Privacy Policy
Last updated: 24 February 2026
1. Who We Are
Eatpace is operated by ShopEms, a company registered in the Netherlands (KVK 89061225). When we refer to "Eatpace", "we", "us", or "our" in this policy, we mean ShopEms.
We are the data controller for the personal data processed through Eatpace. If you have questions about this policy, contact us at privacy@eatpace.com.
2. What Data We Collect
We collect the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account information | Email address, display name | You provide this during registration |
| Dietary preferences | Allergies, avoidances, dietary restrictions, food dislikes | You provide this during onboarding |
| Meal planning data | Generated meal plans, saved recipes, shopping lists | Created through your use of the service |
| Usage data | Pages visited, features used, interaction patterns | Collected automatically via analytics (when consented) |
| Device information | Device type, operating system, app version | Collected automatically |
| Contact information | Name, email, message content | When you contact us via the website |
3. How and Why We Use Your Data
We process your personal data under the following legal bases (GDPR Article 6):
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the meal planning service | Account info, dietary preferences, meal data | Contract performance (Art. 6(1)(b)) |
| Personalise your meal plans | Dietary preferences, cooking history, feedback | Contract performance (Art. 6(1)(b)) |
| Generate shopping lists | Meal plan data, recipe ingredients | Contract performance (Art. 6(1)(b)) |
| Website analytics | Usage data, device info | Consent (Art. 6(1)(a)) |
| Respond to contact enquiries | Name, email, message | Legitimate interest (Art. 6(1)(f)) |
| Improve our service | Aggregated usage patterns | Legitimate interest (Art. 6(1)(f)) |
| Send service notifications | Email address | Contract performance (Art. 6(1)(b)) |
| Process payments | Payment handled by Apple/Google (we do not store card data) | Contract performance (Art. 6(1)(b)) |
4. Special Category Data
Your dietary preferences may reveal information about your health conditions (e.g., allergies, intolerances) or religious beliefs (e.g., halal, kosher). Under GDPR Article 9, this is considered "special category data" requiring additional protection.
We process this data based on your explicit consent (GDPR Art. 9(2)(a)), which you provide when entering your dietary preferences during onboarding. You can withdraw consent at any time by deleting your dietary preferences or your account.
6. Third-Party Services
We share data with the following service providers, each of which processes data under their own privacy policies:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database, authentication | Account data, preferences, meal plans | EU (Frankfurt) |
| Vercel | Website hosting, analytics | Usage data (anonymised, cookieless) | EU (Frankfurt) |
| Resend | Transactional email | Email address, message content | US (EU safeguards) |
| RevenueCat | Subscription management | User ID, purchase history, subscription status | US (EU safeguards) |
| Apple / Google | Subscription billing | Payment data (not shared with us) | US (EU safeguards) |
We do not sell your personal data to third parties. We do not share identifiable personal data for marketing or advertising purposes.
7. International Data Transfers
Our primary infrastructure (database and hosting) is located in the EU (Frankfurt, Germany). Where data is transferred outside the European Economic Area (e.g., Resend for email delivery), we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.
8. Data Retention
We retain your data only for as long as necessary for the purpose it was collected:
| Data type | Retention period |
|---|---|
| Account information | Until you delete your account |
| Dietary preferences | Until you delete your preferences or account |
| Meal plan history | Rolling 12 months (older plans are automatically deleted) |
| Shopping lists | Until the next week plan is generated |
| Usage analytics | 26 months (aggregated, anonymised) |
| Contact form messages | 24 months, then deleted |
| Guest mode data | Stored locally on your device only — never transmitted to our servers |
9. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15) — request a copy of your data
- Right to rectification (Art. 16) — correct inaccurate data
- Right to erasure (Art. 17) — request deletion of your data
- Right to restrict processing (Art. 18) — limit how we use your data
- Right to data portability (Art. 20) — receive your data in a structured format
- Right to object (Art. 21) — object to processing based on legitimate interest
- Right to withdraw consent (Art. 7(3)) — withdraw consent at any time (e.g., for analytics cookies or dietary data processing)
To exercise any of these rights, email privacy@eatpace.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
10. US and International Privacy Rights
California (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:
- Right to know — what personal information we collect, use, and disclose
- Right to delete — request deletion of your personal information
- Right to opt out of sale/sharing — we do not sell or share your personal information as defined by the CCPA/CPRA
- Right to non-discrimination — we will not discriminate against you for exercising your privacy rights
- Right to correct — request correction of inaccurate personal information
- Right to limit use of sensitive personal information — dietary preferences that may reveal health or religious information are used solely to provide the meal planning service
To exercise these rights, email privacy@eatpace.com. We will verify your identity and respond within 45 days.
Other US States
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), and other states with consumer privacy laws may have similar rights to access, delete, correct, and opt out of the processing of personal data. We honour these rights for all US users regardless of state. Contact privacy@eatpace.com to exercise your rights.
Other Jurisdictions
If you are located outside the EU and US, you may have additional rights under your local privacy laws (e.g., LGPD in Brazil, POPIA in South Africa, PIPEDA in Canada, Privacy Act in Australia). We are committed to respecting your privacy rights. Please contact us at privacy@eatpace.com and we will do our best to accommodate your request in accordance with applicable law.
11. Account Deletion
You can delete your account at any time from the app settings. When you delete your account:
- Your profile, dietary preferences, and meal plan history are permanently deleted
- Active subscriptions are cancelled (billing handled by Apple/Google)
- Shopping lists and saved recipes are removed
- Data is purged from our systems within 30 days
- Anonymised, aggregated analytics data is not affected by account deletion
12. Children's Privacy
Eatpace is not directed at children. We do not knowingly collect personal data from anyone under 16 (as required by GDPR) or under 13 (as required by the US Children's Online Privacy Protection Act, COPPA). If you believe a child has provided us with personal data, please contact us at privacy@eatpace.com and we will delete the data promptly.
13. Guest Mode
Eatpace offers a guest mode that allows you to use core features without creating an account. In guest mode:
- Your data (preferences, meal plans) is stored locally on your device only
- No personal data is transmitted to our servers
- You can upgrade to a full account at any time, at which point your local data is synced to our servers
14. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the app or email before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.
15. Contact
For any questions about this Privacy Policy or your personal data:
- Email: privacy@eatpace.com
- Company: ShopEms (KVK 89061225)
- Country: The Netherlands