Privacy Policy

At SmartyDiet (smartydiet.com) we value your privacy and are committed to protecting your personal data. SmartyDiet is part of the Smarty Wellness family of brands — a science-based ecosystem for everyday human wellness — alongside our sister brands SmartyGym (train) and SmartyMove (assess), while SmartyDiet focuses on fuel. This Privacy Policy explains how SmartyDiet collects, uses, stores, and protects your information when you use our AI-generated personalized nutrition service. Our practices comply with the General Data Protection Regulation (GDPR) (EU) 2016/679, the ePrivacy Directive 2002/58/EC, and applicable data protection laws worldwide.

1. Data We Collect

Account & Profile Data

• Name, email address, and password (stored hashed) when you create an account.
• Optional profile information: display name, timezone, and notification preferences.

Questionnaire & Nutrition Data

• Self-reported information from your nutrition questionnaire: age, gender, height, weight, body composition metrics (BMR, BMI, body fat %, muscle mass — all optional), activity and training habits, sleep quality, goals, diet-style preferences, meal timing, foods you like and dislike, allergies and intolerances, cultural or religious restrictions, alcohol, caffeine and water intake.
• Practical constraints you provide: cooking skill and time, budget level, kitchen equipment, eating-out frequency.
• Health-screening answers: diagnosed medical conditions, medications affecting diet, pregnancy or breastfeeding status.
• Free-text notes and refinement requests you submit for your plan.
• Your generated diet plans, grocery lists, and plan history.

Payment Data

• Payment records for each one-time plan purchase are processed by Stripe. We do not store your full card details on our servers.

Usage & Technical Data

• Technical data such as IP address, browser type, device type, and operating system.
• Aggregated usage analytics (which steps you complete, refinements used).

2. How We Use Your Data

• Generate your personalized nutrition plan and grocery list.
• Exclude allergens, disliked foods, and restricted items from your plan.
• Apply your refinement requests using remaining credits.
• Save your plans and history so you can view them at any time.
• Process one-time plan payments via Stripe.
• Send transactional emails (account, security, billing) and, with consent, product updates.
• Improve SmartyDiet through anonymized, aggregated analytics.
• Ensure legal compliance and platform security.

We will never sell or rent your personal data to third parties.

3. Legal Basis for Processing (GDPR Article 6)

• Consent (Art. 6(1)(a)): Marketing emails, optional analytics.
• Contractual necessity (Art. 6(1)(b)): Running the questionnaire, generating plans, processing your purchases.
• Legal obligation (Art. 6(1)(c)): Tax and accounting records, fraud prevention.
• Legitimate interests (Art. 6(1)(f)): Service security, product improvement.
• Health-related self-reports (allergies, conditions, medications, pregnancy) are processed only with your explicit consent and used solely to make your plan safer and more relevant. We do not share them for any other purpose.

4. Data Sharing & Sub-Processors

• Stripe — payment processing (PCI DSS compliant). Stripe Privacy Policy
• Lovable Cloud — database hosting and authentication.
• AI provider(s) — used only to generate your personalized plan from your questionnaire. Prompts are transmitted for the sole purpose of producing your plan; no direct identifiers (name, email) are sent to the AI provider unless strictly required.
• Email delivery provider — for transactional and (with consent) marketing emails.

All processors are required to comply with GDPR standards and maintain appropriate technical and organizational security measures.

5. Data Retention

• Account data: retained while your account is active and deleted when you delete your account, except where short operational backup windows or legal obligations apply.
• Questionnaire & plan data: retained while your account is active and deleted with your account.
• Transaction records: retained for 7 years as required by tax law.
• Marketing preferences: retained until you withdraw consent.
• Anonymized analytics: may be retained beyond account deletion in fully anonymized form.

6. Your Rights Under GDPR

• Right of Access (Art. 15)
• Right to Rectification (Art. 16)
• Right to Erasure (Art. 17) — delete your account and data from settings.
• Right to Restrict Processing (Art. 18)
• Right to Data Portability (Art. 20) — download your data in JSON format.
• Right to Object (Art. 21)
• Right to Withdraw Consent (Art. 7)
• Right to Lodge a Complaint with your local data protection authority.

7. Security Measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Hashed passwords and secure session management.
• Row Level Security (RLS) ensuring each user can only access their own data.
• Strict access controls and least-privilege principles.
• Regular dependency, infrastructure, and security reviews.

8. Cookies & Local Storage

SmartyDiet uses cookies and local storage for the following purposes:

• Essential: authentication tokens, session security, fraud prevention.
• Functional: UI preferences, questionnaire progress.
• Third-party (Stripe): payment fraud prevention at checkout.

9. Children

SmartyDiet is intended for users aged 18 and over. Users between 13 and 18 may only use SmartyDiet with parental or guardian supervision and consent. We do not knowingly collect data from children under 13.

10. International Transfers

Your data is primarily processed within the EU. Where transfers outside the EU are necessary, we rely on Standard Contractual Clauses or other lawful transfer mechanisms approved under GDPR.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via the app or email.

12. Contact

Data Controller: SmartyDiet (smartydiet.com), part of Smarty Wellness, alongside sister brands SmartyGym and SmartyMove. Contact smartydiet@outlook.com.