Lyckeli privacy policy

1. Introduction

Lyckeli ("we," "our," or "the Platform") is committed to protecting your privacy. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our meal planning services. By using Lyckeli, you consent to the practices described in this policy.

2. Information we collect

2.1 Personal data

We collect personal information you provide directly, such as:

• Account information: Name, email address, and password.
• Dietary preferences: Health conditions, allergies, and food preferences (to personalize your meal plans).
• User-generated content: Recipes, ratings, comments, and interactions with the Platform. Ratings contribute anonymously to aggregate signals (e.g. average rating, popularity) visible to other users, but are never linked to your public profile. Comments are private unless you explicitly publish them.

2.2 Usage data

We automatically collect information about your use of Lyckeli, including:

• Interaction data: Recipes you view, save, or rate.
• Technical data: IP address, device type, browser, and operating system.
• Aggregated insights: Anonymized or aggregated statistics derived from how Lyckeli is used may inform product decisions and our own advertising (see Section 4.2).
• Cookies and tracking: Session cookies for functionality, analytics cookies to improve our services, and, on surfaces where we use them, cookies that support delivery and measurement of our own advertising (see Section 6).

2.3 Payment information

If you subscribe to premium features, we may collect payment details through Apple Pay (via the App Store). We do not store your payment information.

3. How we use your information

We use your data for the following purposes:

• To provide Lyckeli and keep improving it, we process the data needed to run the service and develop features—this is necessary to perform our contract with you.
• To personalize meal plans, we use your preferences and related information you choose to share; that is also necessary to deliver the service you asked us to provide.
• To understand usage trends and refine the product, we analyze how Lyckeli is used. We do this based on our legitimate interests, including through analytics. Where we use cookies or similar technologies for measurement on a given surface, we describe consent and choices in Section 6 and our Cookie policy.
• We send marketing communications only where you have given consent. We may contact you about your account or the service when needed to run Lyckeli—for example, where that follows from our agreement with you or applicable rules.
• To help keep Lyckeli secure and protect users, we process data as needed for security and abuse prevention, which we do based on our legitimate interests.

Examples:

• Your dietary preferences help us generate safe, personalized recipes.
• Usage data helps us improve our algorithms and recommend popular recipes.
• Your ratings are aggregated anonymously to produce a recipe's average rating and popularity signals shown to other users; they are never linked to your public profile.

4. How we share your information

4.1 Service providers

We share data with trusted third parties who help us operate Lyckeli, such as:

• AWS for hosting and cloud infrastructure.
• Google Gemini for AI-powered recipe generation.
• Analytics tools (e.g., Google Analytics) to understand user behavior.

All service providers are bound by confidentiality agreements and GDPR compliance.

4.2 Aggregated/anonymized data

We may share non-identifiable, aggregated data for research or statistical purposes (e.g., "30% of users prefer gluten-free recipes"). We may also use such data, or share it with advertising and measurement partners only in anonymized or aggregated form, to help us reach relevant audiences with our own promotional campaigns. This is not a sale of personal data, and we do not share information that identifies you individually.

4.3 Legal compliance

We may disclose your information if required by law (e.g., court orders) or to protect our rights and safety.

4.4 No sale of personal data

We do not sell your personal information to third parties.

5. Data storage and security

• Storage location: Your data is stored on secure servers within the European Union.
• Retention period: We retain your data until you delete your account, unless legal obligations require longer storage.
• Security measures: We use encryption, access controls, and regular audits to protect your data.

6. Cookies and tracking technologies

Lyckeli uses cookies and similar technologies to enhance your experience, analyze usage, and—where applicable—support delivery and measurement of our own advertising. This section is aligned with our Cookie policy, which describes consent, your choices, and what we store on each surface (marketing site vs. app) in more detail.

Categories include:

• Essential cookies: Required for core functionality (e.g., logging in, saving preferences). These cannot be disabled without affecting the Platform's performance.
• Analytics cookies: Help us understand how users interact with Lyckeli (e.g., Google Analytics). You can opt out of these via your browser settings, industry tools where available (e.g., Google Analytics Opt-out Browser Add-on), or other controls offered by your browser or device.
• Advertising cookies: Where used (for example on our marketing site), these help deliver and measure our own promotional campaigns for Lyckeli. They are not used to sell your personal data. Where consent is required, we obtain it before enabling non-essential cookies; see the Cookie policy for how choices are stored and updated.

How to manage cookies:

• You can use browser or device settings and other available tools to block, delete, or limit cookies; your browser's help center (e.g., Chrome, Safari, Firefox) has instructions.
• Disabling cookies may limit some features of Lyckeli.

7. Your privacy rights (GDPR)

Where GDPR applies, you have the usual rights over personal data we hold about you. This section is a brief summary; for full explanations, see the European Commission’s data protection pages. If a request cannot be fully met, we will say why.

• Access — You have the right to ask what we process and for a copy of your personal data where applicable.
• Rectification — You have the right to ask us to correct inaccurate or incomplete data.
• Erasure — You have the right to ask us to delete your data where the law allows; to delete your Lyckeli account, email team@lycke.li.
• Restriction — You have the right to ask us to limit certain processing in the situations GDPR provides for.
• Portability — Where the law requires it, you have the right to ask for the data you gave us in a structured, machine-readable form.
• Objection — You have the right to object to some processing, including direct marketing; we stop using your data for marketing if you object.

To exercise any right, contact team@lycke.li. We may verify your identity first.

8. Children’s privacy

Lyckeli is not directed at children under 16. We do not ask for or store date of birth as part of routine sign-up, so we cannot tell a user’s age from the information we typically hold.

If you are a parent or guardian, you are responsible for deciding whether Lyckeli is appropriate for someone in your care and for any account created or used on their device. If you believe a minor has used Lyckeli without suitable consent or you want an account or related data removed, contact us at team@lycke.li and we will help.

9. Data breaches

In the event of a data breach, we will notify affected users and relevant authorities within 72 hours, as required by GDPR.

10. Updates to this policy

We may update this privacy policy periodically. We will notify you of significant changes via email or in-app notice. Continued use of Lyckeli constitutes acceptance of the revised policy.

11. Contact us

For questions or requests regarding your privacy, contact:

Email: team@lycke.li

12. Supervisory authority

If you are in the EU and believe we have violated your privacy rights, you may lodge a complaint with your local data protection authority.