Privacy notice — DRAFT

DRAFT — pending legal review

This notice describes how the current closed beta of r365 actually processes personal data. It was prepared in good faith but has not yet been reviewed by a lawyer. Open points are marked as open. The German version prevails.

1. Controller

James Cazzetta, Fiebertraum Studios (sole proprietorship), Oberstrasse 159, 9000 St. Gallen, Switzerland. Email: beta@regional365.com. No data protection advisor has been appointed; please send requests to this address.

2. What data we process and why

Visiting the website. When you open the site, our hosting provider Cloudflare processes technically necessary connection data (IP address, time, requested address, browser identifier) to deliver the page and protect it against abuse. Our application uses the IP address only in memory to limit the request rate and does not store it.

Sign-in. Sign-in is provided by WorkOS. WorkOS processes your email address, sign-in credentials and technical data about the sign-in. r365 itself stores only a pseudonymous identifier for your account, not your email address.

Account and consent. We store the pseudonymous account identifier, the declared region (Switzerland), the version of the consent text you agreed to, the time of consent, your two separate agreements (terms of use and health data) and the creation date. Anyone declaring another region is put on the waitlist with identifier and region; no account is created.

Household data. For planning you store information about your household and its members: household and first names (nicknames are enough), date of birth or age group, sex, optionally weight, weight goal and activity, food preferences, dislikes, meals, time budget and language. Added to this are the weekly plans, shopping lists, certificates, cooking logs and proposed profile changes computed from it.

Health data (sensitive, Art. 5 lit. c FADP). Where you record them: allergies and intolerances, conditions (for example coeliac disease or a kidney condition), medications, pregnancy, breastfeeding and menstrual-cycle information. These are used solely to choose meals and calculate nutrients. The date of the last period stays in your browser and is not sent to us.

Email to us. If you write to us (for example for the waitlist), we process your email address and message in order to reply.

We do not use the data for advertising, do not sell it and do not analyse it for other purposes. Planning is an automated calculation; it makes no decision with legal effect for you (Art. 21 FADP).

3. Legal basis and consent

We process health data only with your explicit consent (Art. 6(7)(a) FADP), which you give separately when opening your account. We keep a history of every consent and withdrawal: text version, language, a checksum of the text shown and the time; every text version is kept unchanged. You can withdraw consent at any time with effect for the future: in the app under Settings → Account → “Withdraw consent”, by deleting your account or by writing to us. Without consent we no longer process your household and health data and cannot compute plans; you can still export or delete it. We process account data to provide the service, and connection and security data in our overriding interest in secure operation (Art. 31(1) FADP).

Data of other household members. Whoever opens an account must be an adult and confirms that they record other people’s data only if those people have consented or if they are their legal representative (for example a parent with parental authority). Please inform the people concerned about this notice. Household members can also exercise their rights directly with us.

4. Recipients and processors

• Cloudflare, Inc., USA — runs the application (Cloudflare Containers), delivers the website, stores account and household data (Cloudflare R2) and operational logs. Cloudflare operates a global network; data may be processed in any country where Cloudflare operates. Storage exclusively in Switzerland is not promised.
• WorkOS, Inc., USA — sign-in and identity management. WorkOS receives no household or health data.
• The provider of an AI assistant you connect yourself (for example Anthropic PBC, USA, for Claude) — see section 6. This provider is not our processor; it processes the data under its own responsibility.

The processor agreements with Cloudflare and WorkOS will be reviewed and documented before the public launch. Beyond that we disclose data only where the law requires us to.

5. Disclosure abroad

The recipients above are in the USA (Art. 16 and Art. 19(4) FADP). For the USA, the Federal Council has found adequate protection only for companies certified under the Swiss-U.S. Data Privacy Framework. Cloudflare, Inc. appears on the official list of that framework for Switzerland. For WorkOS, Inc. we rely on contractual safeguards, namely the standard contractual clauses recognised by the FDPIC (Art. 16(2)(d) FADP); their conclusion will be confirmed before the public launch. Disclosure to the provider of your AI assistant happens at your instigation and with your explicit consent (Art. 17(1)(a) FADP).

6. Connected AI assistants (MCP)

When you connect an assistant such as Claude to r365, the assistant and its provider receive the results of the tools the assistant calls: household and health information, plans, nutrient gaps, certificates, cooking logs, proposals and, via the export tool, your complete account export. Your messages to the assistant are processed by its provider under its own privacy terms. The r365 planning engine itself does not call a language model. Disconnecting does not erase copies already held by the assistant provider.

7. Cookies and browser storage

We set only technically necessary cookies: __Host-r365_session keeps you signed in (at most eight hours, not readable by scripts), and __Host-r365_oauth briefly secures the sign-in. Your browser’s local storage holds a copy of your household and plan (so the app loads quickly), the date of the last period if recorded, your language choice and a non-reversible account fingerprint the app uses to remove a previous person’s data on the same device. Signing out and deleting your account remove the household and health data from the browser. We use no analytics, advertising or tracking tools and load no third-party scripts.

8. Retention and deletion

We keep account and household data until you delete your account or we end the beta; in the latter case we announce the deletion in advance. Deleting your account immediately removes the household store, its copy in Cloudflare R2 and the account and consent record, and ends the session. We delete your sign-in identity at WorkOS on request by email. Waitlist entries and emails are deleted once no longer needed. The retention periods for operational logs and any backups at Cloudflare and WorkOS are not yet final; we will set them before the public launch and state them here.

9. Data security

Transmission is encrypted (TLS); Cloudflare R2 stores data encrypted. Each account has its own data store. Automated tests ensure that names and health information do not appear in our server logs; these contain only technical events and the pseudonymous account identifier. The operator has technical access to stored data and uses it only for operation, troubleshooting or your requests. If a data security breach is likely to result in a high risk, we notify the FDPIC and, where necessary, you (Art. 24 FADP).

10. Your rights

You may request access (Art. 25 FADP), delivery or transfer of your data (Art. 28 FADP), correction, deletion and restriction, object to processing (Art. 32 FADP) and withdraw your consent. The quickest ways:

• Export: in the app under Settings → Account → “Export my data” (one JSON file), or via the export tool of a connected assistant.
• Correct: directly in the household settings.
• Delete: in the app under Settings → Account → “Delete account”.
• Anything else: email beta@regional365.com. We usually reply within 30 days and may ask for proof of identity.

You may complain to the Federal Data Protection and Information Commissioner (FDPIC)1.

11. People outside Switzerland

The beta is aimed at people resident in Switzerland. Should the EU General Data Protection Regulation (GDPR) nevertheless apply to you, we base the processing of health data on your explicit consent (Art. 9(2)(a) GDPR) and other data on the performance of the contract and our legitimate interest (Art. 6(1)(b) and (f) GDPR). You then additionally have the rights under Art. 15 to 21 GDPR and may complain to a supervisory authority.

12. Changes

We update this notice when the service or the law changes. If the consent text changes, we ask for your consent again before processing further health data.