Privacy Policy

Who we are

Merienda is a nutrition tracking app that helps you log meals and understand what you eat. For privacy questions, contact contact@merienda.app.

Data controller

The controller of your personal data is EXNEC SRL, a company registered in Romania.

Registered office: Str. Petru Rareș 63, bl. A4, sc. B, et. 3, ap. 28, 610114 Piatra Neamț, Neamț County, Romania
Trade Register number: J27/71/2001
Tax ID (CUI): RO6866627
Email: contact@merienda.app

We have not appointed a data protection officer. For any question about your data or this policy, write to contact@merienda.app.

Data we collect

Account data: your name and email address, provided directly or through Google or Apple sign-in.

Health profile: the date of birth, gender, height, weight, activity level, fitness goal and dietary preferences you provide. We use these to calculate calorie and macronutrient goals.

Meal data: your photos, detected meals and drinks, and logging times.

Usage data: which screens and features you use, with a random app ID and basic device information, and your subscription status.

Activity data, only if you connect Apple Health or Health Connect: steps, active energy, workouts and weight. If you ask the app to use your sleep, only the bedtime it calculates leaves your phone, not your sleep records.

Consent records: which consents you gave or withdrew, when, and the version of this policy at the time.

How we use your data

We use your data to analyze meals, calculate nutrition totals and personal goals, track completed goals, and improve the app. We do not sell your personal data or show ads.

Legal basis

We use your data only when the law gives us a basis for it:

• Your account and the service you asked for (the meal log, goals, history, achievements, the shop and subscriptions): the contract with you, Art. 6(1)(b) GDPR.

• Your health data (body measurements, weight, goals, the meals and drinks you log, and meal photos): your explicit consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR. You give it in the app before you create your account. Merienda needs it, because calculating your goals and tracking what you eat is what the app does.

• The activity you connect from Apple Health or Health Connect: the same explicit consent. This connection is optional. You turn it on yourself, and you can disconnect it at any time from the Activity card. The app works without it.

• Meal photos and descriptions sent to the AI service for analysis: your explicit consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR.

• Usage statistics (Firebase Analytics): your consent, Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004. They are off until you turn them on.

• Security, abuse prevention and daily limits (server logs, request limits): our legitimate interest in keeping the service safe and available, Art. 6(1)(f) GDPR.

• Records the law requires, and answers to authorities: our legal obligation, Art. 6(1)(c) GDPR.

How to withdraw a consent:
• Usage statistics: Settings → Privacy, turn off the switch.
• AI meal analysis: Settings → Privacy → AI meal analysis, turn off the switch. Photo and description analysis then stop. You can still log meals in other ways.
• Health data: delete your account in Settings → Delete Account. Merienda cannot work without health data, so this consent ends with the account.

A withdrawal is free. It stops the processing from that moment. It does not make the earlier processing unlawful.

Third-party services

An external AI service provider analyzes meal photos and descriptions to detect food and estimate nutrition values. It uses them only for this, and only after you agree. The provider may process them outside the EU, under the safeguards that the GDPR requires.

Firebase Analytics (Google) receives usage events, such as which screens you open, with a random app ID and basic device information. It does not receive your name, email, photos, meals, weight or goals. Google estimates your country and city from your IP address. The app itself never asks for your location.

RevenueCat processes subscription status; the App Store or Google Play handles payments.

If you sign in with Google or Apple, the provider shares your basic profile, such as your name and email, with us.

Recipients and processors

We do not sell your data and we do not show ads. We share data only with the service providers below. Each one processes it for us under a data processing agreement, only to give us its service, and not for its own purposes.

• Laravel Cloud (Laravel Holdings Inc.): hosts our servers and database in Frankfurt, Germany. It stores the account and health data described in this policy.

• Cloudflare, Inc.: stores meal photos in Western Europe, serves the merienda.app website, and forwards email sent to contact@merienda.app.

• An external AI service provider: receives each meal photo or description that you send for analysis, with the app language. It does not receive your name, email or profile. It uses the data only to give the analysis and does not use it to train its models.

• Google (Firebase Analytics): receives usage events, only if you turn on usage statistics.

• RevenueCat, Inc.: receives your account number, your purchases and subscription status, and basic device information, to manage subscriptions.

These companies receive data as separate controllers, under their own privacy policies:
• Apple (App Store) and Google (Google Play), when you buy a subscription. They take the payment. We never see your card details.
• Apple and Google, when you sign in with them. They give us your name and email.

If you connect Apple Health or Health Connect, Merienda reads only the data you allow and never writes to Apple Health or Health Connect. It copies what it reads to our servers, so that your history shows on any device: one row per day with active energy, steps and your workouts (type, start time, duration, calories and distance), and a weight reading from today as that day's weigh-in. If you ask the app to use your sleep, only the bedtime it calculates goes to our servers, not your sleep records. Apple and Google do not receive data from Merienda through these connections.

We give data to an authority only when the law obliges us.

Transfers outside the EU

Your data is stored in the EU: our servers and database are in Frankfurt, Germany, and meal photos are in Cloudflare storage in Western Europe.

Some of our providers are based in the United States, or use staff or sub-processors there: Laravel, Cloudflare, Google, RevenueCat and the AI service provider. Data can therefore be sent to or accessed from the United States. We allow this only with one of these safeguards:
• the European Commission's adequacy decision for the EU-US Data Privacy Framework, for a provider certified under it; or
• the European Commission's standard contractual clauses (Decision (EU) 2021/914), in the provider's data processing agreement.

To get a copy of these safeguards, write to contact@merienda.app.

Storage and retention

We store your data on our servers for as long as your account exists. Meal photos are retained so you can review your history.

Retention periods

We keep your data only as long as we need it:

• Your account, profile, health data, saved meals and their photos, weight entries, activity, achievements and consent records: until you delete them or delete your account.
• A meal you delete: deleted at once, with its photo.
• An analysis you do not save: deleted with its photo the next time you analyze a meal, if it is older than one day, and always when you delete your account.
• Server logs: at most 14 days. They contain technical data, such as account numbers and errors, but no meals or profile content.
• Database backups: 7 days.
• Usage statistics in Firebase: at most 14 months.
• Records of AI use (date and amount, for our cost accounting): kept, but no longer linked to you after you delete your account.

When you delete your account, we delete all of this at once. The only copies left are in backups, which are gone within 7 days, and in logs, which are gone within 14 days. Apple, Google and RevenueCat keep their purchase records as their own policies and tax law require.

Your rights

You have these rights under the GDPR, free of charge:

• Access (Art. 15) and portability (Art. 20): Settings → Privacy → Download my data gives you one JSON file with your profile, meals, weight, activity and consents.
• Rectification (Art. 16): edit your profile, goals and meals in the app.
• Erasure (Art. 17): delete a meal in the app, or your whole account in Settings → Delete Account. Without the app, use merienda.app/delete-account.
• Restriction (Art. 18): ask us to stop using your data for a time, for example while we check a correction.
• Objection (Art. 21): object to the processing that is based on our legitimate interest.
• Withdrawal of consent (Art. 7(3)): see "Legal basis".

The AI only estimates nutrition. It makes no decision that has a legal or similar significant effect on you (Art. 22).

For any right, you can also write to contact@merienda.app from the email address of your account.

Complaints

We answer every request within one month. For a complex request, we can extend this by two more months. If we do, we tell you why within the first month.

You can also complain to a data protection authority. In Romania, this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro. You can also complain to the authority of the EU country where you live, where you work, or where the problem occurred.

Children

Merienda is for people aged 16 or older. During sign-up, the app asks for your date of birth and does not continue if you are younger than 16. Our servers also refuse an account with a date of birth under 16.

We do not knowingly collect data from children under 16. If we learn that an account belongs to a person under 16, we delete the account and all its data. If you think that a child under 16 uses Merienda, write to contact@merienda.app.

Changes

If this policy changes significantly, we will notify you in the app before the change takes effect. If a change needs a new consent from you, we ask for it in the app first.

Delete your account

To delete your account with or without the app, see merienda.app/delete-account.

Who operates Merienda

Data controller

EXNEC SRL, Piatra-Neamț, Romania

Contact

contact@merienda.app

Company details

exnec.ro