Privacy policy

This policy explains what personal data Meal Plan collects, why, and what you can do about it. The data controller is VORALINE LIMITED, 22F, 33 Wyndham Street, Central, Hong Kong. Contact us about privacy through our contact form.

The short version: we collect what we need to build your plans and run your account. We don’t sell your data, we don’t use it for advertising, and you can delete it whenever you like.

What we collect

When you build a plan

• Your goal, calorie and macro targets, and optionally height, weight, age, sex and activity level.
• Your diet, allergies, disliked foods, household size and cooking preferences.

Some of this, such as allergies or a diet linked to a medical condition, can count as health data under the GDPR. We only use it to build your plans, and only with your explicit consent, which you give when you enter it. You can withdraw consent by deleting the data or your account.

When you create an account or buy

• Your email address and, for business invoices, your company details.
• Payment confirmations from our payment provider (amount, date, tier). We never receive your full card number.

When you use the site

• Basic technical data such as IP address, browser and device type, kept in server logs for security.
• Anonymous usage statistics, collected without cookies that track you across other sites.

Why we use it, and on what legal basis

• To provide the Service: building plans, saving them and running your account (performance of contract).
• To process health-related preferences (explicit consent).
• To take payments and keep tax records (legal obligation).
• To keep the Service secure and improve it (legitimate interests).
• To send product news, only if you opt in (consent). Every email has an unsubscribe link.

Who we share it with

Only the providers we need to run the Service, under data processing agreements:

• Hosting and database providers
• Our payment provider
• An email delivery service for sign-in links and receipts
• On the Elite tier, the registered dietitian who reviews your plan, only when you ask for a review

Where data is transferred outside the European Economic Area, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses.

How long we keep it

• Account data: until you delete your account.
• Payment and invoice records: as long as tax law requires, usually 7 to 10 years.
• Server logs: 30 days.

Cookies

We use only the cookies needed to keep you signed in and remember your settings. We don’t use advertising or cross-site tracking cookies, so you won’t see a cookie banner.

Your rights

Under the GDPR you can:

• access the data we hold about you, and get a copy in a portable format
• correct it, or have it deleted
• restrict or object to how we use it
• withdraw consent at any time
• complain to your local data protection authority

You can export or delete most data yourself in your account settings. For anything else, send us a privacy request and we’ll reply within 30 days.

Children

Meal Plan is for adults. Accounts are not intended for anyone under 16. Child portions on Family tiers are set up by the adult account holder.

Changes

If we change this policy in a way that matters, we’ll email account holders before it takes effect.