Privacy Policy for SirPrep

The controller responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Viktoriia Hrodetska
Heidenheimer Strasse 24
85748 Garching bei Muenchen
Germany
Email: info.foodb@gmail.com

We process your personal data only to the extent necessary to provide the features and functionality of SirPrep, a web app for weekly meal planning and grocery lists across supported grocery markets. Depending on how you use the app, we may process:

• Account and authentication details
• Meal-planning data, such as self-declared nutrition goals, app-managed country, preferred language, grocery store, budget, taste defaults, diet preferences, meals per day, weekly notes, permanent exclusions, and ingredients excluded for one generation. Legacy household-size values may remain in older stored profiles for compatibility; newly generated meal plans are scaled to one person.
• Generated or saved weekly meal plans, recipe cards, shopping lists, durable liked or avoided meal snapshots, and estimated per-serving nutrition values
• Meal-planning credit usage, including generation window, credit cost, and reservation status
• Subscription status and billing identifiers
• Technical diagnostics, security logs, and transient rate-limit signals such as account identifiers or IP addresses

SirPrep uses the preferences you provide to generate practical meal plans, grocery estimates, and grouped shopping lists. This information is not intended to be medical data. Self-declared calorie, protein, or fiber goals are planning preferences. The optional nutrition-goal calculator may use age, height, weight, sex-formula selection, activity level, and goal direction in your browser to fill these targets, but those metric inputs are not submitted to SirPrep's servers. Estimated calories, fiber, and macros describe generated meals per serving; SirPrep does not provide medical, nutritional, or health advice.

The public grocery waste calculator processes country, monthly spend, household size, shopping and takeout habits, goal, and an optional store only in your current browser tab. Its draft and Planning Profile handoff use sessionStorage, are not placed in URLs or analytics events, and reach SirPrep only after you review and save the Planning Profile. The illustrative waste estimate itself is not stored in SirPrep's database.

• Purpose: We process this data to provide meal planning, saved weekly plans, shopping lists, and budget-oriented grocery planning features.
• Legal basis: The processing is necessary for the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR). Where you provide optional preferences, processing may also be based on your consent (Art. 6(1)(a) GDPR).
• Data control: You can update your planning preferences in the app and delete your account in Account settings. For additional deletion requests, contact us at the email address listed above.

To operate the app securely and efficiently, we use the following third-party service providers.

4.1. Clerk (Authentication)

We use Clerk to provide hosted account creation, sign-in, session management, and related authentication security features.

• Provider: Clerk, Inc., USA.
• Data processed: Account identifiers, email address, authentication events, session information, and security metadata.
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in secure authentication (Art. 6(1)(f) GDPR).

4.2. Aurora PostgreSQL-Compatible Database (App Data)

We use an Aurora PostgreSQL-compatible database to store app data required for meal planning and saved weeks.

• Data processed: Planning preferences including self-declared nutrition goals, app-managed country and preferred language, diet preferences, permanent exclusions, taste and grocery-planning defaults, saved weekly meal plans, durable liked and avoided meal snapshots, meal-planning credit usage, recipe cards, shopping-list details, and subscription state keyed to your account identifier. Optional calculator body metrics are not stored in the database.
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

4.3. Stripe (Payments and Subscriptions)

We do not process card payments directly. Stripe Checkout collects the billing address and payment method for paid plans and the seven-day trial. Stripe may convert the EUR base price into a local currency. Stripe's billing portal manages the subscription, invoices, payment method, and cancellation.

• Provider: Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA.
• Data processed: Billing contact details, payment status, subscription identifiers, invoices, and payment method metadata. We do not store raw card details.
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legal accounting obligations (Art. 6(1)(c) GDPR).

4.4. Google Generative AI (Meal Plan Generation)

SirPrep uses the Gemini API from Google to generate meal-plan content from your grocery-planning preferences.

• Provider: Google Ireland Limited, Ireland (via Google Cloud).
• Data processed: Country, preferred language, store choice, budget, day count, meals per day, taste profile, self-declared nutrition goals, diet preferences, weekly notes, permanent exclusions, ingredients excluded for one generation, durable liked or avoided meal snapshots, and similar planning inputs. Newly generated meal plans are scaled to one person; legacy stored household-size values are not needed for Gemini meal-plan generation. For recipe cards, we also send the selected saved meal and its ingredients. Browser-only nutrition calculator metrics are not sent to Gemini.
• Data minimization: We do not intentionally send direct account identifiers, such as your name or email address, to Gemini for meal-plan generation.
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and, where applicable, your consent for optional preferences (Art. 6(1)(a) GDPR).

Your personal data is stored only for as long as necessary to provide SirPrep, maintain your account, comply with legal obligations, resolve disputes, and enforce agreements.

Liked and avoided meal memory is stored independently from the calendar plan where the feedback was first given, so replacing that plan does not erase the memory. It is removed when the rating is cleared or the account is deleted.

You can delete your account in Account settings. When you confirm deletion, we delete the active SirPrep database records associated with your Clerk account: planning profile data, saved weekly meal plans, meal feedback and durable meal memory, meal-planning credit usage, recipe cards, shopping-list content inside saved plans, and locally stored subscription state. We then delete your Clerk account, so you can no longer sign in with that account.

If a Stripe subscription is linked to your account, we cancel that subscription immediately before account deletion. An active subscription cannot be restored in SirPrep after the account is deleted. Stripe, Clerk, or other service providers may continue to retain payment, invoice, security, or abuse-prevention records where this is necessary for legal obligations, dispute resolution, fraud prevention, or enforcement of agreements.

Some essential service providers may process data outside the European Economic Area (EEA), including in the United States. Where this occurs, we rely on appropriate GDPR safeguards such as the EU-US Data Privacy Framework for certified providers, Standard Contractual Clauses (SCCs), and technical and organizational security measures.

Under the GDPR, you have comprehensive rights regarding your personal data:

• Right of access (Art. 15): Request details about the data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your data.
• Right to restriction (Art. 18): Limit how your data is processed.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.

To exercise any of these rights, or to withdraw previously granted consent, please email us at: info.foodb@gmail.com.

We use technical and organizational security measures, such as TLS encryption in transit, access controls, and server-side integration boundaries, to protect personal data from unauthorized access, accidental loss, destruction, or manipulation.

To reduce abuse and protect paid infrastructure, selected server actions use short-lived rate-limit counters keyed to a signed-in account identifier or, when no account is available, an IP address. These counters are used for security and reliability purposes and expire automatically.

SirPrep uses AI to generate meal-plan suggestions, but these suggestions are informational and user-controlled. We do not engage in legally binding automated decision-making or profiling that produces legal effects concerning you within the meaning of Art. 22 GDPR.

If you believe that the processing of your personal data violates data protection laws, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). You may contact the data protection authority in your habitual residence, your place of work, or the location of the alleged infringement.