1. Introduction

Welcome to Meals Matter. We are committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, and store your data in compliance with the General Data Protection Regulation (GDPR).

2. Data Controller

The data controller for Meals Matter is:
Meals Matter
Email: josh.peterson@hey.com

3. Data We Collect & Legal Basis

We process your personal data based on the following legal grounds:

• Account Information (Email, Password): Performance of Contract. Necessary to create your account, secure it, and communicate with you.
• User Content (Meals, Meal Plans): Performance of Contract. This is the core functionality of the service you requested.
• Payment Information: Performance of Contract & Legitimate Interest. Processed by our payment provider to manage subscriptions and prevent fraud.
• Technical Data (IP Address, Browser Info): Legitimate Interest. Used for security, debugging, and ensuring the stability of our service.

4. Data Recipients (Processors)

We share data with trusted third-party service providers who assist us in operating our app:

• Stripe: Payment processing.
• Mailgun: Email delivery services.

Some of these providers may be located outside the European Economic Area (EEA), specifically in the United States. We ensure valid transfer mechanisms (such as the Data Privacy Framework or Standard Contractual Clauses) are in place to protect your data.

5. Your Rights

Under GDPR, you have the following rights regarding your data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can correct inaccurate or incomplete data in your account settings.
• Right to Erasure ("Right to be Forgotten"): You can delete your account at any time, which removes your data from our active systems.
• Right to Restrict Processing: You can ask us to limit how we use your data in certain scenarios.
• Right to Data Portability: You can request your data in a structured, commonly used format.
• Right to Object: You can object to processing based on legitimate interests.

To exercise any of these rights, please contact us at josh.peterson@hey.com.

6. Data Retention

We retain your data for as long as you have an active account. When you choose to delete your account, your personal data is immediately removed from our active databases. Backups may retain residual copies for a limited period before being overwritten.

7. Cookies

We use essential session cookies to keep you logged in and ensure the security of your account. These are strictly necessary for the website to function. By using our service, you agree to the use of these cookies.

8. Complaints

If you believe we have infringed your rights, you have the right to lodge a complaint with a supervisory authority in your country of residence.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes via email or through the application.