Legal

Privacy
Policy.

Effective date: 8 July 2026 · Last updated: 8 July 2026

    The short version: Accanto collects your name and email to provide the service. If you choose to upload medical documents, they are processed temporarily to generate your meal plan and are never stored permanently on our servers. We do not sell your data. Ever.
  

1. Who We Are

Accanto is a heart-healthy meal planning service operated by Aisha Surodjawan, a sole trader based in Piedmont, Italy. The service is accessible at accan.to.

For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Italian Legislative Decree no. 196/2003 as amended by Legislative Decree no. 101/2018, Aisha Surodjawan is the Data Controller.

Contact: privacy@accan.to

2. What Data We Collect and Why

Data	Why We Collect It	Legal Basis (GDPR)
Name and email address	To create and manage your account, and to deliver the free guide if requested	Contract performance (Art. 6(1)(b))
Password (hashed)	To authenticate you securely. We never see or store your actual password.	Contract performance (Art. 6(1)(b))
Google account information	Only if you choose to sign in with Google: your name, email and profile picture from Google	Consent (Art. 6(1)(a))
Subscription plan and usage	To determine which features you have access to and track monthly generation usage	Contract performance (Art. 6(1)(b))
Medical documents (optional)	Only if you choose to upload them for Full Analysis. Processed to generate your personalized meal plan. Not stored after processing.	Explicit consent (Art. 9(2)(a))
Health conditions	Collected from all users during onboarding (e.g. hypertension, high cholesterol) to personalize your meal plan.	Explicit consent (Art. 9(2)(a))
Allergies	Collected from all users before generating a meal plan, for both your safety and anyone else eating the meals with you.	Explicit consent (Art. 9(2)(a))
Blood pressure, cholesterol, medications, doctor's notes (optional)	Only if you choose to enter these manually instead of uploading documents, for Full Analysis plans.	Explicit consent (Art. 9(2)(a))
Saved meal plans (optional)	If you choose to save a generated plan for future reference	Contract performance (Art. 6(1)(b))
Payment information	Processed by Stripe. Accanto never sees or stores your card details.	Contract performance (Art. 6(1)(b))

3. How We Handle Medical Documents

If you upload medical documents (discharge summaries, lab results, or similar), we want to be completely transparent about what happens:

Documents are transmitted securely over HTTPS directly to Anthropic's API for processing.
The content is used only to generate your personalized meal plan in that session.
Documents are not stored on Accanto's servers or database after processing.
Anthropic processes the data according to their own privacy policy and data retention terms. Anthropic is a sub-processor under our data processing arrangements.
You are never required to upload medical documents. The Quick Start flow works without them.

    Special category data: Health information is classified as "special category" data under GDPR Article 9. Before generating any meal plan, you must actively check a consent box confirming you agree to this processing — this is separate from, and in addition to, agreeing to this Privacy Policy when you create your account. We process this data only for the purpose of generating your meal plan, and only in the session in which you provide it. You may withdraw consent at any time by not entering health information, by clearing it before generating a new plan, or by deleting your account.
  

4. Who We Share Your Data With

We do not sell, rent, or share your personal data with third parties for marketing purposes. We work with the following sub-processors:

Sub-processor	Purpose	Location
Supabase	Account database, authentication, and secure data storage	EU (AWS Frankfurt)
Netlify	Website hosting and serverless functions	USA (with EU data transfer safeguards)
Anthropic	AI processing of prompts and (optionally) medical documents to generate meal plans	USA (with EU data transfer safeguards)
Stripe	Payment processing for subscriptions	USA/EU (with EU data transfer safeguards)
Google	Optional OAuth sign-in only	USA (with EU data transfer safeguards)

All sub-processors are bound by data processing agreements and provide adequate data protection guarantees. Transfers to the USA are conducted under Standard Contractual Clauses (SCCs) approved by the European Commission.

5. How Long We Keep Your Data

Account data — retained for as long as you have an active account, plus 30 days after deletion to allow account recovery.
Usage records — retained for 13 months (to support annual billing comparisons), then deleted.
Saved meal plans — retained until you delete them or your account.
Medical documents — not retained. Processed in-session and discarded.
Email addresses from the free guide form — retained until you unsubscribe or request deletion.

6. Your Rights Under GDPR

As a data subject under EU/Italian law, you have the following rights:

Right of access — you can request a copy of all personal data we hold about you.
Right to rectification — you can correct inaccurate data at any time in your account settings.
Right to erasure ("right to be forgotten") — you can delete your account and all associated data at any time.
Right to restriction — you can ask us to limit how we use your data while a dispute is resolved.
Right to data portability — you can request your data in a machine-readable format.
Right to object — you can object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting previous lawful processing.

To exercise any of these rights, contact us at privacy@accan.to. We will respond within 30 days. You also have the right to lodge a complaint with the Italian data protection authority: Garante per la protezione dei dati personali (garanteprivacy.it).

7. Cookies and Tracking

Accanto uses only technically necessary cookies and browser storage to:

Keep you signed in during your session (authentication tokens managed by Supabase)
Remember your language preference

We do not use advertising cookies, tracking pixels, or third-party analytics. We do not track you across other websites.

8. Security

We take the security of your data seriously, particularly given that some users may share health-related information. Our security measures include:

All data transmitted over HTTPS/TLS encryption
Passwords are hashed using industry-standard bcrypt — we never see your password
Database access protected by Row Level Security (RLS) — users can only access their own data
Medical documents transmitted directly to the AI processor and not persisted
Regular security reviews of our infrastructure

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to privacy@accan.to.

9. Children's Privacy

Accanto is not directed at children under 16. We do not knowingly collect personal data from anyone under 16 years of age. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and update the "last updated" date at the top of this page. Your continued use of Accanto after changes are posted constitutes acceptance of the updated policy.

Contact Us

For any privacy-related questions, requests to exercise your rights, or concerns about how we handle your data:

Aisha Surodjawan
Data Controller — Accanto
Piedmont, Italy
privacy@accan.to

We aim to respond to all privacy requests within 30 days as required by GDPR Article 12.

PrivacyPolicy.