Privacy Policy

1. Introduction

This Privacy Policy describes how Matinn ("we", "us") collects, uses, and protects your personal data when you use our website, apps, and services (the "Service"). We process personal data responsibly and in accordance with the EU General Data Protection Regulation (GDPR) and the Icelandic Data Protection Act no. 90/2018.

The data controller is Mánahöll ehf., reg. no. 510523-1050, Iceland.

• Email: samband@matinn.is

2. What data we collect

2.1 Data you provide

• Account data: Name, email address, and profile picture — from your Google account if you sign in with Google, or the email address you sign in with.
• Profile and preference data: Dietary preferences, household size, language, and other settings used to personalize meal plans and suggestions.
• Food allergies: If you record allergies, they are "special category data" (health data) under Article 9 GDPR. We process them only with your explicit consent, given when you enter them in your profile. They are stored to keep unsafe ingredients out of your suggestions, and they are automatically included in every AI request made on your behalf — an AI assistant cannot remove a stored allergy.
• Content: Recipes, photos, posts, comments, ratings, notes, meal plans, shopping lists, and pantry items you create. Content you make public (recipes, posts, your profile) is visible to anyone, including search engines.
• Communication: Messages you send us, and feedback you submit in the product.

2.2 Data collected automatically

• Technical and usage data: IP address, browser type, pages visited, and error reports. We use privacy-friendly, cookieless analytics (Vercel Analytics) and error monitoring (Sentry) to keep the Service working and improve it.

2.3 Payment data

We never store your card details. All payments are processed by our merchant of record, Paddle, which handles payment data under its own privacy policy. We store only your subscription status and purchase history.

3. How we use data, and on what legal basis

• Providing the Service (account, profile, content, household features): performance of our contract with you.
• Allergy-aware personalization: your consent, given when you record allergies in your profile. You can delete them at any time.
• AI features: recipe text, images you submit for import, and relevant preferences are sent to our AI providers (Google and Anthropic) to generate suggestions, import recipes, estimate nutrition, and create images. We use API tiers where inputs are not used to train the providers' models.
• Matinn Connect: if you connect an external AI assistant through our OAuth-based API, that assistant receives only the data covered by the scopes you approve. You can revoke access at any time in settings.
• Security, debugging, and analytics: our legitimate interest in keeping the Service safe and reliable.
• Emails: transactional emails (sign-in links, receipts, household invites) are necessary for the Service; the newsletter is sent only with your consent and every message has an unsubscribe link.
• Legal obligations: accounting records we are required to keep.

4. Who we share data with

We never sell or rent your personal data. We share it only with service providers (processors) that help us run the Service:

• Vercel — hosting and cookieless analytics
• Neon — database hosting
• Amazon Web Services — image storage (S3), email delivery (SES), and encrypted backups
• Paddle — payment processing (merchant of record)
• Google and Anthropic — AI processing as described above
• Sentry — error monitoring
• Upstash — rate limiting
• Inngest — background job processing

Some providers process data outside the EEA. Where they do, transfers rely on recognized safeguards such as the EU Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework).

5. How long we keep data

• Account, profile, and content data: for as long as your account is active. When you delete your account, your personal data is deleted.
• Backups: encrypted backups are retained for up to 30 days, after which deleted data disappears from them too.
• Accounting records: 7 years, as required by Icelandic accounting law.
• Analytics: aggregated and not tied to your identity.

6. Your rights

You have the right to access, rectify, erase, and receive a copy of your personal data, to restrict or object to processing, and to withdraw consent at any time (without affecting processing already carried out). To exercise your rights, email samband@matinn.is.

If you believe our processing violates data-protection law, you can lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd, www.personuvernd.is) or your local supervisory authority.

7. Security

We protect your data with recognized technical and organizational measures: encryption in transit and at rest, row-level access controls in our database, hashed API tokens, and strict access limits.

8. Children

The Service is not intended for children under 16, and we do not knowingly collect their data.

9. Cookies

See our Cookie Policy for details on the cookies we use.

10. Changes to this policy

We may update this policy from time to time. Changes are published on this page, and we announce material changes separately.

11. Contact

Questions or concerns about this policy:

• Email: samband@matinn.is
• Controller: Mánahöll ehf., reg. no. 510523-1050, Iceland