thenutritionistthenutritionist

Data Processing Agreement (DPA)

Version v1-2026-05.

thenutritionist SAS (the data processor) processes personal data entrusted by the professional (the data controller) under the following terms.

Sub-processors

  • OVHcloud: HDS hosting, France
  • Brevo: transactional emails, France
  • Mistral AI: sovereign AI, EU (input anonymization)
  • Stripe: subscription payment, US (payment data only)

Duration and end of contract

For the duration of the subscription. At the end: data returned within 30 days then permanently deleted.

Security

TLS 1.3 encryption in transit, AES-256 at rest. Password hashing with Argon2id. Automated tenancy tests.