Privacy Policy
Effective date: October 19, 2026
This Privacy Policy explains what personal data we collect through the Eatr mobile application and its web version available in a web browser (together, the "App"), our website eatr.com and any other website, quiz page, or checkout page operated by Eatr that links to this Policy, and related services (collectively, the "Services"), and how we use it.
The data controller is EATR CO. L.L.C, Khalifa B A Balila Building, Abu Hail 126-442, 4th floor, office 205, Dubai, United Arab Emirates. You can contact us at support@eatr.com.
1. What Personal Data We Collect and Why
We collect the following categories of personal data for the following purposes. Some of the information you provide, such as your weight, height, goals, dietary restrictions, and health conditions, is health-related data (a special category of personal data). Providing it is optional. We process health-related data on the basis of your explicit consent (GDPR Art. 9(2)(a)) for the purposes described in this Policy. You may withdraw this consent at any time by contacting support@eatr.com or by deleting your account; if you withdraw, we will stop processing your health-related data and delete or de-identify it, personalized features will no longer be available, and the lawfulness of processing before withdrawal is not affected.
| Purpose | Personal data | Legal basis (EEA/UK) |
|---|---|---|
| Providing core features: your personalized meal plan, food and water logging, progress tracking; providing paid features | User ID; your replies to the onboarding quiz (including your goals, dietary preferences and restrictions, and, where you provide them, weight, height, and health conditions); meals logged; weight entries; device data; age, sex; for paid subscriptions, payment and transaction data | Contract (Art. 6(1)(b)); legal obligation for payment records (Art. 6(1)(c)); explicit consent for special category data (Art. 9(2)(a)) |
| AI features: recipe generation, food recognition from photos and videos, and the AI Coach chat | Your prompts and chat messages; photos and videos you submit; food logs; preferences and restrictions; facts you share in the chat | Contract (Art. 6(1)(b)); explicit consent for special category data (Art. 9(2)(a)) |
| Linking your quiz results and purchase to your App account (website-to-app onboarding) | User ID, quiz responses, email used at purchase, attribution identifiers (including cookies and mobile advertising identifiers) | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for cookies and identifiers; explicit consent for special category data (Art. 9(2)(a)) |
| Measuring which ads and campaigns lead to App installs and purchases (attribution) | Device and advertising identifiers, install and purchase events, campaign data | Consent (Art. 6(1)(a)) given via the tracking prompt on your device, where your device asks for it; otherwise legitimate interests (Art. 6(1)(f)) |
| Account creation and management | Name, email, country, user ID, subscription status, device | Contract (Art. 6(1)(b)) |
| Customer support | Name, email, content of your messages and attachments (your messages may include health-related information you choose to share, such as meal-log screenshots) | Legitimate interests (Art. 6(1)(f)); explicit consent for special category data (Art. 9(2)(a)) |
| Leaving a review via our trusted partners, such as Trustpilot | Name, email, user ID, review content | Legitimate interests (Art. 6(1)(f)) |
| Researching and analyzing your use of the Services to understand how they are used, maintain and improve them, and develop new features | Usage data, logs, and tracking data | Legitimate interests (Art. 6(1)(f)) |
| Analytics and campaign measurement on our websites and quiz pages | Usage and device data collected via cookies and similar technologies | Legitimate interests (Art. 6(1)(f)); you can object at any time (see Section 8) |
| Security and fraud prevention | Account, usage, and transaction data | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications and offers | Email, country, age group, user ID, subscription status | Consent (Art. 6(1)(a)); or, for existing customers, as permitted by ePrivacy rules (soft opt-in), with an opt-out in every message |
| Defending against legal claims | Facts of our relationship (order, payment, cancellation, subscription terms) | Legitimate interests (Art. 6(1)(f)) |
| Calculating and documenting applicable taxes | Country, transaction details | Legal obligation (Art. 6(1)(c)) |
| Showing ads in the App to users of the free version | Device and advertising identifiers, approximate location, ad interaction data — no special category data | Consent (Art. 6(1)(a)) where required, collected via the consent prompt in the App |
Automated processing and profiling. We use automated processing, including profiling, to build your personalized plan and recommendations. We do not make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing.
Payment data. Payments are processed by third-party payment service providers; in-app purchases are processed by Apple and Google under their own privacy policies. We do not collect, store, or have access to your full card number; we receive limited billing information such as a secure payment token, the country of your card, its last four digits, and transaction details.
Provision of your data. Some data is required to enter into and perform our contract with you (for example, an email address for your subscription), and some — such as your dietary preferences and body parameters — is needed to build your personalized plan. If you choose not to provide it, we may not be able to provide the Services or their personalized features.
Aggregated data. We may aggregate, anonymize, or de-identify data and use or share it for statistics and research. We maintain such data in de-identified form, do not attempt to re-identify it, and contractually require the same from recipients.
2. Personal Data Retention
We keep your personal data for as long as your account is active or as needed for the purposes described above. If you purchased on our websites without using the App, or completed our quiz and provided your email address but did not make a purchase, we keep your profile and quiz responses as needed for the purposes described above, and you can request their deletion at any time (see below). Analytics data is retained at user level for up to 3 years and then aggregated, de-identified, or deleted. IP addresses are kept for up to 13 months; payment records are kept as long as tax and accounting rules require. Your AI Coach conversations are kept until you clear your chat history or delete your account; a short summary of facts you shared (for example, your preferences) is kept until you delete your account. We retain data longer where needed to comply with legal obligations, to handle legal claims, or for statistical purposes in de-identified form.
You may delete your account in the App settings or by emailing support@eatr.com (including if you purchased without an App account or completed the quiz without purchasing). Deleting the App or your account does not cancel a paid subscription; cancel the subscription first (see our Terms of Use and Cancellation & Refund Policy). We process deletion requests within one month; residual copies are removed from backups within up to 90 days. Deleted data is not recoverable if you later create another account.
3. Your Data Protection Rights (EEA/UK/Switzerland)
If you are located in or are a resident of the EEA, the UK, or Switzerland, you have the right to: access your data and receive a copy; receive the data you provided to us in a structured, commonly used, machine-readable format (portability); correct inaccurate data; delete your data; restrict processing; object to processing based on our legitimate interests, and, at any time and without giving reasons, to processing for direct marketing; withdraw your consent at any time (including your explicit consent to health-related data), without affecting the lawfulness of prior processing; and lodge a complaint with your local supervisory authority. For Switzerland, the corresponding rights under the Swiss FADP apply; complaints may be addressed to the FDPIC.
To exercise these rights, email support@eatr.com from the email address associated with your account or used at purchase. We may ask you to verify your identity. We respond within one month; for complex requests we may extend this period by up to two further months, and we will inform you of any extension.
If you are a California resident, see Section 12; residents of certain other US states, see Section 13.
4. Security Measures
We use appropriate technical and organizational measures to protect your data, including encryption and access controls limiting employee access to what is operationally necessary. No method of transmission over the Internet is completely secure.
5. Children's Privacy
The Services are not intended for or directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe that a child has provided us with personal data, contact support@eatr.com and we will delete it.
6. Sharing of Your Personal Data
We share personal data with: our affiliated companies (EatrMeals, LLC; GIPNETIX PTE. LTD.; Flowzen, SL), which operate parts of the Services and may act as the seller of record and process payments and billing data for your purchase (EATR CO. L.L.C remains your single point of contact for all requests); hosting and infrastructure providers; payment service providers; AI service providers powering recipe generation, food recognition, the AI Coach, and support; analytics, attribution, and error-monitoring providers; advertising partners; email delivery providers; customer support tools; and review partners, such as Trustpilot, when you choose to leave a review. We may update this list as our providers change.
We do not sell your personal data for money.
We may also disclose data to comply with legal process, to detect and prevent fraud, to protect life and safety, and as part of a merger, acquisition, or sale of assets.
7. Cross-Border Data Transfers
Eatr is operated from the United Arab Emirates. Your data is processed and stored in the United States and in other countries where our service providers and affiliates operate. Where we transfer your data onwards to service providers or affiliates not covered by an adequacy decision (including in the United States and Singapore), we rely on appropriate safeguards under Chapter V GDPR, including, where available, the European Commission's Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, and Swiss-law adaptations. You may obtain a copy of the relevant safeguards by contacting support@eatr.com.
8. Cookies, SDKs, and Other Tracking Technologies
On our websites and quiz pages, we and our partners use cookies, pixels, and similar technologies for functionality, analytics, and advertising. You can control cookies through your browser settings and use industry opt-outs (aboutads.info, optout.networkadvertising.org, Google Analytics opt-out); on your mobile device, you may limit ad tracking in your device settings (iOS Settings → Privacy → Tracking; Android Privacy → Ads). You may also object to analytics and advertising cookies by contacting support@eatr.com. In the App, ads shown to users of the free version use advertising identifiers only with your consent where required; you may change your choice in your device settings or by contacting support@eatr.com.
9. Your Choices About Our Communications
Transactional and security communications (such as account and cancellation confirmations) are part of the Services and are sent regardless of your marketing preferences. Marketing emails are sent only with your consent or, for existing customers, as permitted by ePrivacy rules, and every marketing email contains an unsubscribe link. Push notifications can be disabled in your device settings.
10. Contact Us
Email: support@eatr.com. Postal address: EATR CO. L.L.C, Khalifa B A Balila Building, Abu Hail 126-442, 4th floor, office 205, Dubai, United Arab Emirates.
11. Changes to Our Privacy Policy
We may update this Policy. The updated Policy takes effect when we post it. Where a change involves a new purpose incompatible with the original one, a new legal basis, or new categories of data, we will ask for your consent where required.
12. Information for California Residents
Categories of personal information we collect (as defined by the CCPA/CPRA): identifiers (name, email, IP, account ID); protected classifications (age, sex); commercial information (purchases, subscriptions); internet activity; approximate geolocation (country/state by IP); audio/visual information (photos and videos you submit, for example for food recognition or in the AI Coach chat); inferences; and sensitive personal information — health information you choose to provide (weight, height, goals, dietary restrictions, health conditions).
Sale and sharing. We do not sell personal information for money. We make certain personal information available to advertising partners through cookies, pixels, and software development kits for cross-context behavioral advertising and ad measurement, which may be considered "selling" or "sharing" under California law. In the preceding 12 months, we have sold or shared the following categories of personal information to advertising partners for these purposes: identifiers (such as cookie and device identifiers), internet or other electronic network activity, and approximate geolocation. We do not sell sensitive personal information, including health information, for money. To opt out, email support@eatr.com with the subject "Do Not Sell or Share"; we do not require you to verify your identity for this.
We do not knowingly sell or share the personal information of consumers under 16 years of age. We do not disclose personal information to third parties for those third parties' own direct marketing purposes.
You have the right to: know/access, correct, and delete your personal information; opt out of sale or sharing (see "Sale and sharing" above); limit the use and disclosure of sensitive personal information; and not be discriminated against for exercising your rights. To exercise them, email support@eatr.com from the email associated with your account (authorized agents must provide proof of authorization). We respond within 45 days (extendable to 90 days with notice). We act on requests to opt out of sale or sharing and to limit the use of sensitive personal information within the time required by California law, without requiring you to verify your identity.
| Category | Source | Purposes | Disclosed to | Retention |
|---|---|---|---|---|
| Identifiers (name, email, IP address, user and device IDs) | You; your device | Providing the Services, support, payments, security, analytics, advertising | Affiliates, service providers, payment processors, analytics and advertising partners | While your account exists; IP addresses up to 13 months |
| Health information you provide (weight, height, goals, dietary restrictions, health conditions) | You | Personalized plan, AI features, support, money-back guarantee checks, analytics | Affiliates, hosting, AI and analytics providers | Until you delete it or your account |
| Protected classifications (age, sex) | You | Personalized plan, analytics | Affiliates, hosting, analytics providers | While your account exists |
| Commercial information (purchases, subscriptions) | You; payment processors | Payments, cancellations, refunds, legal obligations | Affiliates, payment processors | As long as tax and accounting rules require |
| Internet activity (usage of the Services) | Your device | Analytics, advertising measurement, security | Analytics and advertising partners | Up to 3 years at user level |
| Approximate geolocation (country by IP) | Your device | Localization, taxes, fraud prevention | Service providers | Up to 13 months |
| Audio/visual information (photos and videos you submit) | You | Food recognition, AI Coach | AI providers, hosting | Until you delete it or your account |
| Inferences (your plan and recommendations) | Derived from your data | Personalization | Affiliates, hosting | While your account exists |
13. Additional US State Privacy Rights
Residents of US states with comprehensive privacy laws (currently including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) have rights to confirm, access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale, and certain profiling. Health-related data is treated as sensitive data; we process it on the basis of your consent (see Section 1). Oregon and Minnesota residents may also request a list of the specific third parties to which we have disclosed personal data. We act on opt-out requests and on withdrawals of consent to the processing of sensitive data within the time required by your state's law. To exercise these rights, email support@eatr.com; we respond within 45 days (one 45-day extension where permitted). If we decline your request, you may appeal by replying to our decision; we decide appeals within the period required by your state's law, and if the appeal is denied, you may contact your state Attorney General.
14. Information for Brazil Residents
If you are in Brazil, you have rights under the LGPD similar to those described in Section 3 — including confirmation of processing, access, correction, deletion, portability, information about sharing, and revocation of consent. To exercise them, email support@eatr.com. You may also lodge a complaint with the Brazilian data protection authority (ANPD).