Fivor
DEEN

Privacy policy

Version 1.6 — 26 September 2026

This is a courtesy translation. In case of any discrepancy, theGerman version is the authoritative one.

§ 1 Controller

The controller within the meaning of the GDPR is:

Fivor GmbH
Sommerfeld 13
45481 Mülheim an der Ruhr
Germany

Managing Director: Gotthard Tischner
Commercial register: Amtsgericht Duisburg, HRB 40509
Phone: +49 208 88387766
Email: info@fivor.com
Web: fivor.com

§ 2 Overview of processing

Fivor is an AI-based nutrition assistant. In order to offer you personalised recipe suggestions and meal planning, we process various personal data. This privacy policy tells you what data we collect, for what purpose, and on what legal basis.

It applies to the website fivor.com as well as to the application at fivor.app and the mobile apps. Where the processing differs, this is noted separately.

Protecting your data is our highest priority. All user data is stored on servers in Germany.

§ 3 What data we collect

3.1 Registration data

When you create your user account, we collect:

  • First and last name
  • Email address
  • Password (stored encrypted, bcrypt hash)
  • Chosen language

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

3.2 Profile data and dietary preferences

During onboarding and ongoing use, we collect information you provide voluntarily about:

  • Your approach to food (e.g. vegan, low carb, Bas Kast)
  • Allergies and intolerances (e.g. lactose, gluten, histamine)
  • Health goals (e.g. weight loss, gut health)
  • Household size and cooking preferences
  • Favourite ingredients and dislikes

Important note: This data may constitute health data within the meaning of Art. 9 GDPR (special categories of personal data). It is processed solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, which you give upon registration.

3.3 Chat and usage data

Using the app generates:

  • Chat histories with the AI assistant
  • Generated recipe suggestions and recipe cards
  • Recipe ratings
  • Shopping lists
  • Group memberships and invitations

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

3.4 Technical data

When Fivor is accessed, the following is collected automatically:

  • IP address (anonymised in logs)
  • Browser type and version
  • Operating system
  • Time of access

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical provision and security)

We record the extent of your AI usage (number of requests and their estimated cost per month) per account in order to manage costs and prevent misuse; a monthly limit applies to this. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in the economic efficiency and security of the service.

We do not collect crash reports from the app. If an error occurs in the app, it is recorded solely in your device's own log and is not transmitted to us.

3.5 Feedback and support reports

When you send us feedback through the app or report a piece of content, we collect:

  • your free text (a description of your request)
  • optionally exactly one image attachment that you select yourself from the camera or your photo library
  • technical details at the time of the report (app version, operating system and its version, device model)

The image attachment is optional; the report can be submitted without it. Please note that a screenshot may contain information about third parties.

Legal basis: Art. 6(1)(b) GDPR where the report concerns your own account or your use of the service; Art. 6(1)(f) GDPR for reports about third-party content and for the technical details. Our legitimate interest lies in the security of the service, the protection of our users and the resolution of technical faults.

3.6 Reading menus

When you use the “Menus” feature, we process:

  • Photos of menus that you take with the camera or select from your photo library. They are transferred to our server in reduced size and passed on to our AI provider for reading and translation. We do not store the photos; they are discarded after processing.
  • The location where you read the menu: from the location data of the photo or, for a camera photo and only with your permission, from the location of your phone. Your phone determines the place name via the map service of its operating system. Without permission, the menu is stored without a location.
  • The result: the menu as read, with dishes, prices and markings, stored in your account until you delete it.

Your dietary profile is also used for the markings; insofar as it contains health data, only with your consent (§ 3.2). A photo may contain information about third parties, such as people in the background.

Legal basis: Art. 6(1)(b) GDPR; for health data Art. 9(2)(a) GDPR.

§ 4 Purposes of processing

We process your data for the following purposes:

  • Providing and operating the Fivor app
  • Creating personalised AI recipe suggestions based on your profile
  • Reading, translating and classifying menus
  • Managing your user account and your groups
  • Sending group invitations by email
  • Handling and responding to support requests and reports
  • Technical troubleshooting and improving the app
  • Meeting statutory retention obligations

§ 5 Processors and data transfers

To provide Fivor we use carefully selected service providers with whom data processing agreements under Art. 28 GDPR are in place. These providers support us in the following areas:

  • Server hosting and data storage (location: Germany/EU)
  • AI-assisted recipe generation, language processing and the reading of menus
  • Email delivery (e.g. group invitations)
  • Technical monitoring and troubleshooting
  • Object storage for attachments from support reports (location: Germany/EU)

Your user data is stored on servers in Germany. For individual services (in particular AI processing and email delivery), a transfer to servers outside the EU may take place. Such transfers are based on Standard Contractual Clauses under Art. 46(2)(c) GDPR or an adequacy decision of the European Commission.

The data transmitted to the AI provider (chat messages, dietary profile, photos of menus) is used solely to generate responses and for any misuse review and is not used to train AI models.

We are happy to provide a full list of our processors on request (info@fivor.com).

§ 6 Cookies and local storage

Fivor uses no tracking cookies and no advertising cookies. We use only technically necessary storage mechanisms:

  • JWT (JSON Web Token): to authenticate your session, stored in the browser's localStorage
  • Language setting: your chosen language is stored in localStorage

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) and § 25(2) TDDDG (technically necessary)

6.1 Specifics of this website (fivor.com)

The website fivor.com is a purely static information site. No processing beyond the technically necessary takes place on it. In particular:

  • No cookies are set.
  • There is no analytics and no audience measurement.
  • Fonts and images are served from our own server. No external font services (such as Google Fonts) and no third-party content delivery networks are used.
  • No video platforms, social networks or advertising networksare embedded.

Visiting the site produces only server log data as described in § 3.4. Consent is therefore not required, and no consent banner is used.

If you follow a link from this website into the application (fivor.app), the provisions of the remaining sections of this policy apply from that point on.

§ 7 Your rights as a data subject

Under the GDPR you have the following rights:

Right of access (Art. 15 GDPR): You may request information about the personal data we hold about you at any time.

Right to rectification (Art. 16 GDPR): You may request that inaccurate data be corrected. You can edit your profile data yourself in the app at any time.

Right to erasure (Art. 17 GDPR): You may request deletion of your data. You can delete your profile yourself in the app at any time — all personal data is then irreversibly removed.

Right to restriction of processing (Art. 18 GDPR): Under certain conditions you may request that processing be restricted.

Right to data portability (Art. 20 GDPR): You may request that we provide your data in a structured, commonly used and machine-readable format.

Right to object (Art. 21 GDPR): You may object to the processing of your data at any time where processing is based on legitimate interests.

Right to withdraw consent (Art. 7(3) GDPR): You may withdraw your consent to the processing of health data at any time. Withdrawal is effected by deleting your profile in the app settings. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, please contact:info@fivor.com

§ 8 Retention and deletion

We store your personal data only for as long as necessary to fulfil the purposes of processing or as required by statutory retention obligations.

During active use: Your data is stored for as long as you use your account.

On account deletion: All personal data is deleted immediately and irreversibly. Within groups, your name is pseudonymised ("Former member").

Technical logs: Deleted automatically after no more than 30 days.

Menus: We store the menus you have read, including their location, until you delete them or delete your account. We do not store photos of menus.

Feedback and support reports: Image attachments are deleted 12 months after the case is closed at the latest.

Statutory retention: Where statutory retention obligations apply (e.g. under tax law), the affected data is blocked for the duration of that obligation and deleted afterwards.

§ 9 Protection of minors

Fivor is intended for people aged 16 and over (Art. 8 GDPR). People under 16 may use the app only with the consent of a parent or guardian. We do not knowingly collect data from children under 16 without such consent.

§ 10 Data security

We employ extensive technical and organisational measures to protect your data:

  • Encrypted transmission of all data via HTTPS/TLS
  • Encrypted storage of passwords (bcrypt hash)
  • Server access control via SSH key authentication
  • Automatic SSL certificate renewal (Let's Encrypt)
  • Regular security updates of the server infrastructure
  • JWT-based authentication with time-limited tokens
  • Database access exclusively via the backend (no direct external access)

§ 11 Right to lodge a complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority.

Competent supervisory authority:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf, Germany
Web: www.ldi.nrw.de
Email: poststelle@ldi.nrw.de

§ 12 Changes to this privacy policy

We reserve the right to adapt this privacy policy as needed to reflect changes in the law, new features or changed processing. The current version is always available atfivor.com/de/datenschutz. We will inform you of material changes by email or in-app notification.

Fivor GmbH · Sommerfeld 13 · 45481 Mülheim an der Ruhr, Germany
Managing Director: Gotthard Tischner · HRB 40509, AG Duisburg
fivor.com ·info@fivor.com