Privacy policy

Last updated: 6 July 2026

1. Who is responsible

Baby Nutrition Lab is an independent, non-incorporated personal project run by a mum in Winterthur. The person responsible for this website and your data (the “controller” in legal terms) is:

• Fitore Ibraimi · Baby Nutrition Lab
• Winterthur, Switzerland
• Email: hello@babynutritionlab.ch
• Instagram: @baby.nutrition.lab

If you have any question about your data, the quickest way to reach a real person is simply to email us at the address above.

2. Which law applies

This website is run from Switzerland, so it follows the revised Swiss Federal Act on Data Protection (revDSG / nDSG), in force since 1 September 2023. Because many of our readers write in from the EU and the wider DACH region, we also honour the principles of the EU General Data Protection Regulation (GDPR) for visitors there. Where the two overlap, we simply apply whichever gives you more protection.

3. What we collect, and why

Newsletter and free plan sign-up

When you ask for the free plan or our emails, we collect your email address. That is the only field we need. The sign-up runs through Kit (formerly ConvertKit) with double opt-in: after you enter your email, Kit sends a confirmation message, and you are only added once you click to confirm. That step proves the request really came from you.

We use your email address to send you the guide you asked for and, from time to time, genuinely helpful baby-nutrition emails. We do not send daily blasts and we do not pass your address to advertisers. You can unsubscribe at any time using the link at the bottom of every email — no reason needed, no hard feelings.

The legal basis is your consent (revDSG; GDPR Art. 6(1)(a)), which you may withdraw whenever you like.

Personalized plan enquiries by email

If you write to us about a personalized plan, you may choose to share details such as your baby’s age, the foods already tried, or any reactions you have noticed. This information is provided voluntarily by you, in your own email. We treat it as confidential, use it only to prepare and discuss your plan, and never publish it. If you would like us to delete that correspondence afterwards, just ask.

Details you share about allergies or reactions count as health data — “particularly sensitive personal data” under the revDSG and a special category under GDPR Art. 9. We process it only with your explicit consent, which you give by choosing to send it to us, and you can withdraw that consent and have the correspondence deleted at any time.

Please remember: whatever you tell us helps us tailor educational suggestions, but it is never a substitute for your paediatrician, especially for anything medical, allergy-related, or about dosing.

Personalised plan orders (the paid CHF 59 plan)

When you order a personalised 3-week meal plan, you fill in a short intake form so we can build something that actually fits your baby. Depending on what you choose to share, that form collects your baby’s age, optionally their height and weight, the current feeding stage, the foods already introduced, any allergies or reactions, any medical notes you want us to know about, your dietary preferences, your kitchen setup, your priorities for the plan, and your email address so we can send it to you. Before you submit, you tick the consent boxes that let us use these details to prepare your plan.

The details you share about allergies, reactions or anything medical are health data — “particularly sensitive personal data” under the revDSG and a special category under GDPR Art. 9. We process it only with your explicit consent, which you give by ticking the consent box on the form, and we use it solely to create your plan. We never sell it, and we never use it for anything else.

The legal basis is the performance of our contract with you — you have ordered a plan and we need these details to deliver it (revDSG; GDPR Art. 6(1)(b)) — together with your explicit consent for the health-related parts (GDPR Art. 9(2)(a); revDSG). You can withdraw that consent at any time; just email us and we will stop processing and delete your order.

Every plan is reviewed and approved by a real person (that’s Fitore) before it reaches you — nothing is sent to you fully automatically. And, as always, a plan is educational and does not replace your paediatrician, especially for allergies or anything medical.

Server logs and analytics

Like almost every website, our host keeps standard server logs (for example the requesting IP address, the page requested, browser type and a timestamp) so the site can be delivered securely and problems can be diagnosed. We also use Cloudflare’s cookieless Web Analytics to see roughly how many people visit which pages. This is aggregate and privacy-friendly: it sets no tracking cookies and does not follow you around the web. We process this technical data on the basis of our legitimate interest in running a secure, functioning website (GDPR Art. 6(1)(f); revDSG). More on both providers in the next section.

4. The services that help us run the site

We keep the toolkit deliberately small. Each provider below only ever receives the data it needs to do its job.

Kit (ConvertKit) — email

Kit stores and sends our newsletter and free-plan emails. Your email address is held on Kit’s systems, whose servers are in the USA. This transfer to the US is covered by Kit’s data-processing agreement, including EU/Swiss standard contractual clauses (and the Swiss–US Data Privacy Framework where Kit is certified). You can read Kit’s own privacy policy at kit.com/privacy.

Cloudflare — DNS, CDN and Web Analytics

Cloudflare helps deliver the site quickly and safely and provides our cookieless Web Analytics. To do this it processes visitors’ IP addresses transiently. It sets no tracking cookies and does not build cross-site profiles of you. See Cloudflare’s privacy policy.

Hostpoint — web hosting

The website is hosted in Switzerland by Hostpoint. As part of hosting, standard server logs are generated as described above. Details are in Hostpoint’s data-protection statement.

Stripe — payments

When you buy a personalised plan, the payment runs through Stripe. Your card details are entered on Stripe’s own secure checkout and handled entirely by Stripe (a PCI-DSS certified payment provider) — we never see or store your full card number. Stripe receives only what it needs to take the payment. See Stripe’s privacy policy.

Anthropic (Claude API) — drafting your plan

To build the first draft of your plan, the intake details you provided — including any health notes such as allergies or medical information — are sent to Anthropic’s Claude API, which generates a draft that Fitore then reviews and approves. Only the intake information needed to write the plan is shared. Anthropic does not use data submitted through its API to train its models. Anthropic processes this data in the USA under its data-processing agreement, including EU/Swiss standard contractual clauses (and the EU–US / Swiss–US Data Privacy Framework where certified). See Anthropic’s privacy policy.

Resend — sending your plan

Resend sends the emails involved in your order — the message that delivers your finished plan and the internal review notifications. It receives only your email address and the message content needed to reach you. See Resend’s privacy policy.

Cloudflare (Workers + KV) — running the plan automation

Beyond the DNS and analytics above, Cloudflare also runs the automation behind the paid plans. Cloudflare Workers carry out the steps of preparing your plan, and your order (your intake details plus the generated plan) is stored transiently in Cloudflare Workers KV so we can review, approve and deliver it, and give you a private link to view it. It is kept only for a short while and then deleted, as described in section 6.

Fonts

The Fraunces and Karla typefaces are served directly from our own website, not from Google’s servers. That means no font request — and none of your data — is sent to Google when a page loads.

5. Cookies

This website itself sets no advertising or tracking cookies. Any cookies at all are strictly functional (the kind needed for the site to work). The one exception to be aware of: Kit’s embedded sign-up forms and email links may set cookies on Kit’s own domain when you interact with them — that is Kit’s technology, governed by Kit’s privacy policy linked above.

6. How long we keep things

We keep your email address for as long as you want our emails — that is, until you unsubscribe or ask us to delete it, at which point it is removed. Any personalized-plan correspondence is kept only as long as needed to help you, and we are happy to delete it on request. Server logs are kept for the short periods our host and Cloudflare use for security and maintenance.

For a paid personalised plan order, the order data — your intake details and the generated plan — is automatically deleted about 45 days after the order. If you would like it removed sooner, just ask and we will delete it straight away.

7. Your rights

Under the Swiss revDSG (and, for EU visitors, the GDPR) you have the right to:

• Access — ask what data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — ask us to delete your data.
• Restriction or objection — limit or object to certain processing.
• Data portability — receive your data in a common, machine-readable format.
• Withdraw consent at any time — for example by unsubscribing — without affecting anything done beforehand.

To exercise any of these, just email hello@babynutritionlab.ch and we will take care of it. There is no charge, and we will not make it awkward.

If you ever feel we have not handled your data properly, you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB), edoeb.admin.ch. If you live in the EU, you may instead contact your local data-protection supervisory authority. We would, of course, much rather you told us first so we can put things right.

8. Children

This website is written for parents and carers. We only ever process information about a baby that you, the parent or guardian, choose to give us; we never collect data from children directly, and nothing here is directed at children.

9. Changes to this policy

As the site grows we may update this policy — for example if we add a new tool. When we do, we will change the “Last updated” date at the top. The version with the most recent date, published here, is always the one that applies.