Privacy Policy

Welcome to The Lively Three. We help you track plant-focused intake and turn your entries into personal insights and (opt-in) community benchmarks. You control what you share and can manage access and deletion in the app. This policy explains what we collect, how we use it, and your rights.

This Privacy Policy applies to users in Switzerland (CH), the European Union/EEA (EU), the United Kingdom (UK), and Canada (CA).

1) Controller (Who we are)

The Lively Three - powered by Beeqster GmbH.

Bühlstrasse 18, 8172 Niederglatt, Switzerland

2) EU & UK Representatives (GDPR / UK GDPR)

3) What data we collect

4) Required processing to provide the service

To operate The Lively Three and provide the features you request (food logging and your personal indicators), we must process certain personal data, including your account data, the entries you log, and the indicators derived from those entries. If you do not agree to this required processing, we cannot provide the service.

5) Optional processing via Data Contracts (opt-in)

In addition to the core service, we may offer optional features via Data Contracts. Data Contracts are contextual opt-ins that specify:

• who requests data
• what is requested
• what you receive (e.g., additional analytics or features)
• duration and how withdrawal works

Managing Data Contracts: The primary way to manage Data Contracts is in the app (Settings → Data Transparency). If you cannot access the app, you can contact us at privacy@thelivelythree.earth or use the Trust Center above.

Preventing “silent expansion”: If we introduce new optional processing (for example, offering new analytics or involving external research partners), we will do so via a new Data Contract that clearly explains scope, purpose, duration, and withdrawal.

6) How we use your data

We use personal data to:

• provide and operate the app and its core features
• generate your personal dashboards and indicators
• operate, secure, and improve the service
• respond to support requests
• (where enabled) measure and improve website performance and usability
• (if you opt in) enable optional features and any sharing described in a Data Contract

• Service communications: We may send emails necessary to provide the service (e.g., account verification, security notices, password reset, subscription status, and support responses).
• Marketing communications (if enabled): If we send newsletters or promotional messages, we will do so only where permitted by applicable law, and you can opt out at any time (e.g., via an unsubscribe link or in-app settings). Marketing preferences are separate from your use of the core service.
• No advertising targeting (in-app): We do not use your in-app consumption logs, body metrics, or derived indicators to target you with advertising.
• Website advertising measurement (cookie-based): If you opt in on our website, we may use marketing/advertising cookies and tags to measure campaign effectiveness and enable retargeting/audience features (see Section 11 and our Cookie Policy).
• We don’t combine in-app nutrition data with website advertising audiences

7) Legal bases (EU/EEA and UK users)

Where EU/EEA GDPR or UK GDPR applies, we rely on one or more of the following bases depending on the purpose:

• Contract (to provide the service you request)
• Legitimate interests (security, fraud prevention, service reliability and improvement, balanced against your rights)
• Consent (where required, e.g., optional Data Contracts and non-essential website cookies/tags for analytics and marketing)
• Legal obligation (where applicable)

8) Service providers, third parties, and disclosures

We do not sell your personal data.

9) Data storage, location, and transfers

Our primary database is hosted in Frankfurt, Germany (AWS eu-central-1) via Supabase.

Data sovereignty and transfers: We design the service to keep storage and primary processing within Switzerland and the EU/EEA where feasible. Where processing requires transfers outside Switzerland/EU/EEA (for example due to specific service providers or support operations), we apply appropriate safeguards required by applicable law.

Website analytics/marketing providers (e.g., Google/Meta) may process data outside Switzerland/EU/EEA, including the USA, where enabled and consented.

Safeguards: Where required, we use recognized transfer safeguards such as Standard Contractual Clauses (SCCs) or equivalent lawful mechanisms.

10) Retention and Delete Account (two options in-app)

We retain personal data only as long as needed for the purposes described above, unless longer retention is required by law or needed for security and dispute handling.

Operational retention (examples):

• Security and abuse prevention logs: retained for a limited period to protect the service and investigate misuse.
• Support communications: retained as needed to resolve issues and maintain an audit trail where appropriate.

Payment and transaction records: Where required for accounting, tax, and compliance purposes, we retain payment-related records for the period required by applicable law. Purchases are processed by Apple/Google, and we do not store full payment card details.

Request logs: We retain records of privacy requests and our responses (e.g., request type and timestamps) for a limited period to demonstrate compliance, prevent abuse, and maintain auditability.

Limited period: Where we refer to a “limited period,” this generally means months, not years, unless we must retain data longer to meet legal obligations or to establish, exercise, or defend legal claims.

TLT offers an in-app Delete Account flow with two scenarios:

Option A — Delete my account and keep only anonymous statistics (donation)

• We delete personal identifiers and remove all means of linking records back to you.
• We retain only truly anonymous consumption statistics to improve analytics and community insights.
• Once anonymised, the retained statistics cannot be linked back to you.

Option B — Delete my account and delete all my personal data

• We delete personal data associated with your account, including consumption logs and derived indicators to the extent they remain personal data.

When you delete your account, your data is removed from our active systems. It may persist in encrypted backups for up to 7 days before being overwritten.

11) Cookies & tracking (website only)

We use a cookie preference banner/settings to manage non-essential cookies.
Essential cookies are required for the website to function securely.
With your consent (where required), we may enable:

• Analytics cookies/tags via Google Tag Manager (GTM), including Google Analytics 4 (GA4), to understand how visitors use the website and to improve performance; and
• Marketing/advertising cookies/tags, including Google Ads conversion tracking and the Meta Pixel, to measure campaign effectiveness and enable retargeting/audience features.
• Marketing/advertising cookies may also be used to show you ads on other platforms and to measure the effectiveness of campaigns, where you have opted in.

You can withdraw consent at any time via the website cookie preference controls and/or your browser settings.

Where these tools process data outside Switzerland/EU/EEA (including the USA), we apply appropriate safeguards required by applicable law (e.g., Standard Contractual Clauses or equivalent mechanisms).

12) Security

We use reasonable technical and organisational measures designed to protect personal data (e.g., encryption in transit and at rest where supported, access controls, and monitoring).

Security practices (high level): We use encryption in transit (e.g., TLS) and access controls designed to limit access to authorized personnel only.

Future plan: employ distributed ledger technology (DLT) to support technically enforced fine-grained access rights, immutability of records, and stronger decentralization of control.

13) Your rights and choices

You can:

• access and correct much of your data in the app (e.g., Settings)
• manage optional Data Contracts in the app (e.g., Settings → Data Transparency)
• delete your account in-app (Option A or B, (e.g., Settings → Account)
• submit privacy requests (EU/UK): https://app.prighter.com/portal/thelivelythree-privacy
• contact us (all regions): privacy@thelivelythree.earth

Identity verification: We may need to verify your identity before fulfilling certain requests (especially access and deletion requests) to protect your data.

EU/EEA and UK users may also have additional rights depending on circumstances (including portability, restriction, and objection) and may log a complaint with their supervisory authority. Canadian users may raise concerns with the Office of the Privacy Commissioner of Canada if unresolved.

14) Changes to this policy

We will post updates here with a new “Last Updated” date. Important changes may be notified to registered users.