Privacy Policy

1. Who we are

Mintflow Nutrition ("we", "us") is the data controller responsible for personal data collected through this site. For any privacy question or to exercise your rights, contact us at mintflow.hq@gmail.com.

2. What we collect

• Email address: when you subscribe to our newsletter, request a free guide, or join a waitlist. We also record the date and the source of your sign-up. Because our emails are about GLP-1 medicines, being on our list can suggest that you use one, which data protection law treats as health information. We ask for your explicit consent to this when you sign up, use it only to send you the emails you asked for, and never use it for advertising.
• When you ask us to email you a recipe: we use your email address only to send that recipe, unless you also tick the box to join our newsletter. To stop the form being misused, we keep a scrambled (hashed) form of your email and network address, which cannot be turned back into either, for 30 days.
• When you sign up or we check your email address: to stop our forms being used to send unwanted email, we keep a scrambled (hashed) form of the email and network address used, which cannot be turned back into either, for 30 days.
• Order & payment details: if you buy an ebook (card details are processed directly by our payment provider; we do not see or store your full card number).
• Anonymous usage analytics: aggregated, cookie-free statistics about how the site is used.

3. Why we use it, and our lawful basis

• To send the content or product you asked for. Lawful basis: performance of a contract / your request.
• To send marketing emails (newsletter, tips, launches). Lawful basis: your consent, including your explicit consent for the health information your sign-up may reveal, which you can withdraw at any time.
• To operate, secure, and improve the site. Lawful basis: our legitimate interests in running a functional, safe service.
• To meet legal and accounting obligations (e.g. for purchases). Lawful basis: legal obligation.

4. Who we share it with

We use trusted service providers ("processors") who handle data only on our instructions, under data processing agreements:

• Supabase: database & storage (hosted in the EU).
• Vercel: website hosting & cookie-free analytics.
• Resend: sending emails.
• Stripe: payment processing.

We never sell your personal data.

5. International transfers

Your data is primarily stored in the EU. Some providers (e.g. Vercel, Stripe) may process data outside the EU/UK; where they do, transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Agreement.

6. How long we keep it

We keep newsletter and lead emails until you unsubscribe or ask us to delete them, after which they are removed within 30 days. If you sign up but never confirm your email, the sign-up is deleted after 30 days. Hashed records of recipe emails, sign-ups and email checks are deleted after 30 days. Order records are kept for as long as Romanian tax and accounting law requires.

7. Your rights

Under the EU GDPR and UK GDPR you have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and withdraw consent at any time (without affecting prior processing). To exercise any of these, email mintflow.hq@gmail.com.

You also have the right to lodge a complaint with a supervisory authority. In the EU or EEA you can complain to your local EU or EEA data protection authority, normally the one where you live, work, or where the issue arose (find yours at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). Our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) (https://www.dataprotection.ro/), because we are established in Romania. In the UK, contact the UK Information Commissioner's Office (ICO) (https://ico.org.uk/).

8. Cookies & analytics

We aim to keep this site cookie-light. We currently use only essential cookies needed for the site to function, and our analytics (Vercel) are cookie-free and do not track you across sites. If we later add services that set non-essential cookies (for example payment or advertising tools), we will ask for your consent first via a cookie banner.

9. Marketing emails

You only receive marketing emails if you opted in. Every email includes a one-click unsubscribe link, and you can opt out at any time with no effect on any purchase.

10. Changes

We may update this policy; we'll revise the date above and, for material changes, notify subscribers by email.