Effective on: August 13, 2021
Last updated on: June 11, 2026
Syndigo LLC (“Syndigo”, “we”, “us”, “our”) takes the protection of personal data (“Personal Data”) very seriously. Please read this privacy notice (the “Notice”) to learn what we are doing with your Personal Data, how we protect it, and what privacy rights you may have under the European Union General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act of 2018 (“CCPA”), the Lei Geral de Proteção de Dados Pessoais (“LGPD”), the Personal Information Protection and Electronic Documents Act (“PIPEDA”), and other applicable privacy laws (“Applicable Laws”).
This Notice addresses data subjects whose Personal Data we:
This Notice does not apply to Personal Data we collect by other means, such as Personal Data that we receive directly through Nutritionix’s own publicly accessible website (https://www.nutritionix.com/) or as part of our sales and marketing efforts, or the Personal Data of our employees.
This Notice tells you, among other things:
Within the scope of this Notice, Syndigo acts as a data controller or “business” for the Personal Data we process. This means that we decide how and why your Personal Data is collected and further processed.
We must have a valid reason to use your Personal Data. This is called the "lawful basis for processing". We may process your Personal Data on the basis of:
Where we process your Personal Data based on your consent, you may withdraw it at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect the validity of our processing of Personal Data performed on other lawful grounds.
Where we receive your Personal Data as part of providing our Services to you to fulfill a contract, we require such Personal Data to be able to carry out the contract. Without that necessary Personal Data, we will not be able to provide the Services to you.
The table below describes the categories of Personal Data we have collected about you in the last twelve months.
| Personal Data We Collect, Process, or Store | How We Obtain It |
|---|---|
IdentifiersThis includes items such as full name, postal address, IP address, email address, account name, or other similar identifiers, your Facebook account and public profile attributes, short name |
We may receive this information directly from you, from your use of the application, or from Apple Health. |
Special categories of Personal DataPhysical characteristics or description, payment information, or health information. Some Personal Data included in this category may overlap with other categories. |
|
Protected characteristicsAge (over 40 years), medical condition, physical or mental disability, or sex (including gender, gender identity or expression, and pregnancy or childbirth). |
|
Commercial informationRecords of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
|
Biometric informationIdentifier or identifying information, such as physical patterns and sleep, health, or exercise data. |
|
Internet or other similar network activityBrowsing history, search history, information on a consumer's interaction with a website, application, or advertisement, usage data, permissions (for camera, microphone) |
|
Geolocation dataPhysical location or movements. |
|
Sensory dataAudio, electronic, visual, or similar information. |
|
Inferences drawn from other Personal DataProfile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. |
|
OtherBody measurements, exercise data, time zone, general activity data, nutrition and food consumption, including brands. |
We will not collect additional categories of Personal Data without informing you.
When you use certain features of the Services, you may upload images, barcodes, product packaging, text, or other content to help identify food products, improve product recognition, or improve the accuracy and completeness of our databases and Services.
These uploads may include:
Uploads should be limited to food products, packaging, nutritional labels, and related product-identification content. Please avoid uploading images containing people, unrelated personal information, government identifiers, payment cards, or sensitive content.
Uploaded content may contain technical or metadata information, such as timestamps, device information, or geolocation-related information. We may remove, transform, filter, or otherwise process such metadata:
We may use automated tools, manual review, or a combination of both to review submitted content for:
We may reject, suppress, remove, transform, or exclude submitted content that violates our policies or is unsuitable for operational, research, or technology improvement purposes.
We may review, process, analyze, transform, moderate, filter, categorize, normalize, or otherwise use uploaded content to:
We may remove metadata, crop or normalize images, filter inappropriate or irrelevant content, separate uploaded content from account identifiers, and apply other technical and organizational measures designed to reduce the likelihood that uploaded content identifies individuals.
Conditioned or transformed datasets derived from uploaded content may be shared with service providers, technology providers, commercial partners, research partners, and other business partners for the limited purposes described in this Notice.
A “cookie” is a small file stored on your device that contains information about your device. We may use cookies to provide basic relevant ads, website functionality, authentication (session management), usage analytics (web analytics), to remember your settings, and to generally improve our websites and Services.
We use session and persistent cookies. Session cookies are deleted when you close your browser. Persistent cookies may remain even after you close your browser, but always have an expiration date. Most of the cookies placed on your device through our Services are first-party cookies which are placed directly by us. Other parties, such as Google, may also set their own (third-party) cookies through our Services. Please refer to the policies of these third parties to learn more about the way in which they collect and process information about you.
If you would prefer not to accept cookies, you can change the setup of your browser to reject all or some cookies. Note, if you reject certain cookies, you may not be able to use all features of our Services. For more information, please visit https://www.aboutcookies.org/.
You may also set your browser to send a Do Not Track (DNT) signal. For more information, please visit https://allaboutdnt.com/. Please note that our Services do not have the capability to respond to “Do Not Track” signals received from web browsers.
For more information about our use of cookies, please see our cookie notice.
We may process your Personal Data for the following business purposes:
When the purposes of processing are satisfied, we will delete the related Personal Data within thirty (30) days or upon receipt of a verified request.
In the preceding twelve (12) months, we have disclosed the following categories of Personal Data to other parties for business purposes:
The categories of third parties to which we may disclose your Personal Data for our business purposes include:
The categories of third parties to which we may disclose your Personal Data for our commercial purposes include:
Depending on the applicable law and the context of the disclosure, certain disclosures of Personal Data or conditioned, transformed, deidentified, or aggregated datasets to third parties may constitute a “sale,” “sharing,” or similar regulated disclosure under applicable privacy laws. Where required by law, we will provide applicable rights relating to these disclosures, including rights to opt out of certain disclosures or uses of Personal Data.
We implement contractual, technical, and organizational safeguards designed to govern how third parties use information received from us, including restrictions relating to reidentification, retention, confidentiality, security, and permitted uses. Some of these third parties may be located in another country, which can be outside the European Economic Area, the United Kingdom or Brazil, such as the United States of America. However, when the Personal Data is protected by Applicable Laws, before transferring your Personal Data to these third parties, we will either ask for your explicit consent or require the third party to maintain at least the same level of privacy and security for your Personal Data that we do.
Note if you are located in the EU: In some cases, the European Commission may have determined that in some countries, their data protection laws provide a level of protection equivalent to European Union law. You can see here the list of countries that the European Commission has recognized as providing an adequate level of protection to personal data. We will only transfer your Personal Data to third parties in countries not recognized as providing an adequate level of protection to personal data when there are appropriate safeguards in place. These may include the European-Commission-approved standard contractual data protection clauses under Article 46.2 of the GDPR, or BCRs for processors under Article 47 of the GDPR.
Note if you are located in Brazil: In this case, the processing of Personal Data will be carried in compliance with LGPD and subject to monitoring and regulation by the Autoridade Nacional de Proteção de Dados (“ANPD”) and may determine that certain countries’ data protection laws provide an equivalent level of protection to the LGPD. Where this is not the case, we will only transfer your Personal Data to third parties located in other countries when there are appropriate safeguards in place which the ANPD has confirmed as acceptable. According to Section 33 of the LGPD, you consent to and acknowledge the international transfer of your personal data to foreign countries and companies within our economic group and that such processes are essential and necessary to carry the services provided by us.
We may disclose your Personal Data to the extent required by law or if we have a good-faith belief that we need to disclose it in order to comply with official investigations or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties). If we have to disclose your Personal Data to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.
We may also disclose your Personal Data if we sell or transfer all or some of our company’s business interests, assets, or both, or in connection with a corporate restructuring. Finally, we may disclose your Personal Data to our subsidiaries or affiliates, but only if necessary for business purposes, as described in the section above.
We may create, use, disclose, license, transfer, or otherwise process aggregated, conditioned, deidentified, pseudonymized, anonymized, or otherwise transformed information for lawful business purposes, including:
Where applicable, we apply technical, administrative, and organizational measures designed to reduce the likelihood that such information can reasonably identify individuals.
Risk of Harm
Whenever Personal Data is collected and processed, there is always some level of risk that the Personal Data
may be breached, misused, or otherwise result in harm to you. However, we take several measures to ensure that
this risk is mitigated as much as possible. For example, we limit the Personal Data about you that we collect
and process to solely what is necessary to achieve the purposes of processing listed in this Notice. We also
have put in place appropriate technical, administrative, and physical security measures, as described in this
Notice, to make sure that your Personal Data is protected.
You may have specific rights regarding your Personal Data that we collect and process under the Applicable Laws. In this section, we first describe those rights and then we explain how you can exercise those rights.
Right to Know What Happens to Your Personal Data
This is called the right to be informed. It means that you have the right to obtain from us all information
regarding our data processing activities that concern you, such as how we collect and use your Personal Data,
how long we will keep it, and who it will be shared with, among other things.
We are informing you of how we process your Personal Data with this Notice.
Right to Know What Personal Data Syndigo Has About You
This is called the right of access. This right allows you to ask for full details of the Personal Data we hold
on you, including confirmation of whether or not we process Personal Data concerning you, and, where that is
the case, a copy or access to the Personal Data and certain related information.
Once we receive and confirm that the request came from you or your authorized agent, we will disclose to you:
Under some circumstances, we may deny your access request. In that event, we will respond to you with the reason for the denial.
The CCPA does not allow us to disclose financial account numbers, account passwords, or security questions and answers. We can inform you that we have this information generally, but we may not provide the specific numbers, passwords etc. to you for security and legal reasons.
Right to Change Your Personal Data
This is called the right to rectification. It gives you the right to ask us to correct without undue delay
anything that you think is wrong with the Personal Data we have on file about you, and to complete any
incomplete Personal Data.
If your account settings do not allow you change the information yourself, please contact us and we will do our best to change the Personal Data for you.
Right to Delete Your Personal Data
This is called the right to erasure, right to deletion, or the right to be forgotten. This right means you can
ask for your Personal Data to be deleted.
Sometimes we can delete your information, but other times it is not possible for either technical or legal reasons. If that is the case, we will consider if we can limit how we use it. We will also inform you of our reason for denying your deletion request.
Right to Ask us to Change How We Process Your Personal Data
This is called the right to restrict processing. It is the right to ask us to only use or store your Personal
Data for certain purposes. You have this right in certain instances, such as where you believe the data is
inaccurate or the processing activity is unlawful.
Right to Ask Us to Stop Using Your Personal Data
This is called the right to object. This is your right to tell us to stop using your Personal Data. You have
this right where we rely on a legitimate interest of ours (or of a third party). You may also object at any
time to the processing of your Personal Data for direct marketing purposes.
We will stop processing the relevant Personal Data unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your Personal Data to establish, exercise, or defend a legal claim.
Right to Opt Out of Certain Processing Activities
Where required by applicable law, you may have the right to object to or opt out of certain processing
activities involving your uploaded content (which may or may not qualify as sales of Personal Data), including
certain disclosures or uses relating to analytics, commercial licensing, machine learning, or technology
improvement activities.
Right to Port or Move Your Personal Data
This is called the right to data portability. It is the right to ask for and receive a portable copy of your
Personal Data that you have given us or that you have generated by using our services, so that you can:
We will provide your Personal Data in a structured, commonly used, and machine-readable format. When you request this information electronically, we will provide you a copy in electronic format.
Right to Withdraw Your Consent
Where we rely on your consent as the legal basis for processing your Personal Data, you may withdraw your
consent at any time. If you withdraw your consent, our use of your Personal Data before you withdraw is still
lawful.
If you have given consent for your details to be shared with a third party and wish to withdraw this consent, please also contact the relevant third party in order to change your preferences.
Right to Non-Discrimination & Financial Incentives
We will not discriminate against you for exercising any of your privacy rights. Unless the applicable data
protection laws permit it, we will not:
Right to Lodge a Complaint with a Supervisory Authority
If a law like the GDPR, UK GDPR or LGPD applies to our processing of your Personal Data, you have the right to
lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal
Data.
Specifically, under the GDPR you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work, or the alleged violation of the GDPR.
Right to Have Your Personal Data Anonymized, Blocked or Deleted
You may have the right to request that we anonymize, block or delete your Personal Data, if the Personal Data
is unnecessary, excessive or processed in a manner that does not comply with the provisions of the LGPD.
To exercise any of the rights described above, please submit a request using the information under “Contact Us.”
In order to correctly respond to your privacy rights requests, we need to confirm that YOU made the request. Consequently, we may require additional information to confirm that you are who you say you are.
For requests submitted via password-protected accounts, your identity is already verified. For requests sent by other means, we will verify your identity via the following method: we will ask you to confirm information that we already hold on you.
We will only use the Personal Data you provide us in a request to verify your identity or authority to make the request.
We will confirm the receipt of your request within ten (10) days and, in that communication, we will also describe our identity verification process and when you should expect a response, unless we have already granted or denied the request.
Please allow us up to thirty (30) days to reply to your requests from the day we received your request. If we need more time [up to ninety (90) days in total], we will inform you of the reason why and the extension period in writing. If you send us a request to confirm the processing of your Personal data or to access your Personal data and we can confirm that the LGPD applies to the processing, allow us up to fifteen (15) days to reply to your requests from the day we received your request.
If we cannot satisfy a request, we will explain why in our response. For data portability requests, we will choose a format to provide your Personal Data that is readily usable and should allow you to transmit the information from one entity to another entity without difficulty.
We will not charge a fee for processing or responding to your requests unless we determine that your request is excessive, repetitive, or manifestly unfounded. In those cases, we will tell you why we made that determination and provide you with a cost estimate before completing your request.
We are strongly committed to keeping your Personal Data safe. We have implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect your Personal Data from unauthorized processing. Unauthorized processing includes unauthorized access, exfiltration, theft, disclosure, alteration, or destruction.
If you are a data subject whose Personal Data we process, you may also have the right to lodge a complaint with a data protection regulator in one or more of the European Union member states.
If we make any material change to this Notice, we will post the revised Notice to this web page. We will also update the “Effective” date. By continuing to use our Services after we post any of these changes, you accept the modified Notice.
If you have any questions about this Notice or our processing of your Personal Data, or want to submit a request to exercise your privacy rights, please write to the Syndigo privacy team by email at [email protected] or contact us by postal mail at:
Syndigo LLC
Attn: Debra Osborn, Senior Counsel
141 W. Jackson Blvd., Ste 1220
Chicago, IL 60604
United States
Please allow up to four weeks for us to reply.
We have appointed VeraSafe as our representative in the EU for data protection matters. While you may also contact us, VeraSafe can be contacted on matters related to the processing of Personal Data. To contact VeraSafe, please use this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.
Alternatively, VeraSafe can be contacted at:
We have appointed VeraSafe as our representative in the United Kingdom for data protection matters. While you may also contact us, VeraSafe can be contacted on matters related to the processing of Personal Data. To contact VeraSafe, please use this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +44 (20) 4532 2003.
Alternatively, VeraSafe can be contacted at:
VeraSafe United Kingdom Ltd.
37 Albert Embankment
London SE1 7TL
United Kingdom
We have appointed VeraSafe as our Data Protection Officer (“DPO”). While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:
VeraSafe, LLC
100 M Street S.E., Suite 600
Washington, D.C. 20003 USA
Email: [email protected]
Web:
https://www.verasafe.com/about-verasafe/contact-us/
© 2026 Syndigo LLC All rights reserved. | Legal | Terms of Use | Privacy Policy | App Privacy Notice