WhatEat
WhatEat
FeaturesHow it worksPlans
Legal Document

Privacy Policy & Data Protection

Aplicación: WhatEat
Software Ownership: Author & Technical Creator of WhatEat (Scientific & Technical Creation protected by Intellectual Property Law)
Merchant of Record & Billing: Polar Software, Inc.
Legal Contact & Inquiries: app@whateat.es | Córdoba, Spain

2.1. Data Controller & Contact

The data controller for WhatEat is the legitimate author and copyright owner of the software. For privacy inquiries and data protection rights, contact: app@whateat.es.

2.2. Categories of Data Processed

To provide technical and algorithmic services, the following categories of data are processed:

  • Account & Identity Data: Email address and a system-generated unique User ID.
  • Anthropometric & Profile Data: Age, weight, height, self-reported activity level, and caloric/macronutrient goals voluntarily entered by the user.
  • Dietary Records: Food logs, custom recipes, meal plans, favorite menus, and macro cycles.
  • Subscription Status: Access tier (Free, Trial, Premium) and expiration dates synchronized with Polar (WhatEat never stores credit card or banking details).

2.3. Legal Basis for Processing

  • Contractual Performance (Art. 6.1.b GDPR): Authentication, session management, and delivering core software calculation features.
  • Explicit Consent (Art. 6.1.a & Art. 9.2.a GDPR): Processing user-provided metrics and dietary choices solely to generate requested nutritional calculations.
  • Legal Compliance (Art. 6.1.c GDPR): Fulfilling statutory and regulatory obligations.

2.4. Data Processors, Security, and Protection of Anthropometric Data

Data is transmitted end-to-end encrypted using secure protocols (HTTPS / TLS) and stored on high-security servers provided by Supabase (with encryption at rest and strict GDPR compliance). Payment transactions and tax compliance are processed by Polar Software, Inc. Under no circumstances are personal or anthropometric health/wellness data sold, rented, or transferred to third-party advertising networks, insurance companies, or data brokers.

2.5. Data Retention & Erasure Timeline

Data is retained while the account is active. Upon an account deletion request (in-app, web, or email), associated personal records are permanently erased from active databases within a maximum period of 30 days, retaining only records required by statutory legal retention obligations.

2.6. User Rights

Under the GDPR and international data privacy regulations, users may exercise rights of Access, Rectification, Erasure (Deletion), Restriction, Portability, and Objection by emailing: app@whateat.es, or directly execute self-service account deletion via our official portal at: https://whateat.es/delete-account (or https://whateat.es/eliminar-cuenta).