Privacy Policy of MenuMagic

1. Data Controller

The data controller for personal data is MenuMagic. For any questions or requests regarding this policy, you can contact us at the email address: support@menumagic.ai.

2. Data Collected

MenuMagic collects only the personal data necessary to provide and improve our service. The categories of data collected include:

• Registration Data: Information provided by the user during registration, such as name, email address, and user image.
• Usage Data: Information relating to the user's interaction with our application, including logins, preferred settings, browsing activities, and dietary preferences.
• Technical Data: Technical information such as IP addresses, browser type, and operating system, collected to improve the functionality and security of the application.
• Health and Nutrition Data: Information provided voluntarily by the user when using the food diary and calorie tracking features, such as sex, date of birth, height, body weight, activity level, weight goals, and logged foods.

3. Purpose and Legal Basis for Processing

We use users' personal data solely for the following purposes:

• Provision of Service: To enable the creation of personalized meal plans and shopping lists.
• Account Management: To administer the account and manage access to the service, including customer support.
• Service Analysis and Improvement: To enhance the user experience of MenuMagic and optimize our features.
• Marketing Purposes: To send marketing communications, such as informational emails about special offers, new features, or discounts. Users can revoke their consent to receive such communications at any time.
• Compliance with Legal Obligations: When required, to comply with applicable legal obligations.
• Preventing Misuse of the Free Trial: To check that the free trial is used only once per person, also after an account is deleted.

4. Data Retention

Users' personal data is retained only for as long as necessary for the purposes for which it was collected and in accordance with applicable law.

• Account Data (such as name, email address, meal plans, recipes, shopping lists, food diary and preferences): kept while the account exists and deleted within 7 days of the account being deleted.
• Payment and Accounting Records (such as amounts, dates, VAT and invoices): kept for 10 years in our payment providers' systems, as Italian accounting and tax law requires (Art. 2220 of the Italian Civil Code). Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR). These records are used only for accounting, tax and legal purposes.
• Free Trial Record: if you started a free trial or a subscription, when you delete your account we keep, for 12 months, a one-way code (a hash made with a secret key) derived from your email address, together with the date of the trial. Your email address cannot be read from this code. We use it only to check whether a new account with the same email address has already had the free trial. Legal basis: our legitimate interest in preventing repeated use of the free trial (Art. 6(1)(f) GDPR). After 12 months the code is deleted automatically.
• Disputes: if a payment dispute or legal claim is open, the related data is kept until it is resolved (Art. 17(3)(e) GDPR).

5. Data Sharing

MenuMagic does not sell or share users' personal data for marketing purposes or for uses not strictly related to the functioning of the application. We may share data with:

• Service Providers: Third parties that provide support services to our infrastructure and process data on our behalf, with confidentiality and security obligations.
• Legal Authorities: Government entities or public authorities, only when necessary to comply with legal obligations.
• AI and Food Database Providers: When the food diary is used, typed food descriptions and voice recordings are processed by third-party providers (such as OpenAI and Google) to transcribe them and estimate their nutritional values, and barcode scans are looked up in the Open Food Facts database. These requests are sent without the user's name or account identifiers, and biometric data (such as weight, height, or date of birth) is never shared with these providers.
• Payment Providers: Web payments are processed by Stripe, and in-app purchases by Apple and Google. Stripe processes payment data on our behalf and, for its own fraud prevention, anti-money-laundering and legal record-keeping purposes, acts as an independent controller and may keep some data after the account is deleted (see stripe.com/privacy).

6. Data Security

MenuMagic employs technical and organizational security measures to protect users' personal data from unauthorized access, accidental loss, alteration, or destruction. However, no online data transmission is completely secure, and we cannot guarantee the total security of transmitted information.

7. Users' Rights

Users of MenuMagic have the right to:

• Access their personal data and request a copy of it.
• Request the rectification or updating of personal data.
• Request the deletion of personal data in the cases provided by law.
• Object to the processing or request the limitation of the processing of data.

8. Changes to the Privacy Policy

MenuMagic reserves the right to periodically update this Privacy Policy. Any substantial changes will be communicated to users and, where necessary, explicit consent will be sought for the continued use of the service.

9. Contacts

For any questions or clarifications regarding this Privacy Policy, you can contact us by email at support@menumagic.ai.

10. Account Deletion

You can delete your account at any time through the app by going to Settings > Account Management > Delete Account. Within 7 days of deletion, we permanently remove your personal data, including your meal plans, shopping lists, food diary and subscription information. We keep only: payment and accounting records for 10 years, because the law requires it; and, if you started a free trial or a subscription, a hash of your email address made with a secret key, for 12 months, so that the free trial is available only once per person (see Data Retention). Subscriptions bought through the App Store or Google Play are managed by Apple or Google: to stop billing, cancel the subscription there before you delete your account. If you are unable to access your account, you can request deletion by contacting us at support@menumagic.ai.