Privacy Policy

Your privacy matters to us. This Privacy Policy explains what personal data ERISBIO SRL ("we", "us", "our") collects when you use Macrovelo (the "Service"), why and how we use it, who we share it with, how long we keep it, and the rights you have.

We are the "data controller" for the personal data described here. This Policy is written to comply with the EU General Data Protection Regulation (GDPR) and the Romanian data-protection framework, and it also describes rights available to consumers in the United Kingdom, the United States, and other regions. It forms part of, and should be read together with, our Terms of Service and Cookie Policy.

Because the Service helps you with diet and weight goals, some of the data you give us is health-related and is treated as special-category data, which we handle with particular care and only on the legal bases described in Section 4.

1. Who is responsible for your data

Data controller: ERISBIO SRL, a company registered in Romania (Trade Register No. ROONRC.J2014000589092, VAT RO33843116), with its registered office at Bdul. Independenței 266, Brăila, Romania.

For any privacy question, to exercise your rights, or to raise a concern, contact us at [email protected]. We will respond to you directly and, where relevant, coordinate with the service providers who process data on our behalf.

2. The personal data we collect

We collect personal data that you give us, data that is generated as you use the Service, and a limited amount of data from third parties (such as login or payment providers). Depending on how you use the Service, the categories include:

• Account data — your email address, password (stored only in hashed form), and, if you use social or single-sign-on login, the identifier and basic profile information your provider shares with us
• Quiz and profile data — information you enter such as age range, sex, height, current and target weight, activity level, dietary preferences, allergies, intolerances, and food dislikes
• Health-related data — information you provide about your diet, weight goals, progress, and related lifestyle details (this is special-category data under the GDPR; see Section 4)
• Meal photos — images you upload to the photo scanner, which we process to estimate calories, macros, and whether the meal fits your program
• Coach chat content — the messages you send to, and the responses you receive from, the AI coach
• Subscription and billing data — your plan, subscription status, billing history, and payment metadata (your full card number is collected and stored by Stripe, not by us)
• Communications — messages you send to support, feedback, and your contact and consent preferences
• Usage, device, and log data — IP address, approximate location derived from IP, device and browser type, pages and features used, timestamps, and diagnostic and crash data
• Cookie and similar identifiers — and, only with your consent, analytics and advertising identifiers (see our Cookie Policy)

3. How we collect your data

We collect personal data in three main ways. We collect it directly from you when you create an account, take the quiz, build a profile, upload a photo, chat with the coach, subscribe, or contact us. We collect it automatically through cookies, log files, and similar technologies as you interact with the Service (subject to your cookie choices for non-essential cookies). And we receive a limited amount from third parties such as authentication/social-login providers and our payment processor, who pass us the data needed to authenticate you and process payments.

4. Why we use your data and our legal bases

We only use your personal data where we have a lawful basis to do so under the GDPR. The bases we rely on, and the purposes for each, are:

• Performance of a contract — to create and manage your account, generate and adapt your meal plans, run the photo scanner and AI coach, process your subscription and payments, and provide customer support
• Explicit consent — to process the health-related (special-category) data you choose to provide for personalization (Art. 9(2)(a) GDPR), to set non-essential analytics and advertising cookies, and to send marketing emails where consent is required; you can withdraw consent at any time without affecting earlier processing
• Legitimate interests — to secure the Service, prevent and detect fraud and abuse, debug and improve our product, understand aggregate usage, and communicate service-related information, balanced against your rights and freedoms
• Legal obligation — to keep accounting and tax records, respond to lawful requests from authorities, and comply with consumer-protection and other legal duties
• Vital or public interests — in the rare event it is necessary to protect someone's life or comply with a legal requirement in the public interest

5. How AI processing works

Core features — meal plans, coach replies, and photo-based food estimates — are produced using artificial-intelligence systems, including trusted third-party AI providers. To generate a response, we send the relevant inputs (for example your dietary preferences, a chat message, or a meal photo) to these providers, who process the data on our behalf under contract and only to return a result to us.

We minimise what we send, and we do not permit your personal data to be used by these providers to train their own or third parties' models. AI output is generated automatically, may be inaccurate, and is provided for guidance only — see our Medical & AI Disclaimer. We do not use AI to make decisions that produce legal or similarly significant effects about you without a lawful basis and appropriate safeguards.

6. Who we share your data with

We do not sell your personal data. We share it only where necessary, with the following categories of recipients, each of which is bound to protect it:

• Payment processing — Stripe, to take payments, manage subscriptions, and prevent fraud
• AI and model providers — to generate meal plans, coaching responses, and scan estimates
• Email and communications providers — to send transactional emails (such as receipts, renewal reminders, and security notices) and, with consent where required, marketing emails
• Hosting and infrastructure providers — cloud hosting, database, storage, and content-delivery services that run the Service
• Analytics and advertising-measurement providers — only where you have given consent through our cookie banner
• Professional advisers and authorities — lawyers, accountants, and auditors, and public authorities or courts where we are legally required to disclose data or to establish, exercise, or defend legal claims
• Business transfers — a buyer or successor entity if we are involved in a merger, acquisition, reorganization, or sale of assets, subject to this Policy

7. International data transfers

We are based in the European Union, but some of our service providers may process personal data outside the European Economic Area (for example in the United States). Whenever we transfer personal data outside the EEA, we put in place an appropriate safeguard recognized under the GDPR — typically the European Commission's Standard Contractual Clauses, supplemented by additional technical and organizational measures where needed, or transfer to a country covered by an adequacy decision. You can request a copy of the relevant safeguards by contacting us at the address in Section 1.

8. How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes for which we collected it, after which we delete or anonymise it. Our main retention rules are:

• Meal-scan photos and their results — deleted automatically after 90 days
• Account, profile, quiz, plan, and coach-chat data — kept while your account remains active, and deleted or anonymised after account closure subject to the exceptions below
• Subscription, billing, and tax records — kept for the period required by accounting and tax law (typically several years)
• Consent and compliance records — kept for as long as needed to demonstrate compliance and to handle disputes
• Backups and logs — kept for a limited period under our security and backup schedule, then overwritten or deleted

9. Your rights

Under the GDPR and similar laws, and subject to legal conditions and exceptions, you have the right to:

• Be informed about how we use your data (this Policy)
• Access a copy of the personal data we hold about you (you can also export your data from within the app)
• Rectify personal data that is inaccurate or incomplete
• Erase your data — the 'right to be forgotten' — and delete your account
• Restrict our processing of your data in certain circumstances
• Object to processing based on our legitimate interests, and to direct marketing at any time
• Data portability — receive certain data in a structured, machine-readable format and have it transmitted to another controller where technically feasible
• Withdraw consent at any time where we rely on consent, without affecting the lawfulness of earlier processing
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by law
• Lodge a complaint with a data-protection supervisory authority

10. How to exercise your rights

You can exercise most rights directly in the app using the data-export and account-deletion tools, or by emailing [email protected]. We will respond within the time limit set by law — normally within one month, which may be extended by two further months for complex requests, in which case we will tell you. We may need to verify your identity before acting on a request.

If you are in the EU/EEA and believe we have not handled your data properly, you have the right to complain to your local data-protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro). We would, however, appreciate the chance to address your concerns first.

11. Cookies and similar technologies

We use strictly necessary cookies to operate the Service (for example authentication, security, and remembering your cookie choices) and, only with your consent, analytics and advertising cookies. You can accept or reject non-essential cookies in our cookie banner and change your choice at any time. Our Cookie Policy explains the categories and how to manage them in detail.

12. How we protect your data

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration. These include encryption of data in transit, hashing of passwords, access controls and least-privilege principles, network protections and rate limiting, logging and monitoring, and contractual safeguards with our processors.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, you, within the timeframes set by law.

13. Marketing communications

We send service and transactional messages (such as receipts, renewal reminders, security alerts, and important account notices) as part of providing the Service. We send marketing emails only where we are permitted to do so, and you can opt out at any time using the unsubscribe link in each marketing email or by emailing [email protected]. Opting out of marketing does not stop essential service messages.

14. Children's privacy

The Service is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

15. Third-party links and services

The Service may link to or rely on third-party websites and services that have their own privacy practices. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy notices before providing them with personal data.

16. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, or the law. We will post the updated version with a new "last updated" date, and for material changes we will give you reasonable notice (for example by email or in-app) before they take effect, and obtain your consent where the law requires.

17. Contact us

For any privacy matter, contact our team at [email protected], or write to ERISBIO SRL, Bdul. Independenței 266, Brăila, Romania.