Privacy policy

Version 2.0 · effective from 18 October 2026

This policy explains which personal data we process when you use junai.life and buy from us. It also explains why we process it, how long we keep it, to whom we disclose it and what rights you have. Processing takes place in accordance with Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Controller

The controller of personal data is Junai, nutricionistični inženiring, d.o.o.:

address: Dunajska cesta 5, 1000 Ljubljana, Slovenia;
company registration number: 9808434000;
VAT ID: SI21743711;
e-mail: hi@junai.life;
telephone: +386 59 089 670.

We have not appointed a data protection officer. For all questions about data protection, write to us at hi@junai.life.

2. Which data we process, why and on what legal basis

Purpose	Data	Legal basis	Retention
Performing the order, delivery and payment	name, address, e-mail, telephone, contents of the order, payment method (card data is processed only by Stripe)	contract (Art. 6(1)(b))	during performance of the contract and until the expiry of the periods for complaints and claims, as a rule 4 years
Issuing invoices and accounting	invoice details; for businesses the name, company registration number and VAT ID	legal obligation (Art. 6(1)(c))	10 years after the end of the year in which the invoice was issued
My Junai account and subscription	login details, addresses, order history, subscription settings, Stripe payment token	contract	until the account is deleted, then as in the rows above
Withdrawal, complaint, refund	description, photographs, IBAN where necessary	contract and legal obligation	4 years after resolution
Customer support and chat	contents of messages, contact details	legitimate interest in replying to you (Art. 6(1)(f))	2 years after the last communication
Service messages (e-mail, SMS) about the order, subscription and delivery	e-mail, telephone	contract	during performance of the contract
Request for a review and publication of a review	e-mail, order, review, chosen name, country, photograph	legitimate interest (request); consent (publication of name, text and photograph)	until consent is withdrawn or deletion
News and marketing messages	e-mail, name, interests, response to messages	consent; for customers, legitimate interest to the extent permitted by electronic communications legislation (our own similar products, with the option to unsubscribe)	until you unsubscribe or withdraw consent
JunAI Match and JunAI Coach	your answers (which may also concern your state of health, pregnancy or breastfeeding, if you provide them), the recommendation result	consent when using the tool (Art. 6(1)(a) and Art. 9(2)(a))	unlinked results 180 days; results in the account until the account is deleted
Analytics, ad measurement and personalisation	device and browser identifiers, cookies, visit and purchase data	see the Cookie Policy	see the table in the Cookie Policy
Preventing misuse and security	IP address, device identifier, history of uncollected shipments	legitimate interest	up to 2 years
Establishing, exercising and defending legal claims	data needed for the dispute	legitimate interest	until the end of the dispute

The data for the order is a contractual requirement: without it we cannot carry out the order. You provide other data voluntarily.

After two uncollected cash-on-delivery shipments we may disable cash on delivery. At your request a person reviews this decision. Other payment methods remain available. We do not carry out any other automated decision-making with legal effects.

3. Recipients and processors

We disclose data only to the extent necessary for each purpose:

payments: Stripe (Stripe Payments Europe Ltd., Ireland);
delivery: Pošta Slovenije d.o.o. and Packeta (Zásilkovna s.r.o., Czech Republic) with partner delivery services;
warehousing and dispatch: a contracted warehouse in Slovenia;
invoices and accounting: Minimax (SAOP d.o.o., Slovenia) and an external accounting service;
service e-mails: Brevo (Sendinblue SAS, France);
SMS: SMSAPI;
marketing e-mails and automation: Klaviyo, Inc. (USA);
hosting, development, IT support and chatbot: Humanfrog d.o.o. (Slovenia);
analytics and advertising: Google (Google Analytics, Google Ads, Google Tag Manager), Meta Platforms (Facebook, Instagram), Microsoft (Clarity), Metricool;
JunAI Match and Coach and language features: OpenAI (USA);
application error monitoring: Sentry (Functional Software, Inc., USA);
public authorities, where required by law.

Transfers outside the EU/EEA: for recipients in the USA, the transfer is based on the European Commission adequacy decision (EU-US Data Privacy Framework), if the recipient is certified, and otherwise on standard contractual clauses. We will provide information on the safeguards on request.

4. Your rights

You have the right:

of access to your data;
to rectification;
to erasure;
to restriction of processing;
to data portability;
to object to processing based on legitimate interest, and at any time to object to processing for direct marketing;
to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before it.

Send your request to hi@junai.life. We reply within 1 month. In complex cases we may extend the period by up to 2 months. You unsubscribe from marketing messages with the link in every message.

5. Supervisory authority and complaint

Our only establishment in the EU is in Slovenia, so the lead supervisory authority for our processing is the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si). You can lodge a complaint with it or with the supervisory authority in the Member State where you reside. That authority cooperates with the Slovenian one.

For consumers in Ireland: you can also lodge a complaint with the Data Protection Commission (6 Pembroke Row, Dublin 2, D02 X963, www.dataprotection.ie), which will deal with you in English or Irish and cooperates with the Slovenian authority.

6. Security

For data security we use appropriate technical and organisational measures:

an encrypted connection (HTTPS);
restricted access to data;
secure payments through Stripe;
protected connections for sensitive actions.

7. Changes

We may update this policy. The current version is always published on this page. We will notify you of material changes.