Privacy policy

Who is responsible

Responsible for your data at Wundernom is [operator's name], [address], email: [email address].

[Contact of the data protection officer, if one is appointed]

When you visit the website

When you open a page, the host stores technical details: IP address, time, the page and the browser. They keep the website running securely and are deleted after [server log retention]. The legal basis is Art. 6(1)(f) GDPR.

The public pages set no cookies and load no analytics tool.

Account and sign-in

An account needs your email address. To sign in, you get a link by email. After that, a cookie keeps you signed in. Sign-in needs it, so it needs no consent (§ 25(2) no. 2 TDDDG). The legal basis is Art. 6(1)(b) GDPR.

The app remembers your language, colour scheme and your consent to health details in your browser's storage, on your device.

Signing in with Google

[Only if active] If you sign in with Google, Wundernom gets your name, email address, profile picture and Google ID from Google. The legal basis is Art. 6(1)(b) GDPR. Google Ireland Limited is itself responsible for the sign-in at Google [confirm].

Invitations

Anyone in a household can invite other adults by entering their email address. Wundernom sends the invitation through Resend. The email holds only the invitation link, which expires after 7 days. The legal basis is Art. 6(1)(f) GDPR: the household's interest in planning together.

Your household details

To plan your week, Wundernom stores what you enter: who eats with you, the children's ages, what someone never eats, your shops, your weekly plans and shopping lists.

For the person who holds the account, the legal basis is Art. 6(1)(b) GDPR. For everyone else in the household, children included, it is Art. 6(1)(f) GDPR: your household's interest in planning for everyone at the table.

Allergies and intolerances

Allergies and intolerances are health data (Art. 9 GDPR). Wundernom stores them only with your explicit consent, which it asks for the first time you enter one. As parents, you consent for your children. Enter another adult's allergies only with their agreement. The legal basis is Art. 9(2)(a) and Art. 6(1)(a) GDPR.

You can withdraw your consent at any time: delete the details or write to [email address]. What was handled before that stays lawful.

Feedback and ratings

When you say how a meal went, Wundernom stores your rating, whether it was cooked and eaten, and your notes on it. This makes the recipes better for every family, for example more accurate amounts, and your feedback counts for the test kitchen. Other families never see your ratings.

The legal basis is Art. 6(1)(f) GDPR: the interest in improving the recipes. For the test kitchen it is Art. 6(1)(b) GDPR.

How the AI plans

Wundernom drafts weekly plans with an AI language model from Anthropic. Only details about the food go to the model: how many people eat, the children's age groups, allergens, what should not be served, ingredients and amounts. Wundernom sends no names or email addresses with them.

The plan is a suggestion and counts only once you approve it. There is no automated decision under Art. 22 GDPR.

Service providers

These providers handle data on behalf of Wundernom. There is a data processing agreement under Art. 28 GDPR with each of them [confirm].

• Vercel [contracting entity and seat]: hosting for the website and the app. The app runs in Frankfurt am Main. Transfer to the US based on [standard contractual clauses or EU-US Data Privacy Framework]; a copy on request to [email address].
• Neon [contracting entity and seat]: the database for accounts and household details, server location [region]. Neon uses subprocessors in the US [confirm the list]. Transfer to the US based on [standard contractual clauses or EU-US Data Privacy Framework]; a copy on request to [email address].
• Resend [contracting entity and seat]: sign-in and invitation emails; stored in the US for 30 days. Transfer to the US based on [standard contractual clauses or EU-US Data Privacy Framework]; a copy on request to [email address].
• Anthropic [contracting entity and seat]: the AI language model for the weekly plans, with the food details above; processed in the US. Transfer to the US based on standard contractual clauses (Art. 46(2)(c) GDPR) [confirm]; a copy on request to [email address].

How long data stays

• A sign-in link is valid for [period].
• The sign-in cookie expires once you have not used the app for 7 days.
• Resend deletes its logs of sent emails after 30 days.
• Your account and household details stay until you delete the account or ask for deletion. After that, Wundernom deletes them within [period].

Legal retention duties are not affected.

Your rights

You have the right to access (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and data portability (Art. 20). Write to [email address].

You can complain to a data protection authority, for example [competent authority].

Right to object

Where Wundernom handles data under Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). This covers the server logs, the details about others in the household, invitations and feedback. Write to [email address]. Wundernom then stops handling that data, unless compelling legitimate grounds override your objection.

What you have to enter

Without an email address there is no account. Everything else is optional. Without it, the plan fits you less well.