Privacy Policy

1. Controller

The controller responsible for the processing of personal data in connection with this website and the MacroPilot app is:

Lennart Dörfer
operating under the name MacroPilot
c/o Online-Impressum #8297
Europaring 90
53757 Sankt Augustin
Germany

2. General Information on Data Processing

We process personal data only to the extent necessary to provide our website, our app and the functions offered within them.

Personal data is processed in particular when users visit our website, use the app, enter information about meals and personal nutrition goals, purchase premium features or contact us by email.

MacroPilot is intended for recording and evaluating nutrition data. The app does not replace medical advice, diagnosis or treatment.

3. Hosting of the Website and App Backend

Our website and the backend of our app are hosted by:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

As part of the hosting, technically necessary data is processed, in particular server log data such as the IP address, time of access, requested path, HTTP status code and other technically required connection data.

This processing is carried out to ensure the secure and stable operation of the website and app backend, for IT security, error analysis and abuse detection.

Legal basis: Article 6(1)(f) GDPR

Legitimate interest: Secure and stable operation of the website and app backend, IT security, error analysis and abuse detection.

Server log data is rotated regularly and is generally deleted after approximately 14 days.

4. Use of the Website

When our website is accessed, technically necessary data is processed so that the website can be displayed and delivered correctly.

Our website currently serves in particular to:

• present MacroPilot and its features,
• link to the app stores,
• provide the legal notice, terms of use and this Privacy Policy.

We currently do not use analytics or tracking services on the website.

5. Use of the App

5.1 Nutrition and Meal Data

To use the core features, users can describe which foods, drinks or meals they have consumed. Based on this information, MacroPilot determines in particular the foods, quantities, calories and macronutrients.

Depending on how the app is used, the following data may be processed in particular:

• entered meal descriptions and audio recordings when voice input is used,
• foods and quantity information,
• calories, protein, carbohydrates and fat,
• time and meal category,
• corrections or additions made by the user,
• saved or recurring meals,
• the IP address for technical reasons during server communication.

The data is processed in order to perform the nutritional calculations requested by the user, record meals and provide the corresponding daily overviews.

Legal basis: Article 6(1)(b) GDPR

5.2 Personal Information and Nutrition Goals

For the setup and personalization of the app, users may provide information that is used to calculate or display individual calorie and macronutrient goals.

This may include in particular:

• age, gender, height and body weight,
• activity level,
• weight or nutrition goal,
• desired daily calorie and macronutrient targets.

This information may allow conclusions to be drawn about a user's physical condition and dietary habits. Users should therefore only enter data whose processing they want for the use of MacroPilot.

The data is processed to provide the personalized features requested by the user.

Legal basis: Article 6(1)(b) GDPR; where information qualifies as health data within the meaning of Article 9 GDPR, additionally Article 9(2)(a) GDPR based on the user's explicit consent.

5.3 Voice Input via OpenAI

MacroPilot allows users to enter meals by voice. For this purpose, the audio recording is transmitted to an OpenAI service and converted into text there.

The audio recording and the resulting text are processed only to recognize the meal description spoken by the user and then process it within MacroPilot.

The audio recording is not stored permanently on our servers. Where the app stores the generated meal description or nutritional data derived from it, this storage takes place exclusively locally on the user's device.

Because voice input may contain information about nutrition, body weight or nutrition goals, users should only speak information whose processing they want for the use of this feature.

Legal basis: Article 6(1)(b) GDPR; where health data is concerned, additionally Article 9(2)(a) GDPR.

5.4 Local Storage Within the App

Recorded meals, nutritional values, goals, personal information and settings are stored exclusively locally on the user's device.

This data is not stored permanently on our servers. Our backend processes inputs only temporarily where this is technically necessary for the requested AI feature.

No user account or cloud synchronization is currently provided.

If the app or its local app data is deleted, stored meals, goals and settings may be lost.

5.5 Use of OpenAI

For AI-supported voice input and for the recognition and structuring of meals, the data required for the respective feature is transmitted to OpenAI services.

This may include in particular audio recordings, the resulting text, manually entered meal descriptions and contextual data required for modification or reference-based inputs.

For phrases such as “my usual breakfast,” “same as yesterday” or “twice as much rice,” only the locally stored comparison or contextual data required for the specific request may be transmitted to OpenAI.

Only the data necessary to process the respective request is transmitted.

OpenAI processes this data as a processor on the basis of a Data Processing Addendum. Processing by OpenAI, affiliated companies or subprocessors outside the European Union or the European Economic Area, in particular in the United States, cannot be ruled out.

Where personal data is transferred to third countries, this is carried out on the basis of appropriate safeguards, in particular the European Commission's Standard Contractual Clauses or an adequacy decision, where applicable.

According to OpenAI, data transmitted via the API is not used to train OpenAI models by default unless the provider expressly agrees to another use of the data.

Legal basis: Article 6(1)(b) GDPR; where health data is concerned, additionally Article 9(2)(a) GDPR.

5.6 Accuracy of Nutritional Information

The calorie and nutritional information determined by MacroPilot is based on automated estimates. It may vary, in particular where quantities are imprecise, recipes are unknown, restaurant meals are involved or preparation methods differ.

Users can review the detected information and correct it where necessary. No decision based solely on automated processing that produces legal effects or similarly significant effects within the meaning of Article 22 GDPR takes place.

5.7 Necessity of Providing Certain Data

• Without a meal description, AI-supported recognition and nutritional calculation cannot be performed.
• Without personal information, certain individual target values may not be calculated.
• Without an email address, we cannot respond to support requests.

6. Payment Processing and Management of In-App Purchases

6.1 App Stores

Paid features are purchased through the Apple App Store or the Google Play Store. Payment processing and the processing of payment data, such as credit card information, are carried out exclusively by the respective store operator in accordance with its own privacy policy. We do not receive the user's full payment details.

6.2 In-App Purchases and Subscriptions via RevenueCat

We use RevenueCat, provided by RevenueCat Inc., 1032 E El Camino Real #1055, Sunnyvale, CA 94087, USA, to process, manage and validate in-app purchases and subscriptions.

In order to determine whether paid features must be unlocked for a user, the following data may be processed in particular: a pseudonymous app user ID, product and transaction identifiers, purchase date, store, country or region, subscription status and expiry date.

RevenueCat does not receive full credit card or bank account details from us. Because RevenueCat also processes data in the United States, transfers to third countries are carried out on the basis of appropriate safeguards, in particular the European Commission's Standard Contractual Clauses or an adequacy decision, where applicable.

Legal basis: Article 6(1)(b) GDPR

7. Tracking, Analytics and Marketing

7.1 App Tracking Transparency and Advertising Identifier

If we wish to access an advertising identifier such as the IDFA on iOS devices or link user activity with data from other companies for advertising purposes, we first ask for explicit permission through Apple's App Tracking Transparency framework.

Without such consent, the IDFA is not read for these purposes. Consent can be changed or withdrawn at any time in the iOS system settings under “Privacy & Security” and “Tracking.”

Legal basis: Article 6(1)(a) GDPR

7.2 Mobile Attribution and Analytics via AppsFlyer

We use AppsFlyer Ltd. to measure through which advertisements or marketing channels users found and installed MacroPilot and to statistically evaluate certain app events.

Depending on the platform, consent status and technical configuration, the following data may be processed in particular:

• IP address and technical device information,
• pseudonymous device or installation identifiers,
• information about the advertising campaign and installation source,
• app launches and selected events such as viewing a paywall or completing a purchase,
• an advertising identifier such as the IDFA where consent has been granted.

Content relating to individual meals is not intended to be transmitted to AppsFlyer for advertising or attribution purposes.

Legal basis: Article 6(1)(f) GDPR for privacy-conscious, pseudonymous reach and performance measurement; Article 6(1)(a) GDPR where consent is required.

7.3 Performance Measurement via Advertising Platforms

To measure and optimize advertising campaigns, selected technical or aggregated app events may be transmitted to the relevant advertising platform, such as TikTok, Apple or Google.

These events may include an app installation, an app launch, the display of a paywall or a completed purchase. Content relating to individual meals is not intended to be transmitted for advertising purposes.

Where consent is required for such transmission, the data is transmitted only after the user has given prior consent.

Legal basis: Article 6(1)(a) GDPR where consent is required; otherwise Article 6(1)(f) GDPR.

8. Contact by Email

If users contact us by email, we process the data transmitted solely for the purpose of handling the request.

Email communication is provided through:

IONOS SE
Elgendorfer Str. 57
56410 Montabaur
Germany

Depending on the content of the message, the following data may be processed in particular:

• email address and, where applicable, name,
• content of the request,
• voluntarily submitted attachments or diagnostic data.

Legal basis: Article 6(1)(b) GDPR or Article 6(1)(f) GDPR

We delete support requests after they have been fully resolved, unless statutory retention obligations or legitimate reasons require further storage.

9. Disclosure of Data

We disclose personal data only where this is necessary to provide our services, where there is a legal obligation or where the user has given consent.

For this purpose, we use in particular the following service providers or recipients:

• Hetzner Online GmbH for hosting and server operation,
• OpenAI companies and their subprocessors for AI-supported processing of meal descriptions and voice input,
• IONOS SE for email communication,
• Apple or Google for store and payment processing,
• RevenueCat Inc. for the management of in-app purchases and subscriptions,
• AppsFlyer Ltd. and, where applicable, advertising platforms used for attribution and performance measurement.

10. Storage Period

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations.

In particular, the following currently applies:

• server log data: generally approximately 14 days,
• locally stored meals, profile data, goals and settings: generally until deleted by the user, until the app data is deleted or until the app is uninstalled,
• inputs transmitted to our backend and to OpenAI: only for the technical performance of the respective request; no permanent storage of this data on our servers,
• purchase and subscription data: for as long as necessary for contract processing, feature activation, fraud prevention and statutory documentation obligations,
• support emails: until the request has been fully resolved and beyond that only where statutory retention obligations or legitimate reasons apply.

Where data is deleted or consent is withdrawn, the data is deleted unless statutory obligations or overriding legitimate grounds prevent deletion.

11. Rights of Data Subjects

Subject to the applicable legal requirements, data subjects have in particular the right to:

• obtain information about personal data being processed,
• have inaccurate or incomplete data corrected,
• request deletion,
• request restriction of processing,
• receive data in a portable format,
• object to processing based on legitimate interests,
• withdraw consent with effect for the future.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority.

12. Data Security

We use appropriate technical and organizational measures to protect personal data against loss, misuse, alteration and unauthorized access.

These measures include in particular:

• encrypted data transmission via TLS,
• server-side access restrictions,
• limiting access to what is necessary,
• regular rotation of server logs,
• pseudonymous processing of purchase and attribution data where possible,
• privacy-conscious transmission to external service providers.

13. Minors

MacroPilot is not specifically directed at children. Minors should use the app only in accordance with the legal requirements applicable to them and, where necessary, with the consent of their parents or legal guardians.

14. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy if technical features, service providers, legal requirements or our data processing activities change.

The version published at the time the website is visited or the app is used applies.