Privacy Notice

1. Data controller

The controller is Darina Atanasova, an individual established in Bulgaria, operating NUTRIGENOVIA — Integrative Health School.

Contact for questions and to exercise your rights: nutrigenoviasupport@gmail.com.

2. Data we process

• Account and authentication data — email address, account identifier, sign-in method (email or Google sign-in), sign-in timestamps.
• Certificate data — the confirmed name to be printed on the certificate and the stated gender, used solely to select the corresponding certificate template.
• Learning data — course enrolment, lesson progress, quiz results and the final assessment, unlocked resources, achievements.
• Order data — order and transaction identifiers, purchased product, amount, currency, status, date and refund status. We do not store card details.
• Certificates — unique identifier, issue date, course, the name on the certificate and the generated certificate file.
• Support communications — the content of the messages you send us.
• Newsletter subscription — email address, consent status and history, subscription and unsubscription timestamps.
• Technical security and reliability records — the minimum technical records needed to protect against abuse and to diagnose faults.

3. Purposes and legal bases

• Creating and maintaining your account and sign-in — performance of a contract.
• Providing paid course access and tracking progress — performance of a contract.
• Grading, issuing and verifying certificates — performance of a contract and our legitimate interest in reliable certification.
• Processing orders, payments, tax obligations and refunds — performance of a contract and legal obligation.
• Transactional emails about your account, purchase or certificate — performance of a contract.
• Newsletter and marketing messages — consent.
• Support and responding to enquiries — legitimate interest and performance of a contract.
• Security, fraud prevention and service stability — legitimate interest.

4. Gender and the name on your certificate

The gender you state is used exclusively to select the corresponding official certificate template and for grammatically correct wording. It is never used for profiling, advertising or analytics.

The confirmed name is printed on the certificate. You can change it in your profile before issuance; after issuance the name is locked so that verification remains reliable.

5. Public certificate verification

Every issued certificate has a public verification page reachable through a unique identifier and QR code.

The public page shows a limited data set: the name on the certificate, the course title, the issue date, the identifier and validity. It does not show your email, orders, quiz results or other account data.

Anyone holding the link or QR code can open the page. If you prefer not to share it, do not distribute the link.

6. Recipients and processors

We share personal data only with providers we actually use:

• Lovable and the associated platform infrastructure — hosting of the website and application services.
• Supabase — database, authentication and secure file storage within that platform infrastructure.
• Paddle.com — Merchant of Record, handling payment processing, invoicing, tax and refunds.
• Google — only where you choose Google sign-in.
• The transactional email provider used by the platform, to deliver account, purchase and certificate messages.
• The language model provider powering the Nutri educational assistant — it processes the question you send in order to generate an answer.
• Competent authorities where required by law.

7. International transfers

Some of our providers may process data outside the European Economic Area. Where that happens, the transfer relies on an adequacy decision or on standard contractual clauses.

8. Retention

We keep data only as long as necessary for the purposes it was collected for.

• Account and learning records — while the account exists and as long as needed to evidence course completion.
• Certificates and verification data — retained long term so verification remains valid.
• Order and payment records — for the period required by accounting and tax law.
• Newsletter consent records — for as long as needed to demonstrate lawful processing.
• Support communications — for as long as needed to handle the matter.

9. Your rights

Under applicable data protection law you have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You can exercise your rights at nutrigenoviasupport@gmail.com. We respond within one month.

You have the right to lodge a complaint with a supervisory authority — in Bulgaria, the Commission for Personal Data Protection — or with the authority where you reside.

Please note that deleting an account does not automatically erase an issued certificate or accounting records we are legally required to keep.

10. Security

We apply appropriate technical and organisational measures — encryption in transit, database-level access control, restricted private file storage and separation of administrative privileges.

11. Cookies

We use only storage technologies necessary for the site to work. Details are set out in the Cookie Policy.

12. Changes

We may update this notice. The current version is always published here with the date of the last update.