Privacy Policy

Last updated: January 2026

MacroBuddy ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

1. Data Controller

MacroBuddy is the data controller responsible for your personal data. For any privacy-related inquiries, please contact us at [email protected].

2. Data We Collect

We collect and process the following categories of personal data:

• Account Information: Name, email address, and authentication data (including data from Google OAuth if used)
• User Content: Recipes, meal plans, ingredients, and nutritional preferences you create
• Usage Data: Information about how you interact with the Service
• Technical Data: IP address, browser type, and device information for security and service improvement

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: To provide you with the Service you have requested
• Legitimate Interests: To improve our Service, ensure security, and prevent fraud
• Consent: Where you have given explicit consent for specific processing activities
• Legal Obligation: To comply with applicable laws and regulations

4. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Store and display your recipes, meal plans, and preferences
• Calculate and track nutritional information
• Communicate with you about the Service
• Ensure the security and integrity of the Service

5. Data Sharing

We do not sell, trade, or rent your personal data to third parties. We may share your data only in the following circumstances:

• Service Providers: With trusted third parties who assist us in operating the Service (e.g., hosting providers), bound by data protection agreements
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate safeguards

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Regular security assessments
• Access controls and authentication

9. International Transfers

Your data is stored and processed within the European Economic Area (EEA). If we need to transfer data outside the EEA, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Cookies

We use essential cookies only for authentication and session management. These cookies are strictly necessary for the Service to function and do not require consent. We do not use tracking or advertising cookies.

11. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

13. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

14. Contact Us

For any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]