Last updated: October 6, 2026
Convivi ("Convivi", "we") respects your privacy. This policy explains what data we collect, why we process it, who we share it with and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR).
The data controller is Andrea Vigani, Piazzetta Ado Furlan 4, 33170 Pordenone (PN), Italy. For any request regarding your data write to privacy@convivi.app.
Account data: email, password (encrypted), registration date. If you sign in with Google, Google gives us your email address, name and profile picture.
Family profile data: names, age or date of birth, sex, weight and height (optional), activity level, goals, allergies, intolerances, disliked foods and culinary preferences of family members, entered during onboarding or in the settings.
Usage data: generated weekly plans, saved and created recipes, saved or purchased collections, shopping lists, recipe feedback, plan preferences and daily usage counters for AI features (for abuse prevention and service sustainability).
Subscription and payment data (only if you subscribe or buy): plan, subscription status and dates, purchased collections, amounts paid, refunds and identifiers assigned by Stripe. Card details are collected directly by Stripe: Convivi never receives them.
Content you provide to Chef AI: request text, voice note transcriptions, links you paste (e.g. YouTube, recipe websites) and recipe photos you upload for extraction.
Referral data: if you arrive from a creator's page on Convivi, we record which creator you came from (not your browsing on other sites).
Contacts from the free tools (e.g. shopping list, balanced plate): the email you leave to receive the result, what you entered in the tool (for example how many people, the chosen diet) and, only if you tick the box, your consent to receive our emails.
Records of consent: date and version of the Terms of service accepted at sign-up, date of your consent to the processing of allergies and intolerances, exact wording and date of your consent to marketing emails.
Push notification data (only if you enable them): the browser subscription token required to deliver notifications.
Analytics data (only with your consent): app usage events collected via PostHog, such as which features you use and how often.
Technical data: IP address, browser, operating system and logs essential to the operation and security of the service.
Providing the service: generating meal plans, personalized recipes and shopping lists tailored to your family, and giving you access to the collections you save or buy (performance of the contract, art. 6.1.b GDPR).
Managing subscriptions, purchases, payments, refunds and withdrawals (performance of the contract, art. 6.1.b GDPR) and meeting tax and accounting obligations (legal obligation, art. 6.1.c).
Sending you service emails, such as a purchase confirmation, your plan being ready or shopping reminders (performance of the contract, art. 6.1.b). Recurring ones can be switched off in Settings.
Sending you the result you asked for from a free tool, for example the shopping list by email (performance of your request, art. 6.1.b).
Sending you recipes, ideas and news by email only if you ticked the dedicated box (consent, art. 6.1.a — revocable at any time from the link in every email).
If you signed up from a creator's link, calculating the share they are owed on what you pay, without disclosing your identity to them (legitimate interest, art. 6.1.f).
Managing the account, securing the service and preventing abuse, including daily usage limits on AI features (legal obligation and legitimate interest, art. 6.1.c and 6.1.f).
Improving the quality and safety of Chef AI's answers by reviewing requests, for the period stated under “Retention” (legitimate interest, art. 6.1.f; for any allergy or intolerance data they contain, the explicit consent described below).
Sending you push notifications, such as reminders or suggestions, only if you enabled them (consent, art. 6.1.a — revocable at any time).
Analyzing app usage in pseudonymized form to improve the product, only if you accepted the consent banner (consent, art. 6.1.a).
Data about allergies and intolerances is a special category of data (art. 9 GDPR): we process it solely to filter recipes, flag unsuitable ones and generate safe plans for your family, based on your explicit consent, which we ask for with a dedicated box when you enter it. You can withdraw it at any time by removing allergies and intolerances from your profile in Settings, or by writing to privacy@convivi.app: from then on recipes will no longer be filtered on them.
When you use Chef AI, the text of your request (and any voice transcriptions, content extracted from links or photos) is sent to the AI model provider — Google (Gemini) and, as a fallback when it is unavailable, Groq — for the sole purpose of generating the response. If the "Use my data" toggle is on, we also include your profile constraints (allergies, diet, preferences) to make the recipe compatible; if it is off, your profile is not shared. These providers process the data on our behalf and do not use it to train their models.
Voice notes are transcribed preferably by your browser on your device (Web Speech API); only if your browser does not support it is the audio sent to Groq's transcription service. Convivi does not store audio recordings.
Uploaded recipe photos are used only to extract the recipe content. Links you paste are read to extract the recipe from publicly accessible content.
The weekly plan generator is a deterministic algorithm that does not use generative AI and operates only on your profile data. Convivi does not make decisions based solely on automated processing that produce legal effects on you (art. 22 GDPR).
Data is retained for as long as the account is active. Daily usage counters are short-lived technical data.
The text of Chef AI requests stays linked to your account for 90 days. It is then anonymised automatically — we remove the link to your account, the exact time, email addresses and phone numbers — and from then on we only use it anonymously to improve Chef AI.
An email left in a free tool is kept until you ask us to delete it; marketing consent lasts until you unsubscribe.
Records of consent (Terms, health data, marketing) are kept while the account or contact exists, and for as long as needed to prove them in case of a dispute.
Payment, purchase and subscription data is kept for 10 years, as required by tax and accounting law, including after the account is deleted; in that case it is no longer linked to your profile.
You can export your data in a readable format or permanently delete your account on your own from the Settings page: deletion removes your profile, family members, plans, created recipes, saved collections, shopping lists and uploaded images. You can also write to privacy@convivi.app.
Supabase — database, authentication and image storage (servers in the European Union).
Google — Gemini AI models used by Chef AI (generation, classification, extraction from links and photos), processed on our behalf. If you choose to sign in with Google, Google acts as an independent controller for authentication: its policy is at policies.google.com/privacy.
Groq — fallback AI models for Chef AI and voice transcription when your browser does not support it. Data sent is processed on our behalf for the sole purpose of generating the response.
Resend — sending emails (confirmations, service emails, results from the free tools) and, only for those who consented, marketing emails.
PostHog — product analytics on servers in the European Union. Browsing analytics are active only after your consent; the actions a signed-in user takes in the app are measured server-side even without consent (see “Cookies and analytics”).
Vercel — application hosting and delivery.
Stripe — payments, subscription and purchase management and fraud prevention. For some purposes, such as fraud prevention and legal obligations, Stripe processes data as an independent controller: its policy is at stripe.com/privacy.
Your browser's push services (e.g. Google, Apple, Mozilla) — only if you enable notifications.
Except as stated for Stripe and for signing in with Google, these providers process data on our behalf as data processors under art. 28 GDPR. Where a provider is located outside the EU, the transfer is covered by appropriate safeguards under art. 44-49 GDPR (EU-US adequacy decision or standard contractual clauses). No data is sold to third parties.
We use essential technical cookies (session, authentication), which do not require consent.
Browser-side analytics (PostHog) are activated only if you accept the consent banner shown on your first visit. If you decline, no analytics data leaves your browser and only the server-side measurement described below remains active. You can withdraw consent at any time by writing to us or clearing your browser data, which will show the banner again.
Server-side measurement: regardless of the banner, we record the actions you take in the app after sign-in — for example signup and trial, plans generated or built, recipes opened, saved and rated, shopping items checked, use of Chef AI, Discover and the Studio, days on which you open the app — linked only to your internal account identifier. We never record free text or health data: allergies, intolerances and dietary filters stay out. This measurement uses no cookies, reads no device identifiers and never follows you outside Convivi: it exists to tell us whether the product works, and relies on our legitimate interest (Art. 6.1.f GDPR). The banner still governs everything else — browsing behaviour, session recordings, Web Vitals and errors.
Analytics requests pass through our own domain before reaching PostHog. This is a technical measure to avoid losing data to ad blockers: it changes neither what we collect nor who processes it.
We do not use advertising profiling cookies or third-party marketing cookies.
Push notifications are optional and require your explicit consent through the browser. We use them for service-related reminders and suggestions, with limited frequency. You can disable them at any time from your browser or device settings.
The service is reserved for people aged 16 or over. Children's data in the family profile (name, age, allergies, preferences) is entered by the parent or guardian who owns the account, who is responsible for its accuracy, and is processed solely to personalize plans and recipes for the family.
If you participate in the Creator Program, your public profile data (name, picture, bio, social media links) and the recipes you publish are shown publicly, with attribution. To calculate and pay your earnings we process the amounts accrued and the payment details you give us. Further details are defined in the program agreement.
Convivi may publish a page with the name, picture and public links of a recipe author who does not (yet) have an account, to credit them for recipes imported from their public content (legitimate interest, art. 6.1.f). If you are that author and want it corrected or removed, write to privacy@convivi.app: we will take it down or fix it.
You have the right to access, rectify, delete, restrict or object to the processing of your data, to withdraw any consent you have given, and to request data portability (art. 15-22 GDPR). Export and deletion are available self-service from the Settings page; consent to health data is withdrawn by removing allergies and intolerances from your profile; marketing is withdrawn from the link in every email; for everything else write to privacy@convivi.app.
You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or your local supervisory authority.
We may update this policy to reflect new features or legal requirements. In case of substantial changes we will inform you by email or with an in-app notice. The last update date is shown at the top.