Privacy Policy
Last updated: October 8, 2026
GDPR Notice: Nusli is based in Athens, Greece and operates under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019. As an EU-based controller, we are committed to protecting your rights under European data protection law.
Data Controller
The data controller for all Nusli applications is Nusli, based in Athens, Greece. You can contact us at for any data protection matters.
Information We Collect
Our apps are designed with privacy at their core. Data you enter — such as supplement logs, medication records, food logs, weight and health data — is stored locally on your device unless a feature you use needs to send it, as described in the app-specific sections below. Where an app offers optional cloud backup (via Sign in with Apple), your data is stored securely and encrypted, and is only accessible to you.
Some apps collect anonymous usage statistics (such as crash reports or product analytics) to improve the app. Each app's section below lists exactly what it collects.
Legal Basis for Processing (GDPR Art. 6 and Art. 9)
Where we process any personal data, we rely on the following legal bases: (a) your consent, where explicitly given; (b) performance of a contract, to provide features and subscriptions you request; (c) our legitimate interests in improving app performance and preventing crashes; (d) compliance with legal obligations. Where a feature you choose to use processes health-related data (special category data under Art. 9 GDPR), we rely on your explicit consent, which you give by using that feature and can withdraw at any time by stopping its use or deleting your data.
Advertising & Attribution
Some of our apps use the Meta (Facebook) SDK to measure the effectiveness of our advertising. This applies only to apps that show Apple's App Tracking Transparency prompt. ShiftPlate does not include the Meta SDK, does not access the Advertising Identifier (IDFA), and does not track you.
In apps that use it, the Meta SDK helps us understand whether you installed or subscribed after seeing an ad. With your permission (requested through Apple's App Tracking Transparency prompt), this uses your device's Advertising Identifier (IDFA). If you decline, no identifier is shared and attribution is not performed. We never share your health, heart-rate, sleep, or any HealthKit data with Meta or any advertiser — that data stays on your device and in Apple Health.
Health Data
Health and vitals data is processed on your device and, where an app integrates with Apple Health, stored there. Health data is never linked to your identity, never used for advertising or tracking, and never shared with advertisers. Some ShiftPlate features send limited nutrition data to process your request; the ShiftPlate section below explains when and why.
In-App Purchases
Payment processing is handled entirely by Apple (App Store) or Google (Google Play) acting as independent data controllers. We receive only a transaction confirmation — never your payment details. Subscription status is managed through RevenueCat, which receives your App Store transaction data and an anonymous app user identifier.
International Data Transfers
Some third-party services (for example Apple, Google, Anthropic and RevenueCat) may process data outside the European Economic Area. Such transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.
Your Rights Under GDPR
As an EU resident you have the following rights, which you may exercise by contacting us at :
- Right of access — request a copy of your personal data
- Right of rectification — correct inaccurate data
- Right of erasure — request deletion of your data
- Right of restriction — limit how we process your data
- Right of portability — receive your data in a portable format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — at any time, without affecting prior processing
Supervisory Authority
You may lodge a complaint with the Hellenic Data Protection Authority (HDPA): www.dpa.gr.
Data Retention
Local data is controlled entirely by you. Anonymous crash data is retained for a maximum of 12 months. App-specific retention is listed in each app's section below.
Children's Privacy
Our apps are not directed at children under the age of 16. We do not knowingly collect data from minors.
ShiftPlate
ShiftPlate works without an account: no name, email address or password. When you first open the app, an anonymous identifier is created so the app can count food scans and confirm your subscription.
Stays on your device only. Your food log, meals, macros, water, weight entries, calorie and macro targets, shift schedule, weekly reviews and onboarding answers are stored on your device. They are not sent to us.
Data that leaves your device, and why:
- Photos (food scan). When you scan a meal, the photo is sent over an encrypted connection to our backend and to Anthropic to estimate calories and macronutrients. The photo is not stored on our servers. We keep only a timestamp of the scan, attached to your anonymous identifier, to enforce the free daily scan limit.
- Your messages and nutrition data (Coach). When you send a Coach message, the app sends your message, up to six saved meal names, today's calories and protein, your remaining budget, weekly averages, a rounded weekly weight change and your upcoming shift times. Anthropic processes this to write the reply. No name or account identifier is included. Coach conversations are not stored on our servers and are not used to train AI models. The Coach is a wellness feature and does not provide medical advice.
- Purchases and user identifiers (subscriptions). An anonymous session identifier and an anonymous RevenueCat identifier are used to verify your ShiftPlate subscription.
- Product analytics. Anonymous events (for example, which onboarding step was completed or which plan was viewed), a random per-install identifier and, if you arrived from an Apple Search Ads link, an Apple attribution token. Your approximate country or city is derived from your IP address. Events never contain food names, calorie or weight values, or goals. Automatic screen capture and session replay are disabled.
- Food database lookups. Barcode numbers and food search text are sent to Open Food Facts, a public nutrition database, with no identifier.
None of this data is linked to your identity. ShiftPlate does not track you across other companies' apps or websites, shows no ads, and does not sell or share data with data brokers.
Service providers. Supabase (backend, EU hosting), Anthropic (food scans and Coach), RevenueCat (subscriptions), PostHog (analytics, EU hosting), ActivationPal (analytics and Apple Search Ads attribution), Open Food Facts (nutrition database) and Apple (payments).
Retention and deletion. Scan timestamps and subscription status are kept until you delete your account. Settings › Delete account in ShiftPlate permanently deletes your anonymous account and all server-side records, then erases the app's data on your device. Analytics identifiers are random per installation and are not connected to your identity.
Changes to This Policy
We will notify you of material changes through the app or this website.