Privacy notice BETA

How NutrientGraph handles personal data. We collect as little as we can: this site uses no cookies.

1. Who is responsible

The controller is ZAPPIT AI S.à r.l., 7 Avenue du Swing, L-4367 Belvaux, Luxembourg (RCS Luxembourg B295926, VAT LU36542984). Contact for data protection questions: support@nutrientgraph.com.

2. What we collect and why

• Account data: your email address and, if you give it, a name or company, to create your account, send the confirmation link and key notices, and contact you about the service (contract, GDPR Art. 6(1)(b)).
• API usage records: for each call, the key id, endpoint, time, units charged and whether it failed, to enforce plan limits, bill and support you (contract). We do not store request bodies.
• How you found us: with a signup we record the campaign tags of the link you arrived by (utm parameters), the referring website and the first page you visited, kept in your browser tab until then (no cookies), to learn which channels work (legitimate interest, Art. 6(1)(f)).
• Abuse protection: short-lived counters keyed by a one-way hash of your IP address and email address, and a Cloudflare Turnstile check on the signup and recovery forms, to stop automated signups (legitimate interest, Art. 6(1)(f)).
• Payments: when you upgrade, Stripe processes your payment details; we keep only the Stripe customer and subscription ids, invoices and VAT information (contract and legal obligation, Art. 6(1)(c)).
• Support emails you send us (contract or legitimate interest).

3. Service providers

We use processors under data processing agreements: Cloudflare (hosting, the API, bot protection and web analytics), Resend (sending confirmation and notice emails) and Stripe (payments; Stripe is also an independent controller for its own legal duties). Some of them process data in the United States; transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

4. How long we keep data

Proposed, pending review: account data for as long as the account exists, then deleted within 30 days of a deletion request or account closure; usage records for 24 months; abuse counters for at most 24 hours; invoices for the period Luxembourg law requires; error reports for 90 days.

5. No cookies, minimal analytics

This website sets no cookies and uses no advertising or cross-site tracking. We count page views with Cloudflare Web Analytics, which does not use cookies or local storage and does not build visitor profiles. The account page keeps your API key in your browser's session storage for the open tab only; closing the tab removes it.

6. Error reports from this website

If a page script fails, your browser sends us a short error report: the page path, the error message, the script location and the product name. We remove query strings and link fragments first, and we do not include anything you typed. We use these reports only to fix the site.

7. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to support@nutrientgraph.com. You may also complain to a supervisory authority; ours is the Commission nationale pour la protection des données (CNPD).

8. Changes

We will post changes on this page and, for account holders, announce material changes by email in advance.

Version for the NutrientGraph beta. NutrientGraph is a trade name of ZAPPIT AI S.à r.l.