This is a draft prepared to match AIP Guru's current features and vendors. It is not legal advice — have it reviewed by a lawyer familiar with GDPR before AIP Guru launches or takes payment. Bracketed items need to be filled in, and the health-data section in particular should get careful legal review, since diary/reaction data can qualify as special category ("health") data under GDPR Article 9.
We do not sell your data, and we do not use it for third-party advertising. This policy explains what we collect, why, and how long we keep it.
1. Who we are
AIP Guru helps people follow the Autoimmune Protocol (AIP) through diary logging, meal planning, a recipe library, and AI-assisted tools. AIP Guru is operated by Sweit ("we", "us") Sweit, Konvaljevägen 14, 13736 Vasterhaninge, Sweden, and is subject to the General Data Protection Regulation (GDPR).
2. What data we collect
We collect the data needed to provide the service:
- Account data — name, email address, and password (stored as a one-way hash, never readable).
- Billing data — handled by Stripe (website purchases) or by Apple/Google via RevenueCat (in-app purchases); we don't see or store your card number.
- Diary & tracking data — meals logged, symptoms/reactions recorded, reintroduction progress, meal plans, and shopping lists. See Section 3.
- Photos you submit — for the label scanner and recipe-photo-import features, and any recipe photos you choose to add. See Section 4.
- Usage data — feature usage (for example scans or imports used against your plan's limit), app version, and device type, used for plan enforcement and troubleshooting.
- Device/IP data — logged for security, abuse prevention, and to comply with legal obligations, retained for up to 12 months.
- Support communications — anything you send us via the support page or by email.
3. Health-related data
The diary entries and food-reaction tracker you use in AIP Guru can include information about your symptoms and reactions to food, which may qualify as health data — a "special category" of personal data under GDPR Article 9 that gets extra protection. We only process this data because you actively choose to enter it into the app in order to use the diary and reaction-tracing features, and we treat your explicit consent (given when you start using these features) as the legal basis for that processing. You can delete individual diary entries or your whole account at any time, which removes this data; see
Section 8.
4. AI features (label scanner & recipe import)
When you use the ingredient label scanner or the recipe-photo-import feature, the photo (and any text extracted from it) is sent to our AI provider, Google (Gemini models), for processing, and the result is returned to the app. We do not send your account identity, diary entries, or other unrelated data to the AI provider as part of this request — only the content of the photo you submit for that feature.
These images must not contain any personal data.
5. Legal basis for processing
We process your data on the following legal bases:
- Contract — to provide the account, Membership, and core app features you've signed up for.
- Consent — for health-related diary/reaction data (see Section 3), and for any marketing communications.
- Legitimate interest — for security, fraud/abuse prevention, and improving the service.
- Legal obligation — where we need to retain or disclose data to comply with the law.
6. How we use your data
- To authenticate you and manage your account and Membership
- To provide the diary, meal planning, recipe library, food checker, label scanner, and reintroduction assistant features
- To enforce plan limits (for example, free-tier scan/import limits)
- To process payments (website via Stripe; in-app via Apple/Google and RevenueCat)
- To send transactional emails (account verification, billing receipts, and service notices)
- To communicate about AIP Guru's own products and updates, where you haven't opted out
We do not build advertising profiles, sell your data, or use it for purposes unrelated to operating and communicating about AIP Guru.
7. Who we share data with
We don't sell or share your personal data with third parties for commercial purposes. We use a limited number of service providers to operate AIP Guru:
- Google (Gemini) — processes photos/text for the label scanner and recipe-import features. See Google's privacy policy.
- Stripe — payment processing for website purchases. See stripe.com/privacy.
- RevenueCat, Apple, and Google — manage and process in-app subscription purchases.
- We reserve the right to change providers and use other providers at any time.
We may disclose data if required by Swedish or EU law, or to protect the rights and safety of our users.
8. Data retention
We keep your account and diary data for as long as your account is active. If you delete your account, your diary entries, photos, and other associated personal data are permanently removed within 3 months, except where we're required to keep certain records (for example billing records) for longer to comply with the law. Device/IP logs are retained as described in Section 2.
9. Cookies and local storage
The website uses cookies/local storage to keep you logged in and to remember basic preferences. The app uses local device storage for authentication tokens and offline functionality.
10. Analytics
The website uses Google Analytics to track usage.
11. Your rights
Under GDPR, you have the right to:
- Access — request a copy of the data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Portability — request your data in a machine-readable format
- Objection — object to certain uses of your data
- Withdraw consent — where processing is based on consent (including for health data), withdraw it at any time
You can delete your account directly from the app's Profile/Settings, which removes associated personal data as described in Section 8. To exercise any other right, contact us at the address below.
You also have the right to lodge a complaint with the Swedish supervisory authority: Integritetsskyddsmyndigheten (IMY), or with your local supervisory authority if you live elsewhere in the EU/EEA.
12. Security
- All connections are encrypted via HTTPS
- Passwords are stored hashed, never in plain text
- Access to accounts requires authentication
No system is perfectly secure. If you discover a security vulnerability, please contact us right away.
13. International transfers
Some of our service providers (for example Google, Stripe) may process data outside the EU/EEA. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent adequacy mechanism.
14. Children
AIP Guru is not directed at children. You must be at least 18 years old or have approval from their legal guardian to create an account. The guardian must take full responsibility for their minors using the app.
For questions about this policy or to exercise your rights, contact us via our support page, or at hello@aipguru.com.
We aim to respond to privacy requests within 30 days.