Privacy Policy for Madklar

This privacy policy describes how Nornilo ApS processes personal data when you use Madklar, join the waitlist, or contact us.

1. Controller

Nornilo ApS is the controller for the processing of your personal data in Madklar.

Nornilo ApS
CVR: 46359347
Badensgade 40, 1
2300 Copenhagen S
Denmark

Contact: [email protected]

2. What information we process

We process the information needed to provide and operate Madklar.

This may include:

contact information, such as name and email address
account information, such as login, account ID, language, and region
household information, such as household members, roles, and invitations
meal-planning information, such as attendance, preferences, restrictions, pantry, meal plans, recipes, shopping lists, and feedback
subscription information, such as product, status, quotas, and information from App Store receipts
technical information, such as device type, app version, timestamps, errors, log metadata, IP address, and security information
analytics information, such as use of core features, quotas, performance, and aggregated product measurements
communication with us, such as waitlist, support, or feedback

Madklar is not intended to process medical diagnoses. If you choose to enter food restrictions or preferences that may reveal health, religion, or other sensitive matters, we process them only to plan meals for you and your household. Where necessary, we ask for separate consent in the app.

3. Where information comes from

Most information comes directly from you or other members of your household.

We may also receive information from:

Apple, when you use Sign in with Apple, App Store subscriptions, or Apple Family Sharing
other login providers, if offered in the app
people who invite you to a household or mention you in household planning
technical systems that record operations, security, quotas, and errors

If someone else in your household enters information about you, they should only do so where it is relevant to household meal planning.

4. Why we process information

We process personal data for these purposes:

to create and manage your account
to store and sync the household profile, plans, pantry, recipes, and shopping lists
to generate meal plans, recipes, shopping lists, translations, and other suggestions
to administer households, invitations, and ownership
to handle subscriptions, access, quotas, and payment through the App Store
to respond to support, feedback, and waitlist enquiries
to improve stability, security, quality, and product experience
to detect misuse, errors, and unauthorized access
to comply with legal requirements and document necessary transactions

5. Legal basis

Our processing is typically based on:

Contract, where processing is necessary to provide Madklar to you.
Consent, for example for the waitlist, marketing, or certain voluntarily entered information where consent is required.
Legitimate interests, for example operational reliability, debugging, product improvement, misuse prevention, and basic analytics.
Legal obligation, for example accounting, consumer-law requirements, or documentation we are required to keep.

You can withdraw consent. This does not affect processing that already took place while the consent was valid.

6. AI and model providers

Madklar uses AI to generate or process suggestions, such as meal plans, recipes, shopping lists, translations, categories, and images.

When you ask Madklar to use an AI feature, relevant parts of the household context may be sent to a model provider through Nornilo’s AI router. We try to send what is necessary for the task and avoid logging prompt or response text in the router’s normal operational logs.

AI requests are not used to train model providers’ models. Some model providers may, however, retain requests for a limited period for abuse prevention or safety unless we have a separate zero-retention agreement with them.

Model providers may include Cloudflare Workers AI, OpenAI, Anthropic, or other providers if they later become part of Madklar’s production setup.

7. Human access to household content

Nornilo does not routinely review your household content, such as meal plans, recipes, pantry, feedback, preferences, restrictions, or AI requests.

Authorized people at Nornilo only access household content when:

you ask us to investigate a specific issue and consent to us seeing relevant information
you give separate consent for us to use selected household content to improve planning quality, recipe quality, or app behavior
access is necessary for security, abuse prevention, debugging, legal obligations, or protecting the service

Consent for support or quality review is voluntary and can be withdrawn. If you do not give consent, we can still try to help using ordinary logs and metadata, but we may not be able to investigate a household-specific issue as precisely.

When we ask for consent, we describe what information we want access to, why, who can see it, and how long access or any copy is kept.

We do not sell your personal data.

We share information where necessary to provide or operate Madklar. This may include:

hosting and infrastructure providers
login and identity providers
App Store and payment-related services
AI and model providers
email and support providers
analytics and security systems
other members of your household, where the information belongs to the household’s shared planning

Suppliers process information under our instructions where they act as processors. Some suppliers are independent controllers for parts of the processing, for example Apple for App Store payment and certain login or device-related functions.

If information is transferred to countries outside the EU/EEA, we use relevant transfer mechanisms, such as the European Commission’s standard contractual clauses, where necessary.

9. Analytics and product improvement

We use analytics information to understand whether Madklar works, how often core features are used, where errors occur, and how the product can be improved.

Analytics is handled, where possible, with pseudonymous, aggregated, or metadata-based information. Raw analytics events are generally retained for up to 365 days, after which they may be deleted or only included in aggregated measurements.

We do not use analytics to sell information about you to third parties.

10. Cookies and local preferences

The public website uses a small language-preference cookie named madklar_lang. It remembers whether you selected English or Danish, so the root page can send you to the right language next time.

This cookie is not used for advertising, profiling, or cross-site tracking.

The app may also store local settings on your device where necessary for ordinary app functionality.

11. Retention

We keep information for as long as needed for the relevant purpose.

As a general rule:

waitlist and contact information is kept until you ask us to delete it, or it is no longer needed
account and household information is kept while the account or household is active
meal plans, recipes, pantry, feedback, and history are kept until you delete them, the account is deleted, or they are no longer needed for the service
subscription and transaction information is kept as long as needed for access, documentation, accounting, and potential claims
technical logs are kept for a limited period unless needed for security, debugging, or documentation
raw analytics events are generally kept for up to 365 days

When an account is deleted, there may be a short recovery period before final deletion is completed. Some information may be kept longer if we are required to keep it by law, or if it is necessary to establish, exercise, or defend legal claims.

12. Your rights

Under data protection law, you have the right to:

access the information we process about you
correct inaccurate information
erase information in certain cases
restrict processing in certain cases
data portability in certain cases
object to processing based on legitimate interests
withdraw consent where processing is based on consent

We may ask for information needed to confirm your identity before disclosing or changing information.

13. Complaint

You can complain to the Danish Data Protection Agency if you believe we process your personal data contrary to the rules.

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
datatilsynet.dk

14. Children

Madklar is intended for adults who plan food for themselves or their household. An adult should create and manage the household account.

If information about children is entered in a household, it should only be information needed for meal planning, such as name or nickname, attendance, and relevant food preferences or restrictions.

15. Security

We use technical and organizational measures to protect information against unauthorized access, loss, alteration, and misuse. No service can guarantee complete security.

16. Changes

We may update this privacy policy when Madklar or our processing changes. For material changes, we will give notice in a reasonable way, for example in the app or by email.

Last updated: May 11, 2026