms, this data is not used to train its models);
- Google (Google Analytics, Google AdSense on the website, sign-in with a Google account).
If you connect Nolio or Strava, these services send us your training data under their own privacy policies.
5. Transfers outside the European Union
Some providers (in particular Replit, Neon, Stripe, Resend, Mailchimp, OpenAI and Google) may process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider has signed up to it, or on the European Commission’s standard contractual clauses.
6. Retention periods
- Account and profile: as long as your account is active. An account unused for [3 years] is deleted, after a prior email notice.
- Account deletion: your account, profile and training data are erased within [30 days], except data we are legally required to keep.
- Photos sent to the assistant: [period to be confirmed, e.g. not kept after analysis].
- Invoices: 10 years (accounting obligation).
- Newsletters: until you unsubscribe, or 3 years without any interaction from you.
- Support exchanges: 3 years after the last exchange.
- Technical logs: 30 days.
- Analytics: 14 months in Google Analytics.
7. Security
We apply appropriate measures to protect your data: encrypted connections (HTTPS), encrypted passwords, restricted access, separate production databases, and technical logs without personal content.
8. Minimum age
The app is intended for people aged 15 and over. Under 15, registration requires the consent of a person with parental authority.
9. Your rights
Under the GDPR and the French Data Protection Act, you have the right to access, rectify, erase, restrict, port and object to the processing of your data, to withdraw your consent at any time, and to give instructions on what happens to your data after your death.
You can change most of your information directly in the app. For any other request, including deleting your account, email ingrid.gallerini@nutrisport.diet. We reply within one month.
You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
10. Changes
This policy may change. If there is a significant change, we will let you know in the app or by email. The date of the last update is shown at the top of this page.
