Privacy Policy
Last updated: 19 October 2026
1. Controller
Grythyttan Culinary Science & Innovation AB, reg. no. 556653-6818, Tavastgatan 35, 118 24 Stockholm, Sweden, is the controller of your personal data on gusto.science. Contact: support@gusto.science.
2. What we collect and why
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| E-mail address, password (hashed), display name, chosen role | Create and run your account | Contract |
| Pro status, subscription period, Stripe customer and session id | Give you Pro access and handle payments | Contract; legal obligation (bookkeeping) |
| Saved articles | The saved-articles feature | Contract |
| Questions you ask in Ask, and usage counts | Answer your question; enforce free and fair-use limits | Contract; legitimate interest (prevent abuse) |
| Which article, page and campaign link led to an upgrade or purchase (article id, test variant, UTM tags) | Understand which content and campaigns lead to subscriptions | Legitimate interest |
| Weekly digest e-mail address and preferences | Send the newsletter you signed up for | Consent; you can unsubscribe at any time |
| Support e-mails | Answer your questions | Legitimate interest |
We do not sell your data and do not use it for advertising profiles.
3. Usage measurement without cookies
We count anonymous events, such as an article card being shown or an "Unlock" button being clicked. Each event stores only the event type, the article, the page section, the test variant, and any campaign tags in the link you followed. It stores no user id, no IP address and no cookie, so it cannot be linked to you. We use it to improve which content we show to free users.
4. Cookies and local storage
- Login cookies (Supabase,
sb-*): keep you signed in. Strictly necessary. - Local storage in your browser: remembers your settings, such as role, library view, onboarding seen and saved state. It never leaves your device. Strictly necessary for the features you use.
- Purchase attribution (
gs_pending_attribution): stored only after you click an upgrade button. It keeps the article and campaign you came from for up to 7 days, so they can be attached to your purchase. - We use no advertising or third-party analytics cookies. If that changes, we will ask for your consent first and update this policy.
5. Processors
We use these providers to run the service. They process data only on our instructions.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, login, server functions | EU (Ireland) |
| Stripe | Payments, invoices, VAT | EU/USA |
| Cloudflare | Hosting, security, e-mail forwarding | Global |
| Anthropic | AI analyses and answers to Ask questions | USA |
| OpenAI | Text embeddings for search | USA |
| Brevo | Sending e-mail and the newsletter | EU (France) |
AI providers receive the text of your question and article data, but not your e-mail address or name.
6. Transfers outside the EU/EEA
Some providers are based in the USA. Transfers are protected by the EU–US Data Privacy Framework where the provider is certified, or by the EU Standard Contractual Clauses.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account data | Until you delete your account |
| Payment and invoice records | 7 years (Swedish Accounting Act) |
| Ask questions and usage counts | 12 months |
| Anonymous usage events | 24 months |
| Support e-mails | 24 months |
8. Your rights
You can ask for access to your data, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. You can withdraw consent, for example to the newsletter, at any time. E-mail support@gusto.science. We answer within one month.
9. Complaints
You can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or to the authority in your own EU country.
10. Changes
We will tell you about material changes by e-mail or in the service before they apply.