umki

Legal center

Privacy Policy

The personal data Yumki processes, for what purpose, with whom, for how long, and the rights you have.

Last updated September 24, 2026

The controller of the processing described in this policy is Nundia LLC, 1207 Delaware Avenue, 5052, Wilmington, DE 19806, United States. For any question about your data or to exercise your rights, write to [email protected].

This policy applies to the website https://yumki.app and to the iOS app “Yumki”.

Nundia LLC processes the following data:

Account
Name, email address, password stored in hashed form or Apple or Google identifier, profile photo; email verifications; two-factor authentication, if you enable it.
Sessions
IP address, browser and sign-in dates.
Household
Members, roles and invitations, including the email addresses of invited people.
Meal profile
Number of adults and children, country and region, retailers, diet, allergies, excluded foods, equipment, cooking level, preparation time, budget and motivations.
Content
Menus, recipes saved or imported from a link, a photo or a video, folders, shopping list, pantry, receipts (photo, store, lines and prices), conversations with the assistant and what it remembers, and your voice when you use voice input.
Devices
Push notification tokens.
Billing
Payment references at Stripe and at Apple, the status of your plan and the month's usage counters. Your payment details are entered at Stripe or at Apple: Nundia LLC does not store them.
Security
IP addresses, used to limit the number of requests.

This data comes from you, when you create your account and use the service, or is generated by that use, such as sessions and counters. Some of it comes from third parties: from Apple or Google, if you sign in with them; from Stripe and Apple, for the status of your payments; from the household member who invites you, for your email address.

Account data is required to create an account and use the service. Your diet and allergies are optional: if you do not provide them, menus do not take them into account.

Each processing operation relies on a legal basis provided for by the General Data Protection Regulation (GDPR):

Providing the service
Creating and managing your account and household, composing menus, keeping your recipes, shopping list and pantry, reading your receipts, estimating the cost of groceries, running the assistant, and sending the service's emails and notifications. Legal basis: performance of the contract concluded with Nundia LLC.
Managing plans and payments
Applying the limits of the Free plan, granting access to Pro, and tracking payments and refunds. Legal basis: performance of the contract.
Adapting menus to your allergies and diet
Legal basis: your explicit consent, described in section 4.
Using artificial intelligence features
Sending the necessary content to artificial intelligence providers. Legal basis: your explicit consent, described in section 5.
Securing the service
Protecting accounts, limiting the number of requests per IP address, and preventing fraud and abuse. Legal basis: the legitimate interest of Nundia LLC in ensuring the security of the service and its users.
Sending an invitation to join a household
Sending the invited person the invitation requested by a household member. Legal basis: the legitimate interest of the inviting member in bringing their household together in the service.
Answering your messages
Handling your questions, complaints and requests concerning your rights. Legal basis: performance of the contract and, for your rights, compliance with the legal obligations of Nundia LLC.

Menus and suggestions are composed automatically from your profile. No decision producing legal effects concerning you or similarly significantly affecting you is taken solely on the basis of automated processing.

Allergies are health data, and a diet may reveal a religious belief, for example a pork-free diet. This data is processed only with your explicit consent, which you give by entering it after clear information shown at the time of entry. It is used to adapt the menus and recipes offered to your household.

You can withdraw this consent at any time by deleting this information in the settings: it then stops being taken into account. Withdrawal does not affect the lawfulness of processing carried out before it.

If this information concerns other people in your household, you enter it only with their agreement or, for a minor, as their legal representative.

The assistant, the reading of receipts and food photos, recipe import, menu composition, the illustration of composed recipes and the transcription of voice and of the sound of imported videos rely on third-party artificial intelligence providers, listed in section 6.

Before you first use these features, you are asked for your explicit consent to your content being sent to these providers. The data sent is the data used by the feature concerned: the message sent to the assistant, the photo of a receipt or of a food item, the link, photo or video of a recipe to import, the recording of your voice, or the elements of your meal profile needed to compose menus, which may include your allergies and diet.

You can withdraw this consent at any time in Settings, under “AI services”. No content is then sent to these providers any longer, and the features that depend on them are no longer available. Withdrawal does not affect the lawfulness of processing carried out before it.

Your data is accessible to authorised persons at Nundia LLC, within the limits of their duties, and to the members of your household for the content the household shares. It is sent to the following providers, for the role indicated:

netcup GmbH
Hosting of the servers, database and files. Country: Germany.
Cloudflare, Inc.
Routing of the traffic of the website and of file storage, acting as a proxy and content delivery network. Country: United States.
Resend
Sending of the service's emails. Country: United States.
Stripe
Payment on the website. Country: United States or Ireland, depending on the Stripe entity concerned.
Apple
Purchases in the iOS app, push notifications and, if you choose it, sign-in with Apple. Country: United States.
Google
Sign-in with Google, if you choose it. Country: United States.
Alibaba Cloud Model Studio
Artificial intelligence, Qwen models: reading of text and images for the assistant, receipts, recipe import, food photos and menu composition. Country: Singapore.
Alibaba Cloud DashScope
Artificial intelligence: illustration of composed recipes. Country: Singapore.
Groq, Inc.
Artificial intelligence: transcription of voice and of the sound of imported videos. Country: United States.

Some of these providers also process data on their own behalf, under their own privacy policies: Apple, for the purchases it bills and for sign-in with Apple; Google, for sign-in with Google; Stripe, for the data entered on its payment pages.

Finally, your data may be disclosed to authorities where the law requires it.

Your data is hosted in Germany. Some providers, however, process it outside the European Economic Area: in the United States (Cloudflare, Resend, Apple, Google, Groq and, depending on the entity concerned, Stripe) and in Singapore (Alibaba Cloud).

These transfers rely on the contractual safeguards offered by these providers, such as the standard contractual clauses adopted by the European Commission or equivalent safeguards. You can obtain a copy of them by writing to [email protected].

A sign-in session expires after 7 days without activity. Other data is kept until your account is deleted.

You can delete your allergies and diet at any time in the settings, and delete your account there too, except while a subscription taken out on the website is running, as the Terms of Service explain; deletion can then be requested at [email protected]. Deleting the account erases the data attached to it; stored files, such as photos and receipts, are then purged by an automatic clean-up process.

You have the following rights over your data:

  • access: to know whether it is processed and to obtain a copy;
  • rectification: to have inaccurate data corrected or incomplete data completed;
  • erasure: to have it deleted, in the cases provided for by law;
  • restriction: to have its processing suspended, in the cases provided for by law;
  • portability: to receive the data you provided in a structured, commonly used and machine-readable format, or to have it transmitted to another controller;
  • objection: to object, on grounds relating to your particular situation, to processing based on legitimate interest;
  • withdrawal of consent: to withdraw a consent at any time, without affecting the lawfulness of processing carried out before.

If you live in France, you may also set instructions on what happens to your data after your death.

To exercise these rights, write to [email protected]. Several of them can also be exercised directly in the settings: editing your profile, deleting your allergies and diet, withdrawing your consent to AI services or deleting your account. If there is reasonable doubt about your identity, additional information may be requested. You will receive an answer within one month, which may be extended by two months for a complex request or where requests are numerous; you are then informed of this within the first month.

If you believe your rights are not respected, you may lodge a complaint with the data protection authority of your country of residence in the European Union, which in France is the Commission nationale de l'informatique et des libertés (CNIL, www.cnil.fr).

Nundia LLC applies technical and organisational measures appropriate to the risks, including encrypted connections, passwords stored in hashed form, available two-factor authentication, limits on the number of requests and access to data restricted to the people who need it. As no system is infallible, absolute security cannot be guaranteed.

In the event of a data breach that presents a risk to your rights, Nundia LLC notifies the competent supervisory authority and, where the law requires it, the people concerned.

Yumki is intended for people aged 18 or over. Children in the household have no account: the meal profile only records how many there are.

Yumki uses no audience measurement, advertising or error-tracking tool. The cookies and local storage it uses are described in the Cookie Policy.

This policy may change. Its update date appears at the top of the document. Any significant change is announced to you by email or in the service before it takes effect. A new processing operation based on consent begins only once that consent has been obtained.