Privacy Policy

Effective Date: August 10, 2026 · Last Updated: August 10, 2026

1. Introduction

This Privacy Policy explains how VerticalRisers Oy (“VerticalRisers”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you use or interact with Neutrien.

Neutrien is a nutrition and wellness service operated by VerticalRisers Oy.

This Privacy Policy applies when you:

• use the Neutrien mobile application on iOS or Android;

• create or use a Neutrien account;

• provide information for personalized nutrition functionality;

• log meals or other nutrition information;

• upload meal or food photos;

• interact with Neutrien’s coaching or personalized guidance features;

• use AI-assisted Neutrien features;

• purchase or manage a Neutrien subscription;

• visit the Neutrien website;

• complete a survey, questionnaire, or feedback form;

• participate in an interview, usability test, beta test, or other research activity;

• subscribe to product news or marketing communications;

• contact Neutrien support; or

• otherwise interact with Neutrien.

Neutrien is intended only for users who are 18 years of age or older. You must be at least 18 years old to create or use a Neutrien account.

Neutrien is intended as a general nutrition and wellness service. It is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease or medical condition. Neutrien is not a substitute for professional medical advice.

We do not sell or rent personal data.

We do not use personal data collected through Neutrien for third-party behavioral advertising or for tracking users across apps or websites owned by other companies for advertising purposes.

2. Data Controller

The controller responsible for the personal-data processing described in this Privacy Policy is:

VerticalRisers Oy Business ID: 3404761-6 Country: Finland Email: contact@neutrien.io

Neutrien is the product and service operated by VerticalRisers Oy.

Questions, concerns, and privacy requests can be sent to:

contact@neutrien.io

3. Personal Data We Collect

The personal data we collect depends on how you use Neutrien and which features you choose to use.

3.1 Account and Authentication Information

When you create or access a Neutrien account, we may process:

• your email address;

• an internal user ID;

• authentication identifiers;

• authentication-provider information;

• authentication tokens and session information;

• account creation and login information; and

• information necessary to maintain account security.

Neutrien currently supports authentication through:

• email login;

• Sign in with Apple; and

• Google Sign-In.

Authentication and account infrastructure is currently provided using Supabase Auth.

Neutrien does not require you to provide your name as part of your Neutrien profile.

Depending on an external authentication provider and its configuration, Apple or Google may provide limited account or authentication metadata during the sign-in process. If such information is received, we use it only where appropriate for authentication, security, or account management unless another use is disclosed.

3.2 Age Verification

Neutrien is available only to users who are 18 years of age or older.

We may process your age or date of birth to:

• confirm that you meet Neutrien’s minimum age requirement;

• prevent account creation by users under 18;

• provide age-relevant nutrition calculations and personalization; and

• maintain compliance with requirements applicable to the services and technologies used by Neutrien.

You cannot create or use a Neutrien account if you are under 18 years of age.

If we become aware that an account belongs to a person under 18, we may suspend or delete the account and take appropriate steps to remove associated personal data, subject to applicable legal requirements.

3.3 Health, Fitness, Nutrition, and Personalization Information

To provide personalized nutrition functionality, Neutrien may process information that you provide about yourself, including:

• age or date of birth;

• gender, where provided;

• height;

• weight;

• target weight;

• body-composition information;

• nutrition goals;

• weight-management goals;

• fitness-related goals;

• exercise frequency;

• activity level;

• physical activity;

• physical work or lifestyle information;

• dietary preferences;

• special diets;

• allergies;

• intolerances;

• disliked foods;

• preferred foods;

• meal preferences;

• cooking and preparation preferences;

• eating habits;

• calorie targets;

• macronutrient targets;

• food and meal history;

• food intake;

• nutritional calculations;

• progress information; and

• other information you voluntarily provide for personalization.

We may use this information to:

• calculate nutrition targets;

• personalize Neutrien;

• understand your goals and preferences;

• analyze meals;

• generate nutrition guidance;

• provide coaching;

• recommend practical next steps;

• adapt recommendations based on food intake and other relevant information;

• provide progress information;

• operate Neutrien; and

• improve the quality and functionality of Neutrien.

Some of this information may constitute health data or another special category of personal data under applicable data-protection law.

Where required, we process such information based on an appropriate legal basis, including explicit consent where required.

Where processing is based on consent, you may withdraw that consent as provided by applicable law. Withdrawal does not affect processing that occurred lawfully before withdrawal.

4. Meal Photos and Other User Content

Neutrien allows users to provide content for nutrition analysis, personalization, food logging, and coaching.

This may include:

• meal photos;

• food photos;

• food descriptions;

• logged meals;

• ingredient information;

• portion information;

• messages sent to the Neutrien coach;

• questions;

• feedback;

• dietary preferences;

• free-text information; and

• other information that you intentionally submit.

We may process this information to:

• identify or understand foods;

• estimate nutritional content;

• understand meals;

• maintain your food history;

• answer your questions;

• provide personalized nutrition guidance;

• provide coaching;

• calculate or adjust nutrition recommendations;

• suggest practical next steps;

• provide the features you request; and

• evaluate and improve Neutrien’s functionality and quality.

Authorized personnel may access limited user content where reasonably necessary to provide support, investigate technical issues, maintain security, evaluate feature quality, or improve Neutrien.

Access to personal information is limited according to operational need.

Do not provide personal information about another person unless you have permission and are legally permitted to do so.

5. AI-Assisted Processing

Neutrien uses artificial intelligence and machine-learning systems as part of its functionality.

AI-assisted processing may be used to:

• analyze meals and meal photos;

• interpret food descriptions;

• estimate nutritional information;

• answer nutrition-related questions;

• provide personalized guidance;

• generate coaching responses;

• understand a user’s current nutrition situation;

• suggest foods or meals;

• provide practical next steps;

• assist with meal planning;

• adapt recommendations based on information available to Neutrien; and

• provide other personalized Neutrien functionality.

Depending on the feature you use, information processed through AI services may include:

• meal photos;

• food descriptions;

• meals you have logged;

• questions you ask;

• coach messages;

• relevant nutrition information;

• nutrition goals;

• dietary preferences;

• recent meal history; and

• limited profile information relevant to providing the requested functionality.

We aim to provide AI service providers only with information reasonably necessary to provide the relevant Neutrien feature.

5.1 Current AI Models and Providers

Neutrien currently uses third-party artificial-intelligence services, including Google Gemini models, through API-based services.

Neutrien may also use additional AI models, service providers, or supporting AI infrastructure where appropriate for providing and improving Neutrien functionality.

AI models and service providers may change over time as Neutrien develops.

5.2 Sharing Information With AI Providers

Some Neutrien functionality requires information you provide to be transmitted to a third-party AI service provider so that the requested functionality can be performed.

Where required by applicable law or platform requirements, Neutrien will provide appropriate information and obtain the required permission before personal data is shared with a third-party AI provider.

We aim to limit information shared with AI providers to information reasonably necessary for the requested functionality.

We do not sell information submitted to AI service providers.

We do not provide meal information, health information, coach conversations, or other Neutrien personal data to AI service providers for third-party advertising.

AI service providers process information according to the contractual, security, privacy, and data-processing arrangements applicable to the services we use.

5.3 Changes to AI Models and Providers

Neutrien may add, replace, update, or change AI models, AI service providers, or related technical infrastructure as the service develops.

We will update this Privacy Policy where appropriate to reflect material changes.

Where a change remains within the purposes and types of processing described in this Privacy Policy, changing the underlying provider, model, or technical system does not necessarily change the underlying purpose for which your personal data is processed.

Where applicable law or platform requirements require additional notice, consent, or permission before personal data is shared with a new provider or used for a new purpose, we will provide that notice or obtain that permission before the relevant processing begins.

If we introduce a materially different use of personal data that is incompatible with or substantially different from the purposes described in this Privacy Policy, we will provide appropriate information and obtain consent where required.

6. Product Development and Improvement

We use information to operate, understand, develop, and improve Neutrien.

This may include:

• evaluating whether features operate correctly;

• evaluating the quality of nutrition calculations and recommendations;

• evaluating AI-assisted functionality;

• understanding how users interact with Neutrien;

• identifying usability problems;

• improving app functionality;

• improving personalization;

• fixing bugs;

• improving reliability and performance;

• developing new features;

• understanding general product usage; and

• conducting internal product research.

Where reasonably possible and appropriate, we use aggregated, anonymized, de-identified, or pseudonymized information for general product-development, analytics, quality-evaluation, and statistical purposes.

Where identifiable information is reasonably necessary, for example to troubleshoot a particular feature or evaluate an incorrect result, access is limited to what is necessary for that purpose.

We do not sell personal data for product-development purposes.

We do not use health, nutrition, meal, or coaching information for third-party advertising.

7. Usage and Analytics Information

We may collect information about how Neutrien is used.

This may include:

• product interactions;

• screens or features used;

• app sessions;

• app events;

• general usage patterns;

• app version;

• device or app identifiers;

• operating-system information;

• device characteristics;

• language settings;

• timestamps;

• performance information; and

• other technical usage information.

We may use this information to:

• understand how Neutrien is used;

• measure feature usage;

• improve user experience;

• identify areas for improvement;

• evaluate new functionality;

• maintain application quality;

• troubleshoot;

• develop Neutrien; and

• understand overall application performance.

8. Firebase Analytics

Neutrien currently uses Google Analytics for Firebase for application analytics.

Firebase helps us understand general or pseudonymous application usage, engagement, and technical performance.

We do not intentionally send detailed Neutrien profile or user-content information to Firebase Analytics, such as:

• your email address;

• meal photos;

• coach conversations;

• detailed meal content;

• weight;

• detailed health information;

• nutrition goals; or

• your detailed Neutrien nutrition profile.

Firebase may process app or device identifiers and technical or usage information necessary to provide analytics functionality.

We use Firebase Analytics for Neutrien’s own:

• product analytics;

• application development;

• feature evaluation;

• usage measurement; and

• technical improvement.

We do not use Firebase Analytics to sell personal data or to create third-party advertising profiles about Neutrien users.

9. Backend, Authentication, and Security Logs

Neutrien uses backend, database, authentication, and infrastructure services, including Supabase and Supabase Auth, to operate the service.

As part of operating these services, Neutrien and its service providers may process technical information associated with requests, authentication events, and system activity.

This information may include:

• IP addresses;

• user or account identifiers;

• timestamps;

• login and logout events;

• authentication attempts;

• authentication-provider information;

• user-agent information;

• device or browser information;

• session information;

• request metadata;

• application events;

• security events;

• error information;

• technical logs; and

• other information reasonably necessary to operate and protect Neutrien.

We may use this information to:

• authenticate users;

• maintain account security;

• maintain user sessions;

• detect suspicious activity;

• prevent fraud, spam, and abuse;

• apply security and rate-limiting measures;

• investigate errors;

• troubleshoot technical problems;

• protect Neutrien’s infrastructure;

• maintain service reliability and availability; and

• comply with applicable legal or security requirements.

We do not use backend or authentication logs for third-party behavioral advertising.

Access to backend and security information is restricted according to operational need.

10. Diagnostics and Performance Information

We may process technical diagnostic information, including:

• crash information;

• errors;

• application-performance information;

• app responsiveness;

• device characteristics;

• operating-system information;

• technical logs; and

• other diagnostic information.

We may use this information to:

• investigate errors;

• troubleshoot problems;

• maintain reliability;

• improve performance;

• protect Neutrien;

• maintain service availability; and

• improve the product.

We do not intentionally associate diagnostic information with detailed nutrition or coaching content unless doing so is reasonably necessary to investigate a particular technical, security, or support issue.

11. Purchases and Subscriptions

Neutrien offers paid subscriptions.

11.1 Apple App Store

Purchases made through the iOS application are processed through the Apple App Store.

11.2 Google Play

Purchases made through the Android application are processed through Google Play’s billing system.

11.3 RevenueCat

Neutrien currently uses RevenueCat to manage subscription status and access to paid functionality.

We may process information including:

• subscription product;

• subscription status;

• subscription duration;

• purchase history;

• transaction identifiers;

• application user identifier;

• entitlement status;

• renewal status; and

• information necessary to restore or verify purchases.

We may use this information to:

• provide paid functionality;

• verify subscription access;

• restore purchases;

• synchronize subscription access where supported;

• troubleshoot payment issues;

• provide subscription-related support;

• understand subscription performance; and

• comply with applicable financial, accounting, and legal obligations.

Payment information is processed by the applicable payment platform.

Neutrien does not independently receive or store your complete payment-card details for purchases processed by Apple or Google.

12. Website Information

When you visit the Neutrien website, we or our service providers may process limited technical information, including:

• IP address;

• browser type;

• browser version;

• device type;

• operating system;

• language settings;

• pages requested;

• referring page or source;

• date and time of access;

• technical logs;

• approximate location derived from technical information, where applicable; and

• website interactions.

We may use this information to:

• provide the website;

• maintain website functionality;

• maintain security;

• prevent fraud, spam, and abuse;

• troubleshoot technical problems;

• understand website performance; and

• improve the website.

13. Surveys, Feedback, Beta Testing, and User Research

We may invite users or website visitors to voluntarily participate in:

• surveys;

• questionnaires;

• feedback activities;

• interviews;

• beta testing;

• usability tests;

• product research; or

• other research activities.

Depending on the activity, we may process:

• email address;

• survey responses;

• feedback;

• information about your experience with Neutrien;

• dietary or nutrition preferences voluntarily provided;

• research notes;

• correspondence; and

• other information you voluntarily provide.

Where an interview or research activity involves:

• audio recording;

• video recording;

• screen recording;

• screenshots; or

• transcription,

we will inform you before the relevant activity and obtain consent where required.

We may use research information to:

• understand user needs;

• evaluate Neutrien;

• test product concepts;

• identify usability problems;

• improve features;

• improve communications;

• understand potential users; and

• develop Neutrien.

Participation in research is voluntary.

Where health information or another special category of personal data is intentionally collected as part of research, we will use an appropriate legal basis and obtain explicit consent where required.

14. Marketing Communications

If you choose to receive marketing communications from Neutrien, we may use your email address and communication preferences to send:

• product news;

• feature updates;

• launch announcements;

• newsletters;

• promotional offers;

• research invitations; and

• other Neutrien-related communications.

Where required by applicable law, these communications are sent based on your consent.

You may unsubscribe at any time by:

• using an unsubscribe link included in the communication; or

• contacting contact@neutrien.io.

Withdrawing marketing consent does not affect processing that occurred lawfully before withdrawal.

We may retain a minimal suppression record after you unsubscribe so that we can respect your request and avoid accidentally adding you back to marketing communications.

Transactional, account, subscription, security, privacy, or other service-related communications necessary to operate Neutrien are not treated as marketing communications.

15. Communications and Customer Support

If you contact Neutrien, we may process:

• your email address;

• the contents of your message;

• attachments;

• relevant account information;

• technical information relevant to troubleshooting; and

• other information you voluntarily provide.

We may use this information to:

• respond to you;

• provide customer support;

• investigate technical issues;

• handle complaints;

• respond to privacy requests;

• protect Neutrien; and

• maintain necessary records of the communication.

16. Sources of Personal Data

We generally obtain personal data from the following sources.

16.1 Directly From You

For example when you:

• create an account;

• complete onboarding;

• enter profile information;

• log food;

• upload a photo;

• communicate with the coach;

• answer a survey;

• contact support; or

• otherwise provide information.

16.2 Automatically Through Your Use of Neutrien

For example:

• application usage;

• authentication and security events;

• technical information;

• diagnostics;

• app or device identifiers; and

• performance information.

16.3 Authentication Providers

For example:

• Apple; and

• Google,

when you choose to use an external authentication service.

16.4 Payment and Subscription Providers

For example:

• Apple;

• Google; and

• RevenueCat,

for purposes such as confirming subscription status, purchases, and entitlements.

We do not purchase consumer profiles from data brokers for Neutrien.

17. When Providing Information Is Required

Providing some information is necessary to use particular Neutrien functionality.

For example:

• you must be at least 18 years old to create and use a Neutrien account;

• information necessary to confirm your age eligibility may be required;

• an email address or supported authentication account may be necessary to create and access an account;

• certain profile information may be necessary to calculate personalized nutrition targets;

• meal information or a meal photo is necessary when you ask Neutrien to analyze that content;

• relevant information may be necessary to provide personalized coaching; and

• subscription information is necessary to provide paid functionality.

Other information may be voluntary.

If you choose not to provide information necessary for a particular feature, we may be unable to provide or personalize that feature.

18. Why We Process Personal Data

We process personal data for the following main purposes.

18.1 Providing Neutrien

This includes:

• account creation;

• age eligibility;

• authentication;

• food logging;

• meal analysis;

• personalized guidance;

• nutrition calculations;

• coaching;

• recommendations;

• progress functionality;

• subscriptions; and

• other functionality requested by the user.

18.2 Personalization

This includes adapting Neutrien based on relevant information such as:

• goals;

• nutrition needs;

• activity;

• dietary preferences;

• meal history;

• food preferences; and

• previous interactions.

18.3 Product Development and Improvement

This includes:

• improving existing functionality;

• developing new functionality;

• evaluating feature and recommendation quality;

• understanding product usage;

• improving usability;

• testing;

• debugging; and

• conducting appropriate research.

18.4 Analytics

This includes:

• understanding application usage;

• measuring feature performance;

• identifying technical or product problems;

• evaluating product changes; and

• improving Neutrien.

18.5 Security and Reliability

This includes:

• protecting accounts;

• maintaining authentication;

• detecting suspicious activity;

• preventing abuse or misuse;

• maintaining security;

• troubleshooting;

• protecting infrastructure; and

• maintaining service availability.

18.6 Subscription Management

This includes:

• confirming entitlements;

• activating paid functionality;

• restoring purchases;

• managing subscription access; and

• handling subscription-related support.

18.7 Customer Support

This includes responding to:

• questions;

• complaints;

• technical problems;

• account issues; and

• other requests.

18.8 Legal Compliance

This includes complying with applicable:

• tax requirements;

• accounting requirements;

• legal obligations;

• regulatory requirements;

• lawful requests; and

• legal claims.

19. Legal Bases for Processing

Where the General Data Protection Regulation (“GDPR”) or similar data-protection legislation applies, we process personal data under one or more appropriate legal bases.

19.1 Performance of a Contract

We may process information where reasonably necessary to provide Neutrien or functionality that you request.

This may include:

• account functionality;

• authentication;

• maintaining your meal information;

• providing requested nutrition features;

• personalized functionality;

• subscription functionality; and

• customer support related to the service.

19.2 Consent

We rely on consent where consent is the appropriate or legally required basis for processing.

This may include certain:

• sensitive-data processing;

• health-related data processing;

• AI-assisted processing where permission is required;

• voluntary research;

• marketing;

• non-essential website technologies; and

• other processing where applicable law requires consent.

Where applicable law treats health-related information as special-category personal data, we may rely on your explicit consent.

Where processing is based on consent, you may withdraw it as provided by applicable law.

19.3 Legitimate Interests

Where permitted by law, we may process limited personal data where necessary for legitimate interests such as:

• operating Neutrien;

• improving Neutrien;

• maintaining security;

• troubleshooting;

• preventing fraud or misuse;

• understanding service performance;

• providing customer support;

• conducting appropriate product research; and

• protecting our legal rights.

Before relying on legitimate interests, we consider the interests and rights of users.

We do not rely on legitimate interests as a substitute for consent where consent is legally required.

19.4 Legal Obligations

We may process information where reasonably necessary to comply with an applicable legal obligation.

20. Health and Other Sensitive Information

Certain information processed through Neutrien may constitute health data or other sensitive personal data depending on its nature and applicable law.

Examples may include:

• weight;

• health-related goals;

• allergies;

• dietary restrictions;

• body measurements;

• activity information;

• nutrition information; and

• information voluntarily provided in coaching conversations.

We use this information primarily to provide and personalize Neutrien and for the other purposes described in this Privacy Policy.

Where required by applicable law, we obtain explicit consent for the processing of special-category personal data.

We do not:

• sell health or nutrition information;

• sell meal information;

• use health information for third-party behavioral advertising;

• sell health information to data brokers; or

• provide health information to third parties for their independent advertising purposes.

21. Service Providers and Sharing of Personal Data

We use third-party service providers where reasonably necessary to operate Neutrien.

We do not sell personal data to these providers.

Our current core services and categories of service providers include:

**Supabase** — Database, backend infrastructure, storage, technical infrastructure, and related services · **Supabase Auth** — Account creation, authentication, session management, and authentication-related security · **Google Analytics for Firebase** — Application analytics and technical usage measurement · **RevenueCat** — Subscription and entitlement management · **Apple services** — Sign in with Apple and App Store purchases · **Google services** — Google Sign-In and Google Play purchases · **AI service providers, including Google Gemini models** — AI-assisted meal analysis, nutrition processing, personalized guidance, coaching, meal planning, and related functionality · **Website and infrastructure providers** — Hosting, website operation, security, forms, communications, and related website functionality · **Research and communication providers** — Surveys, research, communications, and customer-support activities where used

The specific service providers and technical systems used by Neutrien may change over time.

We may add, replace, or change service providers where appropriate for operating, securing, maintaining, developing, or improving Neutrien.

We aim to provide service providers only with information reasonably necessary for the services they provide.

Where applicable law or platform requirements require additional notice, consent, or permission before information is shared with a new provider, we will provide the required notice or obtain the required permission before the relevant processing begins.

22. Other Circumstances in Which Information May Be Shared

In addition to service providers, personal data may be disclosed in limited circumstances.

22.1 Professional Advisers

We may disclose relevant information to:

• lawyers;

• accountants;

• auditors;

• insurers;

• consultants; or

• other professional advisers,

where reasonably necessary for professional services or legal compliance.

22.2 Authorities and Legal Requirements

We may disclose information where reasonably necessary to:

• comply with applicable law;

• respond to a valid legal process;

• respond to an authorized regulator or authority;

• establish, exercise, or defend legal claims; or

• protect legal rights.

22.3 Security and Safety

We may disclose information where reasonably necessary to:

• investigate fraud;

• investigate misuse;

• address security incidents;

• protect Neutrien’s systems; or

• protect the rights or safety of users or others.

22.4 Business Transactions

If VerticalRisers Oy becomes involved in a:

• merger;

• acquisition;

• financing;

• investment;

• restructuring;

• sale of assets; or

• similar corporate transaction,

relevant information may be disclosed to appropriate participants in that transaction, subject to applicable legal and confidentiality requirements.

23. No Sale of Personal Data or Advertising Tracking

VerticalRisers Oy does not sell or rent users’ personal data.

We do not sell:

• health information;

• fitness information;

• nutrition information;

• meal information;

• meal photos;

• coach conversations;

• account information; or

• user profiles.

We do not use Neutrien personal data for third-party behavioral advertising.

We do not use Neutrien personal data to track users across apps or websites owned by other companies for advertising purposes.

We use service providers for functions such as:

• authentication;

• infrastructure;

• analytics;

• subscriptions;

• payments;

• customer support; and

• AI-assisted functionality.

These service providers process information for purposes related to providing their services to Neutrien and according to the applicable arrangements governing their services.

24. International Data Transfers

Some service providers used by Neutrien operate internationally.

As a result, personal data may be processed outside:

• Finland;

• the European Economic Area (“EEA”); or

• your country of residence.

Where applicable law requires safeguards for international transfers, we use or rely on appropriate legally recognized mechanisms.

These may include:

• adequacy decisions;

• Standard Contractual Clauses;

• applicable contractual safeguards; or

• another legally recognized transfer mechanism.

Where appropriate, we may also use supplementary technical, organizational, or contractual protections.

25. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and for applicable legal, security, accounting, and dispute-resolution requirements.

25.1 Account Information

Account information is generally retained while your Neutrien account remains active.

Following account deletion, associated personal information is deleted or anonymized except where we are legally required or otherwise lawfully permitted to retain particular information.

25.2 Nutrition Profiles and Meal Information

Nutrition profiles, goals, meal history, meal photos, coaching information, and related personalization information may be retained while your account remains active so that Neutrien can provide personalized and historical functionality.

Following account deletion, associated information is deleted or anonymized except where continued retention is legally required or otherwise lawfully permitted.

25.3 Analytics and Diagnostics

Analytics and diagnostic information is retained only for as long as reasonably necessary for:

• product analytics;

• product development;

• quality evaluation;

• security;

• performance monitoring; and

• troubleshooting,

subject to the applicable retention settings and technical systems.

25.4 Authentication and Security Logs

Authentication, backend, and security logs may be retained for a period reasonably necessary for:

• security;

• fraud and abuse prevention;

• authentication troubleshooting;

• system reliability;

• investigation of security incidents;

• technical troubleshooting; and

• applicable legal requirements.

Retention periods may also depend on the configuration and retention settings of the infrastructure providers used by Neutrien.

25.5 Subscription and Transaction Records

Certain subscription, transaction, accounting, or financial information may need to be retained after account deletion where reasonably necessary for:

• taxation;

• accounting;

• fraud prevention;

• dispute resolution;

• legal compliance; or

• other legitimate legal requirements.

25.6 Surveys

Where we conduct voluntary research surveys, identifiable survey responses will generally be retained for up to 6 months, unless:

• a different period is communicated for the relevant research activity;

• you request deletion where applicable; or

• another lawful reason requires or permits continued retention.

Aggregated or genuinely anonymized research information may be retained for longer.

25.7 Research Recruitment

Information concerning prospective research participants who are not selected will generally be deleted within 6 months, unless the individual has agreed to be considered for future research.

25.8 Interview Recordings and Transcripts

Where research interviews are recorded:

• recordings will generally be deleted within 90 days after the relevant research has been analyzed; and

• identifiable transcripts and research notes will generally be retained for up to 12 months,

unless another period is communicated in advance or a different period is reasonably necessary and lawful.

25.9 Support and Correspondence

General support correspondence may generally be retained for up to 24 months after the relevant matter is resolved, unless longer retention is reasonably necessary for legal, security, compliance, or dispute-resolution purposes.

25.10 Backups

Deleted information may remain temporarily in secure backups or technical systems until those backups are overwritten or rotated through normal technical processes.

We periodically review retained information and delete or anonymize information that is no longer reasonably necessary.

26. Cookies and Similar Technologies

The Neutrien website may use:

• cookies;

• local storage;

• scripts; and

• similar technologies.

26.1 Strictly Necessary Technologies

These technologies may be used where reasonably necessary for:

• website operation;

• security;

• fraud prevention;

• technical functionality;

• storing privacy preferences; and

• form submission.

Where permitted by law, strictly necessary technologies may operate without separate consent.

26.2 Analytics Technologies

Where used, analytics technologies may help us understand:

• website visits;

• referral sources;

• website interactions;

• performance; and

• technical problems.

Where applicable law requires consent for non-essential analytics technologies, we will request the required consent before activating them.

26.3 Advertising Technologies

Neutrien does not currently use personal health, meal, nutrition, or coaching information for third-party behavioral advertising.

If our use of website advertising or marketing technologies changes materially, we will update our disclosures and obtain consent where required.

26.4 Managing Your Choices

Where available, you can manage non-essential technologies using:

• our cookie banner;

• cookie settings; or

• your browser settings.

Blocking certain technologies may affect some website functionality.

27. Account and Data Deletion

You can delete your Neutrien account directly from within the Neutrien application.

Deleting your Neutrien account initiates deletion of personal data associated with your account, except information we are legally required or otherwise lawfully permitted to retain.

Information may, for example, need to be retained temporarily or for longer periods where necessary for:

• taxation;

• accounting;

• fraud prevention;

• security;

• legal obligations;

• dispute resolution; or

• legal claims.

If you cannot access your Neutrien account, you can contact:

contact@neutrien.io

for assistance with account or data deletion.

Deleting your Neutrien account does not necessarily cancel an active Apple App Store or Google Play subscription.

Subscriptions purchased through those platforms should also be managed through the applicable Apple or Google account.

28. Your Data-Protection Rights

Depending on applicable law and your circumstances, you may have rights concerning your personal data.

These may include the following.

28.1 Right of Access

You may have the right to request confirmation of whether we process your personal data and request access to that information.

28.2 Right to Rectification

You may have the right to ask us to correct inaccurate information or complete incomplete information.

28.3 Right to Erasure

You may have the right to request deletion of personal data in circumstances provided by applicable law.

The right to deletion is not absolute, and certain information may be retained where there is a valid legal reason.

28.4 Right to Restriction

You may have the right to ask us to restrict certain processing in circumstances provided by applicable law.

28.5 Right to Data Portability

Where applicable, you may have the right to receive certain personal data you provided in a structured, commonly used, machine-readable format.

28.6 Right to Object

Where processing is based on legitimate interests, you may have the right to object in circumstances provided by applicable law.

You may object to direct marketing at any time.

28.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

28.8 Rights Relating to Automated Processing

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

As described below, Neutrien does not currently use automated processing for this type of decision.

28.9 Right to Complain

Where applicable, you may lodge a complaint with a competent data-protection supervisory authority.

For VerticalRisers Oy in Finland, the relevant supervisory authority is the Office of the Data Protection Ombudsman.

You may also have the right to complain to another competent supervisory authority depending on where you live or work.

29. Exercising Your Rights

To make a privacy request, contact:

contact@neutrien.io

Please describe your request clearly and, where appropriate, identify the email address associated with your Neutrien account.

We may ask for additional information where reasonably necessary to:

• understand the request; and

• verify that the request relates to you.

We will not request more information than reasonably necessary for verification.

We will respond within the time required by applicable law.

Requests are generally handled without charge.

Where permitted by applicable law, we may charge a reasonable fee or decline to act on requests that are manifestly unfounded or excessive.

30. Automated Processing

Neutrien uses automated systems to provide functionality such as:

• nutrition calculations;

• meal analysis;

• food identification;

• personalized recommendations;

• AI-generated responses;

• coaching suggestions;

• meal-planning assistance; and

• adaptation of nutrition guidance.

These systems are intended to assist users with general nutrition and wellness.

Neutrien does not currently use solely automated processing to make decisions about users that produce legal effects or similarly significant effects.

AI-generated and automated outputs may not always be accurate and should be considered together with the user’s own judgment and circumstances.

31. Data Security

We use appropriate technical and organizational measures designed to protect personal data against risks including:

• unauthorized access;

• accidental loss;

• unlawful disclosure;

• alteration;

• misuse; and

• destruction.

Measures may include:

• authentication controls;

• access restrictions;

• encryption in transit;

• secure infrastructure;

• data minimization;

• service-provider assessment;

• monitoring;

• logging;

• backups; and

• procedures for handling security incidents.

Access to production systems and personal information is restricted to people and service providers who require access for legitimate operational purposes.

No online service, network, transmission method, or storage system can guarantee absolute security.

Where required by applicable law, we will notify the appropriate authority and affected individuals of qualifying personal-data breaches.

32. Age Requirement

Neutrien is intended exclusively for users who are 18 years of age or older.

You must be at least 18 years old to:

• create a Neutrien account;

• access Neutrien’s personalized functionality;

• use Neutrien’s AI-assisted features; or

• otherwise use the Neutrien service.

Users under 18 are not permitted to create or maintain a Neutrien account.

As part of onboarding or account creation, we may request information necessary to confirm that you meet this age requirement.

If you are under 18, you must not use Neutrien or provide personal data through the service.

If we become aware that an account is associated with a person under the age of 18, we may:

• restrict access to the account;

• suspend the account;

• terminate the account; and

• delete associated personal data,

subject to applicable legal obligations and legitimate retention requirements.

If you believe that a person under 18 has created or is using a Neutrien account, please contact:

contact@neutrien.io

33. Third-Party Websites and Services

Neutrien may contain links or connections to third-party:

• websites;

• services;

• stores;

• restaurants;

• products; or

• other external resources.

Independent third parties may process personal data according to their own privacy policies and terms.

This Privacy Policy does not govern independent third-party services that are not controlled by VerticalRisers Oy.

We encourage users to review the applicable privacy information before providing personal information directly to an external service.

34. Aggregated, Anonymized, and De-Identified Information

We may create aggregated, anonymized, or otherwise de-identified information from information processed through Neutrien.

Where information has been genuinely anonymized so that it no longer identifies an individual under applicable data-protection law, we may use and retain it for purposes such as:

• product development;

• statistical analysis;

• product-quality evaluation;

• understanding general product-use trends;

• internal research;

• business planning;

• internal reporting; and

• improving Neutrien.

We do not intentionally attempt to re-identify genuinely anonymized information.

Pseudonymized information remains personal data where it can still be linked to a particular individual using additional information, and we continue to treat it accordingly.

35. Changes to Our Systems and Service Providers

Neutrien is an evolving service.

We may from time to time:

• update our technical architecture;

• add or remove functionality;

• change databases or infrastructure;

• add, replace, or remove analytics systems;

• add, replace, or remove authentication providers;

• change subscription-management systems;

• change AI models;

• change AI service providers; or

• change other service providers.

A change to a particular vendor, model, technical system, or service provider does not necessarily change the underlying purpose for which personal data is processed.

We will update this Privacy Policy where appropriate to reflect material changes to our processing arrangements.

Where a change introduces a new or materially different purpose or type of processing, we will provide appropriate information.

Where applicable law or platform requirements require additional notice, consent, or permission before a new processing activity begins or personal data is shared with a new provider, we will provide that notice or obtain the required consent or permission before the relevant processing begins.

36. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to Neutrien;

• new or changed functionality;

• changes to AI models or AI providers;

• changes to other service providers or infrastructure;

• changes to processing practices;

• changes to our website;

• legal or regulatory developments;

• platform requirements; or

• organizational changes.

The current Privacy Policy will be made available through our website and, where appropriate, through Neutrien.

The Last Updated date at the beginning of this Privacy Policy indicates when it was most recently revised.

We encourage you to review the Privacy Policy periodically so that you remain informed about how Neutrien processes personal data.

Where a change materially affects the way personal data is processed, we will provide additional notice where required by applicable law.

Where applicable law or platform requirements require consent or permission before we begin a new processing activity or share personal data in a new way, we will obtain that consent or permission before the relevant processing begins.

Nothing in this section limits rights that you have under applicable data-protection law.

37. Contact Us

For questions, concerns, complaints, account-deletion assistance, or requests concerning personal data, contact:

VerticalRisers Oy Business ID: 3404761-6 Country: Finland

Email: contact@neutrien.io