Privacy Policy.

Vital Plus is a personal nutrition and performance coaching service operating from Sofia, Bulgaria. We take privacy seriously because the data you share with us — your weight, body composition, eating habits, medical context — is among the most personal information anyone can hold. This policy explains what we collect, why, and the controls you have over it.

01 · IdentityWho we are

Kristian Petrov, an individual based in the Republic of Bulgaria trading as Vital Plus (the "Company", "we", "us"), is the data controller for this service.

• Based in: Велинград, Bulgaria
• Data Protection contact: vitalplus@vitalpluss.com
• For any privacy or data request, email the address above. We respond within 5 business days.

02 · ScopeData we collect

When you visit our public site

• Technical data: IP address (anonymised), browser type, device type, pages viewed, referring URL
• Performance data via Vercel Speed Insights — Core Web Vitals only, no personal identifiers
• Language and theme preferences stored locally in your browser

When you book an intake call

• First name, last name, phone number
• The primary goal you select (e.g. "lean down", "build muscle")

When you become a member (subscribe)

• Account: email, password (hashed via Supabase — we never see the plain password), display name
• Profile: height, weight, age, gender, dietary preferences
• Health journal: weekly check-ins, body composition entries, mood / energy / hunger logs, meal logs
• Coaching content: messages you send to coaches, photos you upload, files you share
• Meal photos: if you log a meal by photo, the image is stored privately and analysed by an AI service (Anthropic) to estimate calories and macronutrients. The photo is visible to you and your assigned coach and is used only to provide the coaching service. You can delete a logged meal, including its photo, at any time.
• Payment: handled by Paddle (we receive a payment confirmation token only — never your card number)

03 · PurposeWhy we collect it

1. To deliver the coaching service you're paying for (meal plans, check-ins, coach replies)
2. To process subscription payments and prevent fraud
3. To improve the site's speed and usability (aggregated, anonymous)
4. To send you essential transactional emails (receipts, password resets, plan changes)
5. To respond to your enquiries and support requests
6. To comply with our legal and tax obligations under Bulgarian and EU law

04 · GDPRLegal basis

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Contract — to deliver the coaching service you've subscribed to
• Consent — for optional features (newsletter, marketing emails) — you can withdraw consent at any time
• Legal obligation — to keep tax and financial records as required by Bulgarian law
• Legitimate interest — to keep the site secure, prevent fraud, and improve performance

05 · Third partiesWho we share it with

We share only what's strictly necessary to run the service. We never sell your data. Period.

• Paddle.com Market Ltd — acts as our Merchant of Record and payment processor for all subscription payments. Paddle handles card processing, fraud detection, tax calculation and remittance, and chargebacks. When you subscribe, your payment information (card, Apple Pay, Google Pay) is collected directly by Paddle — never by us. See Paddle's Privacy Notice.
• Supabase Inc. (EU-Frankfurt region) — database & authentication. Your account data (email, hashed password, profile fields) lives here. See Supabase Privacy Policy.
• Vercel Inc. — site hosting and privacy-preserving performance analytics (Speed Insights). Aggregated Core Web Vitals only — no personal identifiers, no cross-site tracking. See Vercel Privacy Policy.
• Google LLC — Google Fonts (webfont delivery only). We do not embed Google Analytics, Google Ads, or reCAPTCHA.
• Anthropic PBC — AI meal-photo analysis. When you log a meal by photo, the image is sent to Anthropic's Claude API to estimate calories and macronutrients. It is processed only to return that estimate and is not used to train AI models. See Anthropic Privacy Policy.

We do not use Google Analytics, Facebook / Meta Pixel, TikTok Pixel, Hotjar, or any advertising trackers. We never sell, rent, or license your personal data to third parties.

06 · CookiesCookies & local storage

We use only the cookies and local-storage items that are strictly necessary to run the service. We do not use marketing cookies, advertising trackers, or cross-site profiling.

Strictly necessary (no consent required under EU ePrivacy law)

• ml-lang — remembers your language choice (EN / BG). First-party, localStorage.
• ml-theme — remembers your light/dark theme preference. First-party, localStorage.
• Supabase auth tokens — keeps you signed in to the member portal. First-party, HTTP-only cookie set by Supabase.

During checkout only

• Paddle sets a small number of first-party cookies when its checkout overlay opens (fraud prevention, session state). See Paddle's Cookie Notice. These are only loaded when you click Subscribe.

Analytics (privacy-preserving)

• Vercel Speed Insights — first-party, cookieless-by-default, anonymous Core Web Vitals only (LCP, FCP, CLS, INP). No personal identifiers.

You can clear all cookies and localStorage in your browser settings at any time — the site continues to work, you just lose your preferences and get signed out of the portal.

07 · RetentionHow long we keep it

• Account data: while your account is active, plus 30 days after deletion request
• Payment records: 10 years (required by Bulgarian tax law)
• Health journal entries: retained until you delete them, or up to 30 days after account closure
• Anonymous analytics: 12 months

08 · Your rightsWhat you can ask for

Under GDPR you have the right to:

• Access — request a copy of all data we hold on you
• Rectification — correct anything inaccurate
• Erasure — delete your account and all associated data (see retention above for legal exceptions)
• Portability — export your data in a machine-readable format
• Restriction — ask us to pause processing while a dispute is resolved
• Objection — opt out of any processing based on legitimate interest
• Withdraw consent — for anything based on consent (e.g. marketing emails)
• Complain — to the Bulgarian Commission for Personal Data Protection (КЗЛД) at cpdp.bg

To exercise any right, email vitalplus@vitalpluss.com. We respond within 5 business days and act within 30 days.

09 · SecurityHow we protect it

• All traffic is encrypted in transit (HTTPS / TLS 1.3)
• All data is encrypted at rest (Supabase managed encryption)
• Passwords are hashed with industry-standard algorithms — we never store or see them in plain text
• Access to production data is limited to the founder and a small audited list of coaches under NDA
• We undergo annual security reviews and patch dependencies weekly

10 · AgeChildren

Vital Plus is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please contact us and we'll delete their data immediately.

11 · TransfersInternational transfers

Your data is stored on Supabase's EU servers (Frankfurt). Vercel may serve cached static content from data centres worldwide — these contain only public HTML/CSS/JS, never personal data. Paddle processes payments as merchant of record. We do not transfer personal data outside the European Economic Area without GDPR-compliant safeguards.

12 · UpdatesChanges to this policy

If we make material changes, we'll email all active members and update the "Last updated" date at the top of this page. Continued use of the service after a change constitutes acceptance.

13 · ContactGet in touch

Privacy questions, data requests, complaints — anything:

• Email: vitalplus@vitalpluss.com
• Post: Vital Plus (Kristian Petrov), Велинград, Bulgaria