Privacy Policy
Last updated: July 2026
1. Data controller
The data controller is Norvani Holdings LLC, a limited liability company (LLC) established in the state of New Mexico (United States) with registration number 0008106355, located at 1209 Mountain Road Pl NE, Ste R, Albuquerque, New Mexico 87110, United States, owner of Cerogluten. In accordance with Article 27 of the GDPR, Norvani Holdings LLC has appointed Héctor Roselló as its representative in the European Union, with an address at C. Capitán Marcos García, 6, Bailén-Miraflores, 29007 Málaga (Spain). You can exercise your rights of access, correction and deletion, or direct any queries about data protection, by writing to [email protected].
2. Data we collect
Account data (email, name), location (if you enable it) to show you nearby places and your activity (favorites, reviews). If you authorize analytics, we also collect usage events without free text, such as the category searched or opening a listing. Our own events don't include search terms, review text, phone, name or email to Google Analytics or Microsoft Clarity. Before enabling Clarity we also configure strict masking and sensitive URL parameter protection in the project.
3. Legal basis and retention
We process the data necessary for your account and contributions to execute the service. Cookies, identity and full events from PostHog, Google Analytics and Microsoft Clarity are only enabled with your consent, which you can withdraw anytime. When a base tag activates after privacy checks, it receives the denied status first and may produce limited measurement without cookies depending on the provider. Security and error diagnostics with Sentry are based on our legitimate interest in keeping the service stable, with PII transmission disabled and sanitized URLs. We retain each category for as long as needed for its purpose and according to the retention configuration of each Cerogluten project.
4. Your rights
You can withdraw consent and request portability or deletion of your data anytime from Settings or by email.
5. Data processors
We rely on Supabase for account and service data; Brevo for sending transactional emails (password recovery, account notifications); PostHog Cloud EU for product analytics; Google Analytics 4 for aggregated measurement; Microsoft Clarity for heatmaps and session replay; Sentry EU for errors and performance; and Cloudflare for delivery, security and cookieless web analytics. Each integration uses a new, exclusive Cerogluten project and replay tools remain disabled until they pass privacy review. We don't sell your data or reuse accounts or infrastructure from other products.
6. Complaints
If you believe we haven't properly addressed your rights, you can file a complaint with the Spanish Data Protection Authority (www.aepd.es).