Back to home

Privacy Policy

Last updated: July 14, 2026

1. Data controller

Olivi is the controller of the personal data collected through the olivi.ca platform and the associated mobile app. For any question about your personal data, contact us at [email protected].

2. Data we collect

We only collect the data needed to provide the service:

Account

  • Email address (required)
  • First and last name (optional)
  • Profile photo (optional)
  • Encrypted password (never stored in plain text)
  • If you enable two-factor authentication: encrypted TOTP secret and hashed backup codes

Culinary profile (voluntary)

  • Diets (vegetarian, gluten-free, etc.)
  • Allergies and foods to avoid
  • Culinary preferences (favourite cuisines, types of dishes)
  • Cooking skill level (beginner to advanced)
  • Available equipment (oven, BBQ, slow cooker, etc.)
  • Nutrition goals (optional) and target budget
  • Preferred grocery store among Quebec chains

User content

  • Recipes created, imported (URL, PDF, handwritten photo, dish photo) or marked as favourites
  • Weekly meal plans
  • Grocery lists and grocery history
  • Virtual pantry
  • Cooking history
  • Uploaded photos (recipes, dishes, handwritten cards)

Conversations with Olive (AI)

  • Messages sent to the cooking coach
  • Responses generated by Olive
  • Accepted/declined actions (recipes added, plans generated)

Personalization memory (Olive)

To serve you better, Olive may retain durable facts inferred from your conversations and your behaviour (favourites, ratings, cooked recipes): tastes, constraints (diet, allergy), equipment, context (e.g. number of people). They are used only to personalize your recipes, plans and answers. You can view, disable or delete them at any time in Profile › What Olive knows about me.

Technical data

  • IP address (for security, sign-in log)
  • Approximate location (city, region, country) derived from the IP address, for internal analytics : never precise coordinates, never shared
  • Browser and operating system type
  • Language preference
  • Mobile device identifier (for the session, not for tracking)

3. How we use your data

We use your data only to:

  • personalize Olive's suggestions based on your culinary profile;
  • generate your meal plans, grocery lists and lunchbox suggestions;
  • save your recipes and sync them between web and mobile;
  • manage your account and your subscription (once billing is active);
  • improve the service using aggregated and anonymized data (usage statistics, recipe popularity);
  • contact you when needed about security or service-continuity matters.

No marketing or advertising use. We do not sell, rent or share your data with advertisers.

4. Sharing with third parties

Your data is shared only with the infrastructure providers strictly necessary to run the service:

  • Supabase (Toronto, Canada) : database, authentication, photo storage. Hosted in Canada.
  • Anthropic (United States). Claude API for Olive. Anthropic commits to not using conversations to train its models.
  • Vercel (headquartered in the United States) : hosting of the web application and API routes, on infrastructure located in Montréal (Quebec, Canada).
  • Resend (United States) : transactional emails (sign-up confirmation, password reset).
  • Stripe (United States and Canada) : secure payments (once billing is active). PCI DSS Level 1 compliant.
  • Apple (TestFlight) : beta distribution of the mobile app. Apple only receives your Apple ID, not your Olivi data.
  • Google (United States). Google Tag Manager, used as a tag container to measure the website's audience (page views, journeys). Non-essential tags fire only with your consent, collected through the consent service built into the GTM container. No advertising pixel (Meta/Facebook, Google Ads) is integrated into the site.
  • Sentry (United States) : application error monitoring (website and mobile app): technical traces in the event of a crash, used to fix bugs. No data is used for advertising purposes.

No other resale, or sharing with data brokers or advertisers, takes place.

5. Data retention

  • Your data is actively retained for the duration of your subscription.
  • If you delete your account: personal data is erased within 30 days.
  • Transactional emails (Stripe invoices, archives) may be kept in accordance with applicable accounting obligations (up to 7 years for invoices).
  • Anonymized data (aggregated usage statistics) may be kept indefinitely.
  • Encrypted backups are deleted no later than 90 days after the main account is deleted.

6. Your rights

You have the right to:

  • access your data : available in your profile;
  • rectify inaccurate data : directly from your profile;
  • delete your account and all associated data : button in your profile;
  • export your data (recipes, plans, lists, photos) in JSON and ZIP format : button in your profile;
  • withdraw your consent at any time;
  • file a complaint with the Commission d'accès à l'information du Québec if you believe your rights are not being respected.

To exercise these rights: [email protected]. We respond within 30 days at most.

7. Cookies and local storage

  • Supabase session cookies : strictly necessary for authentication.
  • localStorage : interface preferences (language, onboarding state, collapsed sections).
  • AsyncStorage (mobile) : recipe and grocery-list cache for offline mode.
  • Audience measurement cookies (Google Tag Manager, Google Analytics 4 if enabled) : set only after you have given your consent through the site's cookie banner. You can withdraw your consent at any time from that same banner, or by clearing the domain's cookies in your browser.

No advertising cookies, no retargeting pixels (Meta/Facebook, Google Ads, TikTok, etc.). On mobile, the service uses Expo's EAS Insights for basic crash statistics : this data is anonymous and limited to the app's technical stability.

8. Security

We protect your data with:

  • HTTPS/TLS encryption for all communications;
  • encryption at rest on Supabase databases;
  • data hosting and storage in Canada (Supabase in Toronto, Vercel in Montréal) : your data stays in the country;
  • PostgreSQL RLS (Row Level Security) policies : each user can only access their own data;
  • optional two-factor authentication (TOTP);
  • no API secrets exposed client-side (Anthropic, Stripe keys, etc. kept server-side only);
  • logging of administrator actions for internal audit.

In the event of a data breach, we will inform you within 72 hours of detection, in accordance with Law 25.

9. Quebec's Law 25

Olivi complies with Quebec's Law 25 (the act modernizing legislative provisions as regards the protection of personal information):

  • designated person in charge of the protection of personal information: contact [email protected];
  • prior consent to any collection;
  • minimal collection (only what is necessary);
  • privacy impact assessments for sensitive new features;
  • immediate notification of privacy incidents.

10. GDPR (users in the European Economic Area)

If you are located in the EEA, you benefit from the additional rights provided by the GDPR:

  • data portability;
  • objection to processing;
  • complaint to your local supervisory authority;
  • information about international transfers (Canada and the United States for our providers).

Legal bases for processing: your consent (account creation) and the performance of the contract (provision of the service).

Health data (Art. 9 GDPR): your nutrition-related data (diets, allergies, health goals, physical activity and optional physical measurements) is only processed with your explicit consent, collected through a dedicated, timestamped checkbox when you set up your profile. You can withdraw it at any time by writing to us or by deleting your account; withdrawal ends the personalization based on this data.

Portability:you can download a complete copy of your data in JSON format at any time from your profile (“Export my data”).

11. Changes to this policy

We may update this privacy policy over time. Substantial changes will be communicated to you by email at least 30 days before they take effect. The most recent version is always available on this page, with the last-updated date at the top.

12. Contact

For any question, or any access, rectification or deletion request: [email protected]