Privacy notice

Who is responsible

Nutella Index is run by a private individual, not a company. That person is the data controller and can be reached at info.nutellaindex@gmail.com. There is no data protection officer: the project is too small to require one.

Why we collect it, and on what basis

The lawful basis for publishing observations is legitimate interest: running a public, comparable price index. Reviewing submissions and preventing abuse rests on the same basis. Your email address is used only to contact you about your own submission.

You can object to processing based on legitimate interest at any time — see "Your rights" below.

What we publish, and under whose name

A published observation shows the country, the date, the package weight, the local price and currency, the price per 100 g in euro, whether the price was a promotion, the store or retailer if you gave one, and the photo.

Your name appears next to it only if you chose "Publish my name" on the form. If you chose "Publish anonymously", the observation is credited to "Anonymous User" and your name is stored but never displayed. Your email address is never published in either case.

The city you enter is not shown on the site today. It is kept so a moderator can sanity-check the observation.

Photos

By uploading a photo you confirm you are entitled to do so and you grant the licence described in the legal notice.

Photos are re-encoded on upload. That removes all embedded metadata, including EXIF and GPS coordinates, before anything is stored — the original file is never kept, only resized copies at three widths. We ask you not to photograph faces, receipts, payment cards or other personal details, and a moderator can remove an image without deleting the underlying observation.

Location

We never ask for or record your device location. The browser geolocation API is disabled site-wide by a Permissions-Policy header, so the site cannot request it even by accident.

The coordinates behind the map are country centre points, resolved once per country from Mapbox geocoding and stored. They describe a country, not you and not a shop.

Cookies, analytics and third-party content

The site sets no advertising or profiling cookies, and there is no Google Analytics, ad pixel or fingerprinting script. Three technologies do process data:

Whether this narrow set requires a consent banner under Italian and EU rules is under legal review. Until that review concludes, the site ships this notice and no banner, and no new tracker will be added in the meantime. If the answer is that consent is required, a banner and a persistent "Cookie settings" control will be added and this notice updated.

• Vercel Analytics — aggregate page-view counts. Cookieless; it does not store an identifier on your device.
• First-party page-view logging — the page path, a truncated user-agent string and a timestamp, written to our own database. No cookie, no identifier, no IP address stored. When a search returns nothing we also store the search text, truncated, so we can see which data is missing; it is not linked to you, because we keep no identifier. On one visit in ten we also record how long the page took to load and respond: numbers only, with no identifier attached.
• Mapbox GL JS — loads only on the map page, because the map cannot work without it. Your IP address reaches Mapbox as part of requesting map tiles.

Security and abuse prevention

Submission and correction endpoints apply a per-IP rate limit. Those counters live in server memory, are never written to the database, and disappear when the server restarts. Uploaded images are validated by inspecting the actual file signature rather than trusting what the browser claims.

Submission photos are held in a private storage bucket. While a submission is under review its photo is readable only through short-lived signed links generated for a moderator. Once the observation is published, its photo becomes publicly visible on the observation page at a stable address: it is the evidence behind the price, and we say so at submission time. Photos from rejected or still-pending submissions are reachable from no public address.

Automated decisions

There are none. No profiling, no automated decision-making with legal effect, and no automatic text extraction from your photo — every submission is reviewed by a person before it is published.

Changes to this notice

If this notice changes materially, the date at the top changes with it. Substantive changes affecting how contributions are handled will be described on the page rather than made silently.

What the form collects

Every field on the contribution form, whether it is required, and where it ends up. Optional fields can be left blank and the submission still goes through.

How long we keep it

Who processes the data

These are every third party involved in running the site. Transfers outside the EEA rely on the European Commission's standard contractual clauses.

Fonts are self-hosted at build time, so loading a page sends nothing to Google. Exchange rates come from the European Central Bank via a server-side call that carries no user data.

Your rights

You can ask for access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interest. Write to info.nutellaindex@gmail.com and say which submission you mean — quoting the reference from the confirmation page is the fastest route. We answer within one month. Withdrawing your name from a published observation is always possible: the observation stays, the attribution becomes anonymous.

If you are not satisfied with how a request was handled, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority where you live.

Legal notice