Fivor
DEEN

Privacy policy

Version 1.2 — August 2026

This is a courtesy translation. In case of any discrepancy, theGerman version is the authoritative one.

§ 1 Controller

The controller within the meaning of the GDPR is:

Fivor GmbH
Sommerfeld 13
45481 Mülheim an der Ruhr
Germany

Managing Director: Gotthard Tischner
Commercial register: Amtsgericht Duisburg, HRB 40509
Phone: +49 208 88387766
Email: info@fivor.app
Web: fivor.com

§ 2 Overview of processing

Fivor is an AI-based nutrition assistant. In order to offer you personalised recipe suggestions and meal planning, we process various personal data. This privacy policy tells you what data we collect, for what purpose, and on what legal basis.

It applies to the website fivor.com as well as to the application at fivor.app and the mobile apps. Where the processing differs, this is noted separately.

Protecting your data is our highest priority. All user data is stored on servers in Germany.

§ 3 What data we collect

3.1 Registration data

When you create your user account, we collect:

  • First and last name
  • Email address
  • Password (stored encrypted, bcrypt hash)
  • Chosen language

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

3.2 Profile data and dietary preferences

During onboarding and ongoing use, we collect information you provide voluntarily about:

  • Your approach to food (e.g. vegan, low carb, Bas Kast)
  • Allergies and intolerances (e.g. lactose, gluten, histamine)
  • Health goals (e.g. weight loss, gut health)
  • Household size and cooking preferences
  • Favourite ingredients and dislikes

Important note: This data may constitute health data within the meaning of Art. 9 GDPR (special categories of personal data). It is processed solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give upon registration.

3.3 Chat and usage data

Using the app generates:

  • Chat histories with the AI assistant
  • Generated recipe suggestions and recipe cards
  • Recipe ratings
  • Shopping lists
  • Group memberships and invitations

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

3.4 Technical data

When Fivor is accessed, the following is collected automatically:

  • IP address (anonymised in logs)
  • Browser type and version
  • Operating system
  • Time of access

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical provision and security)

§ 4 Purposes of processing

We process your data for the following purposes:

  • Providing and operating the Fivor app
  • Creating personalised AI recipe suggestions based on your profile
  • Managing your user account and your groups
  • Sending group invitations by email
  • Technical troubleshooting and improving the app
  • Meeting statutory retention obligations

§ 5 Processors and data transfers

To provide Fivor we use carefully selected service providers with whom data processing agreements under Art. 28 GDPR are in place. These providers support us in the following areas:

  • Server hosting and data storage (location: Germany/EU)
  • AI-assisted recipe generation and language processing
  • Email delivery (e.g. group invitations)
  • Technical monitoring and troubleshooting

Your user data is stored on servers in Germany. For individual services (in particular AI processing and email delivery), a transfer to servers outside the EU may take place. Such transfers are based on Standard Contractual Clauses under Art. 46(2)(c) GDPR or an adequacy decision of the European Commission.

The data transmitted to the AI provider (chat messages, dietary profile) is used solely to generate responses and is not used to train AI models.

We are happy to provide a full list of our processors on request (info@fivor.app).

§ 6 Cookies and local storage

Fivor uses no tracking cookies and no advertising cookies. We use only technically necessary storage mechanisms:

  • JWT (JSON Web Token): to authenticate your session, stored in the browser's localStorage
  • Language setting: your chosen language is stored in localStorage

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) and § 25(2) TDDDG (technically necessary)

6.1 Specifics of this website (fivor.com)

The website fivor.com is a purely static information site. No processing beyond the technically necessary takes place on it. In particular:

  • No cookies are set.
  • There is no analytics and no audience measurement.
  • Fonts and images are served from our own server. No external font services (such as Google Fonts) and no third-party content delivery networks are used.
  • No video platforms, social networks or advertising networksare embedded.

Visiting the site produces only server log data as described in § 3.4. Consent is therefore not required, and no consent banner is used.

If you follow a link from this website into the application (fivor.app), the provisions of the remaining sections of this policy apply from that point on.

§ 7 Your rights as a data subject

Under the GDPR you have the following rights:

Right of access (Art. 15 GDPR): You may request information about the personal data we hold about you at any time.

Right to rectification (Art. 16 GDPR): You may request that inaccurate data be corrected. You can edit your profile data yourself in the app at any time.

Right to erasure (Art. 17 GDPR): You may request deletion of your data. You can delete your profile yourself in the app at any time — all personal data is then irreversibly removed.

Right to restriction of processing (Art. 18 GDPR): Under certain conditions you may request that processing be restricted.

Right to data portability (Art. 20 GDPR): You may request that we provide your data in a structured, commonly used and machine-readable format.

Right to object (Art. 21 GDPR): You may object to the processing of your data at any time where processing is based on legitimate interests.

Right to withdraw consent (Art. 7(3) GDPR): You may withdraw your consent to the processing of health data at any time. Withdrawal is effected by deleting your profile in the app settings. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, please contact:info@fivor.app

§ 8 Retention and deletion

We store your personal data only for as long as necessary to fulfil the purposes of processing or as required by statutory retention obligations.

During active use: Your data is stored for as long as you use your account.

On account deletion: All personal data is deleted immediately and irreversibly. Within groups, your name is pseudonymised ("Former member").

Technical logs: Deleted automatically after no more than 30 days.

Statutory retention: Where statutory retention obligations apply (e.g. under tax law), the affected data is blocked for the duration of that obligation and deleted afterwards.

§ 9 Protection of minors

Fivor is intended for people aged 16 and over (Art. 8 GDPR). People under 16 may use the app only with the consent of a parent or guardian. We do not knowingly collect data from children under 16 without such consent.

§ 10 Data security

We employ extensive technical and organisational measures to protect your data:

  • Encrypted transmission of all data via HTTPS/TLS
  • Encrypted storage of passwords (bcrypt hash)
  • Server access control via SSH key authentication
  • Automatic SSL certificate renewal (Let's Encrypt)
  • Regular security updates of the server infrastructure
  • JWT-based authentication with time-limited tokens
  • Database access exclusively via the backend (no direct external access)

§ 11 Right to lodge a complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority.

Competent supervisory authority:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf, Germany
Web: www.ldi.nrw.de
Email: poststelle@ldi.nrw.de

§ 12 Changes to this privacy policy

We reserve the right to adapt this privacy policy as needed to reflect changes in the law, new features or changed processing. The current version is always available atfivor.com/de/datenschutz. We will inform you of material changes by email or in-app notification.

Fivor GmbH · Sommerfeld 13 · 45481 Mülheim an der Ruhr, Germany
Managing Director: Gotthard Tischner · HRB 40509, AG Duisburg
fivor.com ·info@fivor.app