Privacy Policy

This privacy policy is a working draft pending lawyer review before our public launch. The principles below reflect our locked operating policy. If you have any questions about how we handle your data, contact us at our Contact form.

Who we are

Yutrients is a UK supplement brand selling personalised, made-to-order supplement blends. We are the data controller for the personal information described in this policy. Our registered office is in London, United Kingdom. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What we collect

Account information — your name, email address, billing and delivery address, and phone number (if you provide one). We use this to manage your account and ship your orders.

Formulas you build — the ingredients and doses you choose are stored against your customer record so we can manufacture your tin and let you re-order or adjust.

Order history — what you bought, when, and how much. Required for fulfilment, customer service, and HMRC tax records (retained 6 years).

Chat sessions — full transcripts of conversations with our guided builder are stored against your account so you can resume and so we can improve the service. You can delete a session anytime from your account.

Image uploads — photos you upload to our supplement label scanner are processed immediately for ingredient detection, then deleted. We do not retain image files or share them with third parties beyond the AI provider used for the immediate scan.

Browser cookies and tracking — see the Cookies section below.

What we don't collect

We don't collect health records, prescription information, or GP details. We don't ask for sensitive medical data and you should not enter it into our chat or any of our forms.

How we use your data

• Run your account and process your orders.
• Ship your tins to your address.
• Email you about your orders, subscriptions, and important service messages.
• With your consent, send you marketing emails (you can unsubscribe at any time via the link in each email).
• Provide customer service and answer your questions.
• Detect and prevent fraud, abuse, and security incidents.
• Improve our products and services — including, in aggregate and anonymised form, training models that improve our chat and image-recognition features.
• Comply with UK legal and tax obligations.

Who we share data with

We don't sell your personal data. We share it only with the processors we need to run the service:

• Shopify — e-commerce platform and payment processing.
• Recharge — subscription management.
• Klaviyo — transactional and marketing email.
• Trustpilot — independent review collection (if you choose to leave a review).
• Anthropic — AI provider used by our guided builder and image scanner. Image uploads are processed and then immediately deleted.
• Supabase, Render, Vercel, Clerk — our hosting, database, and account infrastructure.
• Royal Mail — fulfilment carrier.

Each of these is a contracted data processor bound by UK GDPR-compliant data processing terms. We share only the data they need to perform their function.

Your rights under UK GDPR

You have the right to:

• Access a copy of the personal data we hold about you.
• Rectify any inaccuracies in your data.
• Erase your data (subject to legal retention requirements like HMRC's 6-year rule).
• Restrict how we process your data.
• Object to processing, especially for marketing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent for any processing based on consent.

To exercise any of these rights, use the data export or account-delete buttons in Account → Settings, or contact us via our Contact form. We respond within 30 days.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

How long we keep your data

• Account data — until you delete your account.
• Order data — 6 years from the date of order, to comply with HMRC tax records requirements.
• Chat session transcripts — until you delete the session or your account.
• Image uploads — deleted immediately after the scan completes (not retained).
• Marketing email subscriptions — until you unsubscribe.
• Anonymised analytics — retained indefinitely in aggregate, non-identifiable form.

Cookies

We use cookies to keep you signed in, remember items in your cart, run analytics, and (with your consent) personalise marketing.

Our cookie banner — powered by Cookiebot — appears on your first visit and lets you accept or reject non-essential cookies by category (Preferences, Statistics, Marketing). Necessary cookies (such as your session token) are always on because the site can't function without them.

You can change your cookie preferences anytime by clicking the cookie icon in the footer.

Children

Yutrients is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

Security

We use industry-standard security measures including HTTPS encryption in transit, encryption at rest for sensitive fields, secure password storage, and access controls limited to authorised staff. We review our security practices regularly.

International transfers

Some of our processors operate outside the UK. Where personal data is transferred internationally, we rely on UK-approved transfer mechanisms (such as UK-EU Adequacy Decisions and Standard Contractual Clauses) to ensure equivalent protection.

Changes to this policy

We may update this privacy policy from time to time. We'll notify you of significant changes by email and post the updated version on this page with a fresh 'Last updated' date.

Contact

Questions about how we handle your data? Reach out via our Contact form.