Privacy Policy

Version 1.1.1 — content locked 7 August 2026.

This Privacy Policy explains how Agdir Drift AS, a company registered in Norway under organisasjonsnummer [Norwegian organisasjonsnummer — awaiting CEO input] (Foretaksregisteret / Brønnøysundregistrene), with registered office at [Norwegian registered office — awaiting CEO input] ("Prelog", "we", "us", "our"), processes personal data of users of the Prelog service (https://prelog.app, the "Service").

We are the data controller for the processing described here. The Service is provided from within the European Economic Area (EEA) and is subject to the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") as it applies in Norway through the EEA Agreement and the Norwegian personopplysningsloven (Act relating to the processing of personal data).

Contact for anything in this policy — including data-subject requests: [email protected].

1. What data we process, why, and on what legal basis

You are never required to submit a photo. Body-weight logging is optional; the Service degrades gracefully without it. The eating-disorder self-declaration is optional; leaving it unanswered simply produces the same maintenance-only routing as answering "yes".

2. Health-related data notice (Article 9)

Body-weight measurements combined with height, sex, and age are treated as special-category "data concerning health" under GDPR Art. 9(1). The eating-disorder self-declaration is also health data. We rely on your explicit consent (Art. 9(2)(a)), given when you create an account and enter that information, and on necessity for the provision of a service you have requested. We do not use this data for any purpose beyond running the Service, and we do not share it with third parties other than the technical sub-processors named in §4.

The chat surface may contain health-adjacent content you type in (for example, training injuries or gastrointestinal symptoms in relation to food). We treat all chat content as potentially health-related for storage and access purposes.

Hard boundaries on how the eating-disorder flag is used (from duty-of-care policy v1.2.0):

1. What is actually collected. A single self-declared boolean at onboarding. We do not administer a clinical screening instrument (no SCOFF, EAT-26, or equivalent). We do not attempt to infer, detect, or diagnose an eating disorder from user behaviour.
2. What the flag is used for — exhaustively. Only to (a) route the allocator to maintenance-only mode (no deficit), and (b) trigger the "consult a professional" onboarding branch. Not used for advertising, targeting, profiling, ranking, model training, or any other purpose.
3. Sharing. Never shared with advertising networks, analytics vendors, data brokers, or insurers. Not sold. Not licensed.
4. No external escalation. BMI-based and rapid-loss check-in screens are displayed in-app only. Prelog does not contact you out-of-band, does not contact an emergency contact, and does not notify any clinical service or third party on the basis of these triggers.
5. Withdrawal. The ED flag can be toggled off in settings without deleting the account; the consequence is that the maintenance-only routing lifts, documented in the settings screen so the user consents knowingly.

3. What we do not do

• We do not sell personal data.
• We do not use personal data for advertising, retargeting, or cross-site tracking.
• We do not knowingly process data of children under 18.
• We do not share your identifiable data with anyone other than the sub-processors listed in §4, or when required by law.
• We do not train third-party AI models on your data. The language-model API tier we use (Anthropic) contractually excludes your prompts from training.

4. Sub-processors

The current sub-processor list is this page. Material changes will be posted at /legal/subprocessors-changelog and notified to active subscribers by email at least 30 days in advance where the change affects end-user personal data.

5. International transfers

Data primarily lives in the EEA (Hetzner Germany + PostHog EU cloud where configured). Where a sub-processor processes data outside the EEA (Anthropic, Cloudflare edge, Stripe US backend), we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) as the transfer mechanism, supplemented by the sub-processor's own DPA. Where an adequacy decision applies (currently the UK), we rely on that.

You can request a copy of the transfer mechanism used for any specific sub-processor at [email protected].

6. Retention

7. Your rights under GDPR

Where you are in the EEA, UK, or Switzerland you have the following rights concerning your personal data. Where local law grants additional rights, those apply too.

• Access (Art. 15) — receive a copy of your data. Self-serve via /api/export?format=json, or email [email protected].
• Rectification (Art. 16) — correct inaccurate data via the profile page; email otherwise.
• Erasure / "right to be forgotten" (Art. 17) — delete your account and associated data. Self-serve via Account → Delete my account, or email [email protected]. Legal-obligation retention (billing) survives erasure; all other data is deleted.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — JSON and CSV exports available in-app.
• Object to processing (Art. 21).
• Withdraw consent at any time (Art. 7(3)) — for anything processed on consent (analytics cookies, session replay, ED self-declaration). Withdrawal does not affect processing done before it.
• Complain to a supervisory authority — for Norway, this is Datatilsynet (datatilsynet.no). You may also complain to the supervisory authority of the EU/EEA member state of your habitual residence (GDPR Art. 77).

We respond to requests within 30 days (extendable by 60 days for complex requests with notice, per Art. 12(3)). No fee for reasonable requests; excessive or manifestly unfounded requests may attract a fee or be refused (Art. 12(5)).

8. Security

• Passwords stored using Argon2id / scrypt with per-user salt.
• All transport secured with TLS 1.3.
• Database on private-network Postgres at Hetzner Germany; no public ingress.
• Application deployment via signed commits from a private repository; CI/CD without persistent credentials.
• Backups encrypted at rest.
• Access to production data restricted to named individuals with two-factor authentication; audit-logged.

We follow a "least data, least access" posture and do not use user data in development or staging environments.

Breach notification. In the event of a personal-data breach that presents a risk to affected individuals, we will notify Datatilsynet within 72 hours (Art. 33) and notify affected users without undue delay where the risk is high (Art. 34).

9. Cookies and similar technologies

See the separate Cookie Policy for the full cookie inventory, categories, and how to change your consent.

You can withdraw consent to non-essential cookies at any time via the Cookie settings link in the site footer, or by clearing browser storage.

10. Automated decision-making and profiling

The Service applies rule-based safeguards described in §11 (duty-of-care lockout). This is an automated decision in the GDPR Art. 22 sense insofar as it can restrict what nutrition plan you receive. It has legal effects only in the limited sense of restricting product features. You have the right to obtain human review of the lockout state by emailing [email protected]; a member of the team will look at the underlying signals and confirm or override the lockout.

11. Duty-of-care safeguards (health data-safety notice)

Prelog applies a protective routing — maintenance-only plan, no calorie deficit — when any of the following is true: (a) the user's body mass index is 40 or above, (b) the user's body mass index is below 18.5 (with an additional in-app check-in screen below 17.0), (c) the user's logged weight has declined by more than 1.5 % of body weight per week, averaged over two consecutive four-week periods, or (d) the user's self-declared eating-disorder history is set to "yes". The minimum daily calorie value used by the allocator is max(sex_min, BMR) — the greater of a sex-based floor (1500 kcal male / 1200 kcal female) and the user's estimated basal metabolic rate (Mifflin–St Jeor). The maximum daily deficit is min(20 % × TDEE, 750 kcal/day).

The legal basis for processing weight, height, sex, age, and the eating-disorder self-declaration for these safeguards is your explicit consent to special-category health data (GDPR Art. 9(2)(a)), combined with necessity for the performance of the subscription contract you entered into with us (Art. 6(1)(b)). See §2 for the full Article 9 notice. You can withdraw the eating-disorder flag at any time in settings without lifting the other safeguards; the BMI and rapid-loss safeguards are applied whenever the underlying data is present because they are the minimum floor of the service we offer.

This is stored in code under src/lib/server/dutyOfCarePolicy.ts at policy version 1.2.0. See the Terms of Service §2 for the user-facing statement.

12. Children

The Service is not intended for people under 18. If we become aware that we have processed data of a child, we will delete the account.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes (new categories of data, new sub-processors touching personal data, materially longer retention, changes in legal basis) will be notified to registered users by email at least 30 days before they take effect.

14. Contact

• Privacy / DSAR: [email protected]
• General support: [email protected]
• Postal: Agdir Drift AS, [Norwegian registered office — awaiting CEO input]
• Supervisory authority: Datatilsynet, postboks 458 Sentrum, 0105 Oslo — datatilsynet.no