privacy policy

1. identity and contact details of controller

the controller is polytropic ltd, incorporated in cyprus (reg. no. HE469607), with registered office at ioanni kondylaki 9a, agia zoni, limassol, 3026, cyprus.

contact: support@mealtickt.com

supervisory authorities:

• EU users: office of the commissioner for personal data protection (cyprus)
• UK users: information commissioner's office (ICO)

in this privacy notice, we explain how we at polytropic ltd (mealtickt) collect, use, share, maintain, and store (together, "process") your personal data. mealtickt is the primary data controller responsible for your information. in some cases, if you choose to connect mealtickt with third-party services or integrations, those providers may also act as independent data controllers with their own privacy practices.

this privacy notice sets out how we process your personal data in line with applicable data protection laws, and what steps we take to safeguard your privacy. it applies to your use of our mobile application, your interaction with our services, and any other related activities.

2. categories of data processed

we process:

• identification and contact data (such as through your email, the chosen password and profile picture);
• app configuration data (measurement system, ingredient measurement, free days);
• lifestyle/nutrition data (special category) (height, weight, age, gender, activity level, meal frequency, dietary preferences, allergies, foods to avoid, suggested goal weight, diet goal, diet pace); in future versions, exercise-related data (e.g., activity level, workout frequency) may also be collected to improve recommendations; we will update this notice if we do. users cannot input diagnosed medical conditions; only information on allergies, intolerances, and dietary preferences may be recorded.
• usage data (app activity, subscription tier, in-app interactions);
• device/technical data (logs, diagnostics).
• marketing and advertising data: device identifiers, coarse location, app version, and event-level app usage (e.g. screen views, session duration). we currently show ads via external ad networks (e.g. google ads). we do not use your health data for ads. promotional newsletters and in-app promotions are not active at present, but we may introduce them in future with your prior consent.
• billing and payment data (premium users only): for premium users we may process name, billing address, subscription plan and transaction details.

3. data sources

we collect personal data directly from you when you create an account, use our app, and interact with our services. some data is also generated automatically by mealtickt as part of delivering and improving the app experience (for example, usage logs or analytics). if you choose to connect mealtickt with third-party services or integrations, we may also receive limited information from those providers, always in accordance with your settings and their privacy practices (see section 7 of this privacy notice).

for free users, meal plans are produced by our proprietary, rule-based (non-ai) algorithm. for premium users, ai features may further adapt plans based on your inputs and feedback.

4. purposes and legal bases

as part of our relationship, you may be required to provide us with certain personal data so that we can deliver the mealtickt app and its features. without this data, we will generally not be able to perform our contract and provide you with the service.

the legal bases we rely on when processing your personal data include:

• consent – where you choose to enable features such as personalised nutrition plans, adaptive ai, or marketing communications.
• contractual necessity – where processing is required to provide the core app services or manage premium subscriptions.
• legal obligation – for example, retaining invoices and billing data to comply with tax and accounting laws.
• legitimate interests – where we have a business need that does not override your rights and freedoms.

our legitimate interests include:

• improving our services
• customer acquisition and analysis
• direct marketing
• keeping the service secure
• supporting our users
• market research and insights reports

5. special category data

to provide you with the core services of the mealtickt app, we need to process certain information about you that may qualify as health-related data under data protection legislation. this includes data such as your dietary preferences, allergies, body measurements, activity level, weight goals, and eating patterns. because this data can reveal information about your health, we only process it with your explicit consent.

this information is essential to the functioning of the app: without it, we cannot provide accurate meal planning, tracking functionality, or personalised recommendations.

6. automated decision-making & profiling

mealtickt provides (a) non-ai, rule-based tailoring for all users and (b) optional ai personalisation for premium users. for free (and premium) users, your onboarding inputs are processed by our proprietary closed-form algorithm to generate a unique meal plan; this is profiling (gdpr art. 4(4)) but does not produce legal or similarly significant effects (art. 22(1)).

mealtickt's ai coach is fully automated. it can suggest recipe alternatives, answer nutrition questions, provide motivational and educational content, and adapt diet plans based on your feedback. importantly, these ai-driven features do not produce legal or similarly significant effects on you.

7. recipients of data

we may disclose your personal data to the following categories of recipients, always in line with applicable data protection law:

• processors – third-party service providers who support our operations
• professional advisors – such as auditors, accountants, or legal advisors
• public authorities – where disclosure is legally required
• advertising and analytics partners (with consent)

we never sell your personal data.

8. international data transfers

to provide our services globally, we may transfer your personal data outside the european economic area (eea) and the united kingdom (uk). whenever we do so, we implement safeguards to ensure your data remains protected in line with applicable data protection laws.

9. retention

we only keep your personal data for as long as necessary to fulfill the purposes described in this privacy notice or where we are required to do so by law. our retention periods are:

• account data – retained while your account is active; deleted or anonymised within 90 days after closure.
• lifestyle/nutrition data – retained while your account is active; anonymised after 24 months of inactivity.
• analytics data – raw logs are kept for up to 12 months, after which they are aggregated and no longer identifiable.
• billing and payment data (premium users only) – retained for 6 years after the end of the relevant financial year, then securely deleted or anonymised.

10. data subject rights

you have the following rights under the gdpr and uk gdpr:

• right of access – to obtain a copy of the personal data we hold about you
• right to rectification – to have inaccurate or incomplete data corrected
• right to erasure ("right to be forgotten") – to request deletion of your data
• right to restriction of processing – to limit how we process your data
• right to data portability – to receive your data in a structured format
• right to object – to object to processing, including profiling and direct marketing
• right to withdraw consent – where processing is based on your consent

to exercise any of these rights, please contact us at support@mealtickt.com

11. children

mealtickt is designed for adults aged 18 and over. we do not knowingly collect or process personal data of children under 18. if we become aware that we have inadvertently collected data from a minor, we will take steps to delete it without delay.

12. changes to this notice

we may update this privacy notice from time to time to reflect changes in our practices, legal requirements, or service offerings. when we make significant changes, we will notify you via email or through the app. we encourage you to review this notice periodically.

13. contact us

if you have any questions about this privacy notice or how we process your personal data, please contact us at:

email: support@mealtickt.com

postal address:
polytropic ltd
ioanni kondylaki 9a
agia zoni
limassol, 3026
cyprus

last updated: 6 november 2024