Privacy notice.
Last updated: October 2026
This notice explains how ZWIMP processes personal data under the Swiss Federal Act on Data Protection (revFADP / nDSG), in force since 1 September 2023.
Who is responsible
The controller is ZWIMP, Anders Emblad, Martines 87, 1052 Le Mont-sur-Lausanne, Switzerland, hello@zwimp.app. For any privacy question, write to that address or use the feedback button in the app.
What we process
Your email address, household preferences (language, diet, foods to avoid, stores), pantry items, recipes, meal plans and shopping lists. Kitchen photos and receipt files are analysed in memory and deleted right after — they are never stored.
Why
Only to run the service: suggest recipes, plan meals and build your list. We do not sell data or show ads, and there are no tracking cookies inside the app. Simple usage counts (e.g. "a scan was done") are tied to your household, not your identity, to improve the app.
Website statistics
On our public pages only (home page and this notice) we use Google Analytics to count visits and see how people find ZWIMP. Google sets cookies and receives your IP address (shortened), browser and page data, possibly processed in the USA. It is never used inside the signed-in app, so your pantry, recipes and lists are never sent to Google. You can block it with your browser settings or an ad blocker.
AI processing
Photos, receipts and pantry lists are sent to AI models from OpenAI (USA) to recognise food and write recipes. Requests pass through the AI gateway of Lovable (Lovable Labs AB, Sweden), which forwards them to OpenAI. Data sent to the USA is protected by the standard contractual clauses recognised by the FDPIC. Requests are not stored by the provider for training, and nothing is used to train models. Product names from receipts help improve matching for everyone; no personal or purchase data is shared.
Emails
Sign-in and confirmation emails are sent from notify.zwimp.app through Lovable (Sweden) and its email delivery providers, which may process the email address in the USA. Messages sent to hello@zwimp.app are forwarded by ImprovMX (ImprovMX Inc., USA; servers in the EU and USA) to a Gmail inbox (Google, USA), and kept only as long as needed to answer them. Transfers to the USA rely on standard contractual clauses or the Swiss-U.S. Data Privacy Framework.
Recipients
Data is shared only with the providers needed to run ZWIMP: hosting (Amazon Web Services, United Kingdom), AI (OpenAI, USA, via Lovable, Sweden), app emails (Lovable, Sweden, and its delivery providers Mailgun, USA, and Amazon Web Services SES), contact email forwarding (ImprovMX Inc., USA; servers in the EU and USA) and the contact inbox (Gmail by Google, USA), payments (Stripe, Ireland and USA) and website statistics on public pages (Google, USA). Data is hosted on AWS in the London region (eu-west-2); Switzerland recognises the UK as offering adequate data protection. Stripe handles payments; card and TWINT details are never visible to ZWIMP. Stripe may set cookies on pages where a payment is possible to prevent fraud and process the payment. Transfers to the USA rely on standard contractual clauses or the Swiss-U.S. Data Privacy Framework.
How long
Account data is kept while your account exists and deleted within 30 days of a deletion request. Photos and receipt files are not kept at all.
Your rights
You may request access, correction, deletion or a copy of your data, and object to processing. You may also contact the Federal Data Protection and Information Commissioner (FDPIC).
Security
Encrypted connections, row-level access rules so only your household sees its data, and minimal data retention.