NemlAI — Terms & Conditions
Last updated: November 2026
Quick summary: NemlAI is a free, invite-only hobby project that predicts your next Nemlig.com grocery basket using your order history. By using the platform, you agree that it's provided as-is with no guarantees, that your Nemlig.com order data is stored and processed for predictions, and that the service may change or disappear at any time. Your Nemlig.com password is used during signup and re-authentication to capture a browser session — it is never stored.
På dansk: En dansk gennemgang af, hvilke data NemlAI gemmer, hvorfor og hvor længe, står under Privatliv og data. Hjælp og ofte stillede spørgsmål står under Hjælp.
1. What NemlAI Does
NemlAI is an ML-powered grocery replenishment tool for Nemlig.com, a Danish online grocery delivery service. It is a personal hobby project, not a commercial product, and is not affiliated with or endorsed by Nemlig.com.
Here's what the platform does:
- Predicts your next grocery basket — A machine learning model analyzes your complete Nemlig.com order history to predict what you'll want in your next order, including quantities. It learns patterns like purchase frequency, seasonality, and typical quantities.
- Generates a ready-to-use basket — The predicted items are assembled into a Nemlig.com basket URL. You click the link, review the basket on Nemlig.com, and check out.
- Learns from your feedback — The system compares its predictions against your actual Nemlig.com orders. Items that were suggested but not purchased become less likely to appear in future baskets.
- AI-powered item search (Generer kurv) — A freetext search feature lets you add items or request recipe ingredients (e.g., "stegt flæsk") and have them looked up in the Nemlig.com catalog. This is powered by an external AI workflow (Dify). A previous chat interface has been removed.
- Household sharing — Multiple users can share a household, combining their order histories for better predictions. Each household gets an invite code for adding members.
- Order history sync — The platform periodically fetches your order history from Nemlig.com to keep predictions up to date.
- Push notifications — Optional browser push notifications for basket-related updates.
- CLI & SDK — A published command-line tool (
nemlai) for power users who prefer terminal access.
2. Data Handling
This section describes exactly what data NemlAI collects, where it's stored, how it's processed, and what third parties are involved. All claims here are based on what the code actually does.
2.1 Data We Collect
| Data |
What exactly |
Why |
| Account info |
Your name, email address, display name |
Account creation and identification |
| NemlAI app password |
The password you choose when creating your NemlAI account |
Stored as a hashed credential in Supabase Auth (the authentication provider). This is separate from your Nemlig.com password. |
| Nemlig.com password |
Entered during signup and re-authentication |
Used to log into Nemlig.com via a headless browser to capture session cookies. The password is never stored — it is used for the browser login, then discarded from memory. This also happens when you re-authenticate (e.g., via the "Refresh Orders" page). |
| Nemlig.com session cookies |
Browser cookies from your Nemlig.com login |
Stored in our database and on the server filesystem so the platform can fetch your orders and prepare baskets on your behalf. These expire and need periodic renewal. |
| Order history |
Your complete Nemlig.com order history — order dates, items, quantities, prices, discounts, and the raw order payloads from Nemlig.com (stored as JSON) |
This is the core data the ML model uses to predict your next basket. Raw payloads may include your Nemlig account email and debtor ID. |
| Product catalog data |
Product names, prices, categories, stock status from Nemlig.com |
Used for product search, availability checking, and finding substitutes for out-of-stock items. |
| Prediction data |
Which items were predicted, quantities, and whether predicted items were actually purchased |
Used to improve future predictions: suggestions are compared against your actual orders. |
| Preferences |
Dietary preferences, product exclusions, brand preferences (if you set them) |
Used to filter and personalize predictions. Also includes calculated preferences derived from your purchase patterns (e.g., organic product ratio). |
| Household membership |
Which household you belong to, invite codes |
Used for the multi-user household feature. |
| Beta invite code usage |
Which email addresses used which invite codes |
Tracked for invite code management. Stored in the database. |
| Push notification subscription |
Browser push endpoint URL, encryption keys, user agent |
Only if you opt in to push notifications. Stored in the database and used to send you notifications. |
| Other shops (optional) |
Session tokens and receipts/orders from Bilka, føtex and BilkaToGo, if you link them. Passwords are used for the login only and never stored. |
Receipts improve predictions; the BilkaToGo session lets you send the basket to your BilkaToGo cart. |
| Security/activity log |
Events such as signup, login, password change and account deletion, with email, IP address and user agent |
Abuse detection and debugging. There is currently no automatic expiry. |
| Feedback |
What you write in "Giv feedback", the page path, and your display name (or the contact email you enter when not logged in) |
Bug fixing. Feedback is also copied to a private GitHub issue tracker (message, page path, display name, household ID). |
2.2 Where Data Is Stored
- Database: Supabase (hosted PostgreSQL). All user data, order history, predictions, preferences, push subscriptions, and Nemlig session cookies are stored here. The database uses Row Level Security (RLS) to scope most data access to your own household. Some data (product catalog, household invite codes for join flows) is readable more broadly by design.
- Server filesystem: A self-hosted Raspberry Pi 5 running in a homelab, behind a Cloudflare Tunnel. The server runs the FastAPI application, ML model, and headless browser automation. Nemlig.com session cookies and tokens are also cached on the server's local filesystem (
~/.cache/nemligbot/session/) with restricted file permissions.
- Your browser: A session cookie (
nemlai_session, httpOnly, 7-day expiry), a cookie consent preference cookie (cc_cookie, 182-day expiry), and optionally your household ID in localStorage.
2.3 Third-Party Services
NemlAI integrates with the following external services. Your data may be transmitted to or processed by them:
| Service |
What it does |
Data involved |
| Nemlig.com |
The grocery platform. NemlAI logs into your account (via headless browser) to fetch order history and prepare baskets. |
Your Nemlig.com session cookies, order history, product data. NemlAI accesses Nemlig.com on your behalf using your captured session. |
| Supabase |
Cloud-hosted PostgreSQL database and authentication provider. |
All stored user data (accounts, orders, predictions, preferences). Supabase Auth handles email/password authentication for your NemlAI account. |
| Cloudflare |
DNS, TLS encryption, CDN caching, DDoS protection, and traffic tunneling. All traffic to NemlAI passes through Cloudflare. |
Your IP address and request metadata are visible to Cloudflare as part of normal traffic routing. Cloudflare caches static assets (CSS, JS, fonts). |
| Google Analytics 4 (via Google Tag Manager) |
Website usage analytics. Opt-in only — analytics scripts are completely blocked until you explicitly accept analytics cookies via the cookie consent banner. No tracking occurs without your consent. If you accept, GA4 receives page views and usage events. Your household ID is SHA-256 hashed before being sent — no raw identifiers reach Google. If you revoke consent, GA cookies are automatically deleted. |
Page views, usage events, hashed household ID (only with explicit consent). |
| Google Fonts |
The Outfit font is loaded from Google's font CDN (fonts.googleapis.com). |
Your browser makes requests to Google's servers to load fonts. Google's standard font privacy policy applies. |
| Dify |
AI workflow platform powering the Generer kurv item/recipe search feature. |
Your freetext search queries and household ID are sent to the Dify API for AI-powered product matching. The CLI interface may also send your user ID. Dify processes queries using OpenAI and Anthropic language models. Dify's own data retention policies apply to these queries. |
| GitHub |
Private issue tracker for feedback. |
Your feedback message, page path, display name and household ID. |
| Product Symplify API |
A separate API service for real-time product information (prices, campaigns, stock status). |
Product queries with product identifiers. No user-specific data is sent. |
2.4 Data We Do NOT Collect
- Your Nemlig.com password is never stored. It is used during signup and re-authentication (e.g., "Refresh Orders") to perform a browser login, then immediately discarded from memory.
- No payment information. NemlAI never handles payments — all purchases happen directly on Nemlig.com.
- No ad tracking. Google Analytics is opt-in only, and ad-related consent categories (
ad_storage, ad_user_data, ad_personalization) are permanently denied. No data is shared for advertising purposes.
2.5 Data Retention
- Order history and predictions: Retained indefinitely while the household exists. This data is needed for the ML model to work.
- Nemlig.com session cookies: Stored until they expire naturally (hours to days) or until you re-authenticate. Cached copies on the server filesystem are also overwritten on re-authentication.
- Account data: When you delete your account:
- If you are the last member of your household, the household and all associated data (orders, predictions, preferences, sessions, achievements) are deleted via database cascade.
- If other members remain in your household, your user record is removed but the shared household data (order history, predictions) is retained for the remaining members. Note: push notification subscriptions linked to your account are orphaned (not automatically deleted) — your browser may continue to receive household notifications unless you unsubscribe first.
- Your Supabase Auth account is always deleted.
- Analytics data: Governed by Google Analytics retention settings (if you consented to analytics cookies).
- Cookie consent preferences: 182 days (6 months), after which you'll be asked again.
- Session cookies: 7-day expiry. You'll need to log in again after that.
- Server-side session files: Cached Nemlig.com session cookies and tokens on the server filesystem are not automatically deleted when you delete your account. These files persist until overwritten by a future authentication event or manually removed by the operator.
2.6 Cookies
| Cookie |
Purpose |
Type |
Expiry |
nemlai_session |
Your login session (httpOnly, secure) |
Necessary |
7 days |
cc_cookie |
Your cookie consent preferences |
Necessary |
182 days |
nemlai_csrf |
CSRF protection (httpOnly, secure) |
Necessary |
Session |
_ga |
Google Analytics user identifier |
Analytics (opt-in) |
2 years |
_gid |
Google Analytics session identifier |
Analytics (opt-in) |
24 hours |
Analytics cookies are only set if you explicitly accept them. You can change your cookie preferences at any time via the "Cookie-indstillinger" button at the bottom of any page.
2.7 AI Assistants (MCP)
På dansk: Samme regler står på dansk under Privatliv og data → MCP-forbindelser.
You can use NemlAI from your own AI assistant (for example Claude or ChatGPT) through NemlAI's MCP server. How to connect is described on the AI agents page.
- How access is given: the assistant sends you to NemlAI, where you log in and press "Giv adgang" (Allow) on NemlAI's consent page. The assistant then gets an access token issued by our login provider, Supabase; NemlAI does not store that token. Command-line tools and scripts can instead use an API token you create with
nemlai login; NemlAI stores only a hash of it.
- What the assistant can do: use NemlAI's tools on your account: read your orders, suggestions, basket, spending, offers and settings; change your basket, settings, preferences and exclusions; fetch new orders with the shop login you already linked; read your cart and delivery times at the shop; send feedback in your name when you ask; export a copy of your data; and, when you say yes, put your basket in your own cart at Nemlig.com or BilkaToGo.
- What it cannot do: pay or check out, book a delivery time, change your password, delete your account, or link a shop. Those need a password or happen on the shop's own site, and are done only by you, in NemlAI or at the shop.
- Who sees what: the assistant and its provider see the data you ask it to fetch. That happens on their terms, not ours.
- What we log: for each call the server writes one log line with your user ID, the tool's name, how long it took, whether it succeeded, and the assistant's name. The access token and what the assistant sends (for example a search text) are not logged.
- Ending access: remove NemlAI in the assistant's own settings. An API token is revoked with
nemlai logout. There is no button in NemlAI yet to revoke an assistant's access; write to milops@milops.org to have it closed completely. If you delete your NemlAI account, the access stops working.
3. No Warranty / As-Is Disclaimer
NemlAI is provided "as is" and "as available", without any warranty of any kind, express or implied.
In plain language:
- No guarantee it works correctly. The ML predictions are estimates based on your history — they won't always be right. The platform may suggest items you don't want or miss items you do.
- No guarantee it's available. The service runs on a single Raspberry Pi in someone's home. It may go down for maintenance, power outages, hardware failures, or simply because the maintainer is on holiday.
- No guarantee it's secure. While reasonable security measures are in place (HTTPS, authentication, rate limiting, CSRF protection, CSP headers), this is a hobby project maintained by a small team. It has not undergone professional third-party security certification.
- No guarantee of accuracy. Product prices, availability, and other data from Nemlig.com may be outdated or incorrect.
- No guarantee of compatibility. The platform is primarily tested on modern browsers and may not work on all devices or configurations.
4. Limitation of Liability
The operator of NemlAI accepts no responsibility for:
- Data loss or corruption — including loss of order history, predictions, preferences, or account data.
- Service interruptions — including downtime, slow performance, or complete unavailability.
- Bugs and errors — including incorrect predictions, wrong product suggestions, broken basket URLs, or any other software defects.
- Security incidents — including unauthorized access to your data, data breaches, or any consequences thereof.
- Financial impact — including incorrect grocery orders, unexpected charges on Nemlig.com, or any costs resulting from using the platform.
- Nemlig.com account issues — including session problems, account lockouts, or any other issues with your Nemlig.com account that may arise from NemlAI's automated access.
- Third-party service failures — including issues with Supabase, Cloudflare, Google Analytics, Dify, or any other integrated service.
- Any other damages — whether direct, indirect, incidental, consequential, or otherwise, arising from your use of or inability to use NemlAI.
NemlAI is a free hobby project. You use it at your own risk.
5. Beta Notice
NemlAI is in early development (beta). This means:
- Features may change without notice. Things that work today may work differently tomorrow, or may be removed entirely.
- Data may be wiped at any time. Database resets, schema migrations, or infrastructure changes may result in loss of your stored data, including order history and predictions.
- Bugs are expected. You will encounter rough edges, broken features, and unexpected behavior. That's normal for beta software.
- The platform may be discontinued. As a hobby project, there is no commitment to long-term maintenance or availability. It may be shut down at any time.
- Breaking changes happen. API endpoints, CLI commands, and SDK interfaces may change without backward compatibility.
If you encounter issues, you're welcome to report them, but there is no guaranteed response time or fix timeline.
6. Account & Access
- Invite only. NemlAI is a closed beta. You need a valid beta invite code to create an account. Invite codes are distributed manually by the operator.
- Access can be revoked. Your account and access may be suspended or terminated at any time, for any reason, without prior notice. This includes (but is not limited to) abuse, excessive usage, or simply because the operator decides to reduce the user base.
- One household per Nemlig account. Your Nemlig.com account should only be linked to one NemlAI household.
- Shared households. If you join a household with other users, all members share access to the combined order history and predictions. Only join households with people you trust.
- Account deletion. You can delete your account through the Settings page. If you are the last member of your household, all associated data (orders, predictions, preferences) is deleted. If other household members remain, the shared data is retained for them.
7. User Responsibilities
By using NemlAI, you agree to:
- Not rely on the platform for anything critical. NemlAI is a convenience tool, not an essential service. Do not depend on it as your sole method of grocery shopping.
- Not upload sensitive personal data. Beyond what's required for the service to function (Nemlig account, name, email), do not store sensitive information like government IDs, financial details, medical information, or passwords in any free-text fields (preferences, notes, search queries).
- Keep your Nemlig.com credentials secure. NemlAI accesses Nemlig.com on your behalf. If you suspect your session has been compromised, change your Nemlig.com password immediately.
- Review baskets before checkout. Always review the generated basket on Nemlig.com before completing a purchase. The AI predictions are not perfect, and you are responsible for what you order.
- Use the platform reasonably. Do not attempt to abuse the service, overload the server, or circumvent access controls.
- Understand the AI limitations. The AI-powered search and ML predictions are automated systems. They can make mistakes, misunderstand requests, or produce unexpected results. Use your own judgment.
8. Changes to These Terms
- These terms may be updated at any time, without prior notice.
- The "Last updated" date at the top of this document indicates when changes were last made.
- Continued use of NemlAI after changes are posted constitutes acceptance of the updated terms.
- If a change is significant (e.g., new third-party data sharing), reasonable effort will be made to notify active users — but this is not guaranteed.
9. Contact
If you have questions about these terms or the platform, reach out to:
Email: milops@milops.org
*NemlAI is a personal hobby project created by Simon Miller. It is not a commercial product, has no formal business entity behind it, and is maintained on a best-effort basis.*