TOP NUTRITIONIST / PRIVACY

Privacy notice

Updated 3 October 2026

This notice explains how personal data is processed in Top Nutritionist: the Telegram bot @topnutritionist_bot, this website and the web reports.

Controller

The controller is Mariia Poteshkina, a self-employed person (autónoma) registered in Spain, NIF Z0843401L, C/ Quevedo 16, Bajo, 03700 Denia (Alicante), España. Send all data protection questions through the contact form.

Data we process

• Telegram account data: Telegram ID, username, first name and language.
• Records you enter: profiles and nutrition targets, meal photos and descriptions, food estimates and your corrections, activity and sleep records, imported tracker files and their import history, and wellbeing notes sent by voice or text (the transcript, the statements listed from it and a reference to the voice message in Telegram).
• Optional features: the Google e-mail you link for web reports, report links, tracker connection credentials and synchronisation history, and assignments to a nutritionist or trainer.
• Credits and payments: balance, credit transactions, Telegram payment ID, amount in Stars and date.
• Consent records: which version of the terms and of the data consent you accepted and when, and the waiver confirmation given before each purchase.
• Accounts of nutritionists, trainers and the team in the dashboard: Google e-mail address, name, role, sign-in sessions and the clients assigned to them.
• Messages sent through the contact form: name, e-mail address for the reply, topic and text. We use them only to answer and delete them 12 months after receipt.
• Technical data: server logs with request paths, times, IP addresses and Telegram IDs, sign-in cookies and records of actions in the professional dashboard.

Health data

Records of meals, activity, sleep and wellbeing can reveal information about your health. Such data is a special category of personal data (Article 9 of the General Data Protection Regulation, GDPR). We process it only on the basis of your explicit consent, which you give in the bot before the first record (Article 9(2)(a) GDPR). Without this consent the bot does not store or analyse records.

Purposes and legal bases

• Keeping your diary, calculating summaries, showing reports, sharing them at your request and importing tracker data: performance of the contract with you (Article 6(1)(b) GDPR) and, for health data, your explicit consent (Article 9(2)(a)).
• Analysis by artificial intelligence and the related transfer to the United States: your explicit consent (Articles 9(2)(a) and 49(1)(a)).
• Credits, payments, accounting and tax records: performance of the contract and legal obligations (Article 6(1)(b) and (c)).
• Recording your acceptance and consents: the legal obligation to demonstrate consent (Articles 6(1)(c) and 7(1)).
• Security, prevention of misuse and troubleshooting through logs, sign-in cookies and dashboard records: our legitimate interest in a secure, working service (Article 6(1)(f)).
• Dashboard accounts of nutritionists and trainers: performance of the contract with them (Article 6(1)(b)).
• Answering your requests and complaints: legal obligations (Article 6(1)(c)).

We make no decisions based solely on automated processing that produce legal or similarly significant effects for you. We do not use your data for advertising and do not sell it.

Artificial intelligence and transfer to the United States

Food photos and descriptions, tracker screenshots, text entered for analysis and wellbeing voice messages and texts are sent to OpenAI, L.L.C. in the United States. Voice messages are transcribed to text, and the text is organised into a list of your statements. For import files with unrecognised columns, the column headers and a few sample rows are sent so that the columns can be matched.

We use OpenAI through a ChatGPT subscription account. OpenAI processes these inputs under its own terms of use and privacy policy for this account type and may store them; we have no separate data processing agreement with OpenAI. Use of these inputs to train OpenAI models is switched off in the account settings. For this transfer we do not rely on an adequacy decision or on safeguards such as standard contractual clauses. It is based on your explicit consent (Article 49(1)(a) GDPR). The risks: the level of data protection in the United States may be lower than in the European Union, US authorities may obtain access to the data, and you may have fewer ways to enforce your rights. Send only what you agree to have processed this way.

Recipients

• Telegram, which delivers messages and files and processes payments in Telegram Stars under its own terms and privacy policy.
• Contabo GmbH (Germany), which hosts our server in France, in the European Union, on our behalf.
• Cloudflare, Inc., which delivers and protects this website and processes IP addresses and request data on our behalf under its data processing terms.
• OpenAI, L.L.C. (United States) for analysis, as described above.
• Google, if you use Google sign-in for web reports.
• Tracker providers (Oura, Fitbit, Polar, Withings, WHOOP, Strava), only if you connect them; data comes from them to us.
• Nutritionists and trainers you share your records with or who are assigned to you at your request. They use your records to give you their own guidance and are responsible for that use themselves.
• Anyone who holds an active report link that you created.
• Our tax advisor, for payment records needed for accounting and tax obligations, and public authorities where the law requires it.

PayPal (Europe) S.à r.l. et Cie, S.C.A. processes payments for credits under its own terms and privacy policy; we receive your PayPal e-mail address, the amount and the payment number.

How long we keep data

• Diary records, profiles, wellbeing notes, imports, tracker connections and report links are kept until you delete them, delete your account with /deleteaccount or withdraw your consent. They are then removed from the database immediately.
• While your account exists, your credit balance, credit transactions, payment records and consent records are kept with it. After you delete the account, these records and your Telegram ID are kept for six years after the last transaction (Article 30 of the Spanish Commercial Code and tax law) and are then deleted automatically.
• Unfinished entries in the bot session are kept until you finish or cancel them and are removed when you delete your account.
• Server logs are deleted after 90 days. Copies of the database made before software updates are deleted after 30 days. Uploaded files are deleted after they have been processed.
• Messages and voice messages in your Telegram chat stay in Telegram under Telegram's rules; you can delete them in Telegram.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict processing, to data portability and to object to processing based on legitimate interest. You can withdraw your consent at any time; withdrawal does not affect processing carried out before it. You can exercise these rights yourself: in the bot, /mydata shows what is stored, sends all your data as a file and leads to deletion, and /deleteaccount deletes the account; on the website, the «Your data» page of your client report lets you download the data and delete individual records or the whole account. For other requests use the contact form. We answer within one month and may ask you to confirm the request from your Telegram account so that we hand data only to you.

You can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the authority of your country of residence.

Minimum age and required data

The service is for people aged 14 and over. Entering records is voluntary, but the diary works only with the records you provide, and an account requires your Telegram ID.

Cookies

The website has no advertising or analytics cookies. It uses a cookie that stores your chosen language, cookies for signing in to reports and the dashboard, and Cloudflare may set technical cookies that protect the site against automated abuse. These cookies are necessary for the functions you request and need no consent.

The cookie policy lists every cookie with its purpose, provider and lifetime.

Oura integration status

A direct Oura connection is in preparation and is not yet available to the public. Data received through the Oura API will not be sent to artificial intelligence models.

Changes

We will update this notice when the service changes and announce material changes in the bot. If a change requires new consent, the bot will ask for it. See also the terms of use.